Elements of nuclear safety

i i ELEMENTS OF NUCLEAR SAFETY Jacques LIBMANN English translation by Jean Mary Dalens Avenue du Hoggar Zone Indu...

Author: J. Libmann

122 downloads 1396 Views 27MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!
Report copyright / DMCA form

DOWNLOAD PDF

i

i

ELEMENTS OF NUCLEAR SAFETY

Jacques LIBMANN

English translation by Jean Mary Dalens

Avenue du Hoggar Zone Industrielle de Courtabœuf BP 112 91944 Les Ulis cedex A, France

Book series coordinated by Henri Mètivier Books already published: Agriculture, Environnement et Nuclèaire : comment reagir en cas d'accident Auteurs : Rene Coulon, Jacques Delmas, Gerard Griperay, Philippe Guetat, Rene Loyau, Claude Madelmont, Rèm ; yMaximilien, Jean-Claude Rottereau Traitement de la contamination interne accidentelle des travailleurs Auteurs : M.H. Bhattacharyya, B.D. Breistenstein, H. Mètivier, B.A. Muggenburg, G.N. Stradling, V. Volf Approche de la surete des sites nuclèaires Auteur : Jean Faure Circonstances et consequences de la pollution radioactive dans I'ancienne Union soviètique D. Robeau, Coordinateur. Auteurs : Jean-Claude Nènot, Christian Chenal, Sabine Charmasson, Daniel Robeau, M. Bertin, Philippe Renaud, Henri Maubert, Andre Jouve, Alexandre Grebenkov Elements desûretènuclèaire Elements of Nuclear Safety (Russian version in preparation) Auteur: Jacques Libmann Le tritium - de I'environnement a I'Homme Yves Belot, Monique Roy et Henri Mètivier, Coordinateurs. Auteurs : Y. Belot, M. Roy, H. Mètivier, P. Pihet, Ph. Duport, A. Flüry-Hèrard, E. Rabin, Ph. Boucquey, F. Briot, P. Giroux, J.Y. Hervè, J.P. Le Goff et G. Pescayre Radionuclides in the Oceans P. Guèguèniat, P. Germain and H. Mètivier, Coordinators

ISBN : 2-86883-286-5 This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broad-casting, reproduction on microfilms or in other ways, and storage in data banks. Duplication of this publication or parts thereof is only permitted under the provisions of the French Copyright law of March 11, 1957. Violations fall under the prosecution act of the French Copyright Law. © Les Editions de Physique 1996

Foreword This basically educational document draws much of its substance from all the various activities of the Institute for Nuclear Safety and Protection (IPSN), the technical support body of the Nuclear Installation Safety Directorate (DSIN). The latter organizations however may under no circumstances be considered liable for its contents. Its purpose was to heighten awareness among analysts and more generally among all those concerned by nuclear safety. The safety picture presented is consequently not intended to be well-balanced. It is moreover imbued with the activities and viewpoints of the IPSN, which is only one of the safety organisms concerned. The present document is an extensively supplemented revision of work published in 1988 by the National Institute for Nuclear Science and Technology (INSTN) under the title "Approche et analyse de lasûretèdes rèacteurs eau sous pression". As in the previous case, this work would not have been possible without the technical and financial assistance of the DSIN. The personal acknowledgments featured in the 1988 publication remain intact for the present version, as follows: Monique Libmann; MarieClaire Dupuis, Bernard Barrachin, Andr Cayol, Bernard Fourest; Daniel Quèniart,Yves Chelet, Fran ois Cognè. The basic raw material for a general review of the activity of a large group is the actual work of the members of the group considered. This was, of course, the case for the present document and I should like to mention in a far from exhaustive list some of those on whom I relied for assistance: Roland Avet-Flancart, Bernard Barbe, Alain Bardot, Bernard Barrachin, Bernard Bartholmè, Geneviève Beaumont, Claude Birac, Christine Bonnet, Jean Bourgeois, Louis Brègeon, Jacques Brisbois, Jean-Paul Bussac, Gerard Cadolle, Marc Champ, Yves Chelet, Alain Chesnel, Jean-Pierre Clausner, Francois Cogne, Yvon Cornille, Patrick Cousinou, Bernard Crabol, Michel Delage, Gerard Delettre, Gerard Depond, Yves Droulers, Fran ois Ducamp, Jacques Duco, Marie-Claire Dupuis, Veronique Fauchille, Jean Faure, Christine Feltin, Bernard Fourest, Denis Goetsch, Christian Giroux, Alain

IV

Elements of nuclear safety

Gouffon, Gilbert Gros, Fran ois Heili, Jean-Yves Henry, Karine Herviou, Jean Jalouneix, Laurent Janot, Martial Jorel, Anne Jouzier, Patrick Jude, Mil ne Julien-Dolias, Jeanne-Marie Lanore, Michel Laverie, Corentin Le Doare, Catherine Lecomte, Joseph Lewi, Alain L'Homme, Marcel Le Meur, Agnes Levret, Daniel Manesse, Jean-Marie Matt i, Jean-Pierre Merle, Henri Metivier, Jean-Luc Milhem, Bagher Mohammadioun, Jean-Claude N not, Jacques Ney, Nicole Parmentier, Dorothee Pattee, Fr d rique Pichereau, Jean-Louis Pierrey, Jean-Claude Puit, Daniel Queniart, Bruno Rague, Henri Roche, Francois Rollinger, Lucien Rousseau, Monique Roy, Jacques Savornin, Jean-Jacques Seveon, Henri Bureau, Pierre Tanguy, Nicholas Tricot, Serge Vidal-Servat... Consistency of principles and their expression was once again assured by Daniel Queniart, who thus made a decisive contribution to the contents of this text. The readability of the book, both for French and foreign readers, was vastly improved thanks to the advice and comments of Nathalie Rutschkowsky. Philippe Vesseron and Henri Metivier fostered its publication in this form, whilst Etienne Benoist encouraged its translation into English and Russian. To Monique Libmann and Monique Roy was entrusted the thankless task of rereading. I am most honored that Mr. Andre-Claude Lacoste, Director of the DSIN and Chairman of the Board of Management of the IPSN, has accepted to preface the book. I thank them all. Needless to say, any errors and imperfections which may nevertheless have been overlooked remain my entire responsibility. Jacques Libmann

Preface Like many other industrial safety fields, nuclear safety has developed considerably over the last few decades. An essential component of the very notion of safety is doubtless the ceaseless quest for improvement. The impact of these developments on organizations is in part related to the more widespread use of nuclear energy. The prime responsibility of nuclear operators for the safety of their plants is now clearly acknowledged by the International Convention on Nuclear Safety, as is the necessity for each country concerned to constitute a competent safety authority, independent of organisms promoting nuclear energy. It was only in 1973 that such a nuclear safety authority (SCSIN) was set up in France, as a department of the ministry of industry. Twenty years later, it became the DSIN (nuclear installation safety directorate), responsible to the ministers for industry and for the environment respectively. For several years now, the running of this department has been supervised by the Parliamentary Office for Assessment of Scientific and Technological Options and the implementation of nuclear safety statutory provisions is currently being considered. Technical repercussions have also been extensive, since ideas have considerably progressed in France since the initial adoption of the American PWR design, accompanied by its already voluminous package of regulatory or pararegulatory texts. The EDF and Framatome engineers, together with those of the safety authority and its technical support structure, the IPSN, had first to become thoroughly acquainted with the basic reactor type before gradually moving on to a more practical approach, involving the control of accidents considered as beyond design basis events in American practice and even those culminating in core meltdown. Deep thinking along these lines even led to certain previously adopted but inadequately validated criteria being called into question, such as the use of fuels with high burnup fractions. These gradual developments, prompted by know-how advances, whether based on operating feedback or research and development results, are the subject matter of Jacques Libmann's book.

VI


Throughout his career at the IPSN, Jacques Libmann has personally followed all the varied details of this progression, as now witnessed by his book. Many of you will remember him from their training courses, both in France and abroad, when he succeeded in convincing his listeners of the soundness of the basic safety principles which have gradually been defined. The publication of this book will doubtless widen his audience even further and will be beneficial to all those seeking either an introduction to nuclear safety or further insight into specific aspects of the subject. The time history approach has the advantage of showing how real improvements are achieved, sometimes after false starts, by pragmatic research where accepted ideas may have to be called into question. Current developments are aimed beyond national contexts at European, or even worldwide harmonization of safety practices, together with significant improvements on the safety level presently attained. This is notably the goal of the future PWR developed by the French and German utilities and plant builders (EPR project). May Jacques Libmann's book assist all those, whether they be designers, operators or safety authority specialists, who, in France or abroad, are responsible for nuclear plant safety issues! Andre-Claude LACOSTE Directeur de la S ret des installations Nucleaires

Contents 1. 1.1. 1.2. 1.3. 1.4. 2. 2.1. 2.2. 2.3. 2.4. 2.5. 3. 3.1. 3.2. 3.3. 3.4. 3.5. 4. 4.1. 4.2. 4.3. 4.4. 4.5. 4.6. 5. 5.1.

Introduction

1

Radioactivity and the biological effects of ionizing radiation..

5

Units used Natural radioactivity Biological effects of ionizing radiation Radiation protection principles

5 6 7 16

Nuclear safety organization

19

Nuclear security and safety Nuclear safety organization and responsibility sharing Safety analysis reports and regulations Developments in safety goals Safety Culture

20 21 23 27 28

Deterministic safety approach

31

Determination of specific risks Potential risks, residual risks, acceptable risks The barriers The defense in depth concept Quality Control

31 33 35 38 45

Analysis of operating conditions

47

Classification of operating conditions Definition of design basis operating condition categories Choice of operating conditions Operating conditions: list and subdivisions Operating condition analysis process Consideration of internal or external hazards

47 49 50 52 55 64

Assessment of the radiological consequences of accidents

65

Quantities of radioactive products involved

66

VIII 5.2. 5.3. 5.4. 5.5. 5.6. 5.7 5.8. 5.9.

Elements of nuclear safety Release rates Transfer and deposit in reactor systems Transfer and deposit in buildings Leak rate to the outside atmosphere and filtering provisions Environmental transport and deposit conditions Pathways to man Dose conversion factors Changes in radiological consequence calculation methods

67 68 68 69 69 72 72 74

An example of accident analysis: LOCA

75

6.1. 6.2. 6.3. 6.4. 6.5.

Physical effects of a large break Assumptions adopted in safety analysis Acceptability criteria and results Evaluation of radiological consequences Safety demonstration evolution

72 82 84 85 90

7.

Assessment of safety justifications

91

6.

7.1. 7.2. 7.3. 8. 8.1. 8.2. 8.3. 9. 9.1. 9.2. 9.3. 9.4. 9.5. 9.6.

Data drawn from operating condition studies Checking the number of lines of defense New safety demonstration requirements for the N4 series

92 105 108

A particular barrier point: the steam generator tubes

113

Steam generator tube rupture without human intervention Complementary French studies Dealing with the problem for the N4 series

115 117 118

Internal hazards

121

Missiles from inside the containment The results of piping breaks Turbogenerator bursting Protection against load dropping Fire protection Internal flooding

122 123 124 126 129 132

10. External hazards 10.1. 10.2. 10.3. 10.4. 10.5.

Determination of earthquake hazards Protection against aircraft crashes Industrial hazards Floods Protection against other external hazards

11. Complementary operating conditions 11.1. Origins 11.2. The position of the safety authorities

135 136 141 145 147 149 151 151 152

Contents 11.3. Complementary operating conditions 12. Probabilistic assessment of an accident sequence 12.1. 12.2. 12.3. 12.4. 12.5.

Effects of failures and initial assumptions Chronological list of the elements forming the scenario Required data Assessment results Revision of scenarios and their probabilities

13. The accident at Three Mile Island

IX 153 163 163 164 165 166 168 171

13.1. The accident 13.2. Causes of the accident 13.3. Lessons learned from the accident

171 177 180

14. The state-oriented approach

183

14.1. 14.2. 14.3. 14.4 14.5.

Limits of the event-related approach Development of the state-oriented approach First application of the state-oriented approach Generalization of the state-oriented approach Safety panels

15. Preparation for the management of severe accidents 15.1. 15.2. 15.3. 15.4. 15.5. 15.6. 15.7. 15.8. 15.9.

Core and vessel degradation The Rasmussen report "Source terms" Severe accident management studies in France Radiological consequences of source term S3 and intervention provisions List of ultimate emergency procedures Summary of procedures Internal Emergency Plan The fourth level of defense in depth

16. Special risks associated with criticality accidents 16.1. 16.2. 16.3. 16.4. 16.5.

Theoretical scenario A plausible scenario and corrective measures Identification of other dilution scenarios Other criticality accident hazards International information

17. Emergency preparedness and IPSN resources 17.1. Emergency preparedness 17.2. Role of the IPSN crisis team 17.3. Method and tools of the assessment cell

183 184 185 188 189 191 191 194 196 198 209 213 213 214 215 217 217 220 221 222 224 227 227 230 231

X


17.4. 17.5. 17.6. 17.7.

Methods and tools of the radiological consequences cell Conclusion on the method and tools External Emergency Plan Environmental transfer and deposit conditions

238 240 241 242

18. Severe accident research and development work

247

18.1. 18.2. 18.3. 18.4. 18.5.

Thermal hydraulic codes Fission product codes Fission product experiments Corium and containment building behavior studies Other on-going surveys

19. Probabilistic safety assessment 19.1. 19.2. 19.3. 19.4. 19.5. 19.6. 19.7.

Initiation of the studies Aims and organization of the studies Core meltdown probability assessment method Specificities of French studies Results of the 900 PSA survey Results of the 1300 PSA Comparison with studies undertaken abroad

20. Applications and development of probabilistic studies. 20.1. 20.2. 20.3. 20.4.

Use of probabilistic safety studies Development of these studies and tools Probabilistic assessment of radioactive release Conclusions on the probabilistic safety studies

21. The Chernobyl accident 21.1. 21.2. 21.3. 21.4. 21.5. 21.6. 21.7. 21.8.

The Chernobyl plant and the RBMK reactors The accident The release and its consequences Causes of the accident and lessons learned Future of the other Chernobyl units Lessons drawn in France Information of the general public and communication After Chernobyl

22. General operating rules 22.1. 22.2. 22.3. 22.4.

General operating rules Technical Operating Specifications Initial and periodic tests Emergency operating procedures

248 250 252 253 254 257 258 259 260 263 266 272 274

277 277 285 288 289 291 292 297 300 312 315 315 317 318 319 320 323 331 335

Contents

23. Incident analysis 23.1. Incident selection 23.2. Significant incident analysis methods 23.3. Case of a repetitive incident 24. Detailed analysis of incidents involving human factors 24.1. 24.2. 24.3. 24.4. 24.5. 24.6. 24.7.

XI

339 341 345 352 359

Pressurizer heater damage at Flamanville 2 Isolation of pressurizer level sensors at Cruas 2 Isolation of pressurizer level sensors at Gravelines 4 Analysis and lessons Check on sensor operability General considerations on maintenance activity quality Defense in depth applied to operation

360 366 368 369 374 374 377

25. Preventive maintenance and in-service surveillance

379

25.1. 25.2. 25.3. 25.4. 25.5.

In-service surveillance for large components Preventive maintenance of equipment Steam generators Steam line defects Closure head adapter cracking

26. Some French precursors 26.1. Incidents 26.2. Latent nonconformances revealed by inspections 27. Periodic safety review 27.1. Safety review methodology 27.2. Fessenheim and Bugey plant safety reviews 27.3. Safety review of the CP1 and CP2 standardized 900 MWe plant series 28. The international dimension 28.1. 28.2. 28.3. 28.4. 28.5.

The IAEA standards and guides program The Incident Reporting System French-German comparisons Services proposed by the IAEA Plants of soviet design

29. The next generation of reactors 29.1. 29.2. 29.3. 29.4. 29.5.

Setting up of French-German safety options Changes in safety objectives Application of the defense in depth concept Preliminary characteristics of the EPR project Illustration of defense in depth provisions

379 381 382 390 392 399 400 411 419 420 423 430 439 441 442 444 446 450 461 462 463 465 466 471

XII


30. Safety considerations on other nuclear installations

473

30.1. 30.2. 30.3. 30.4. 30.5. 30.6. 30.7. 30.8. 30.9.

477 477 479 482 486 495 500 504 506

Safety organization changes at the CEA General safety approach Safety objectives, notion of acceptability Risk potentials Design bases Safety analysis of an installation Operating safety Plant end of life Conclusion of this chapter

Conclusion

507

Appendix A - Basic safety rules

509

A.1 A.2

509

Rules concerning pressurized water reactors (June 1995) Rules concerning basic nuclear installations other than reactors (June 1995)

511

Appendix B - Regulatory texts related to quality

513

B.1. B.2.

513 520

Order of August, 10,1984 Circular of August, 10, 1984

Appendix C - French nuclear power plants

533

C.1. C.2. C.3. C.4.

533 534 535 535

Graphite-moderated, gas-cooled reactors (GCR) Heavy water reactor (HWR) fast breeder reactors (FBR) Pressurized water reactor (PWR)

Appendix D - Basic Nuclear Installations

539

D.1. D.2. D.3. D.4. D.5.

539 540 541 542 542

Experimental reactors in service Fuel cycle basic nuclear installations Other CEA basic nuclear installations Other nuclear installations Particle accelerators considered as basic nuclear installations

Introduction Nuclear installations present a specific risk in that they all contain, by definition, more or less substantial quantities of radioactive products. These can result in the exposure of individuals, populations or the environment to ionizing radiation and the consequences thereof. Nuclear installations for electricity generation fall, of course, in this category. Other sources of energy also involve risks, but our present purpose is not to draw comparisons. Moreover, we are well aware of public sensitivity in this respect, where radioactivity effects are associated far more with the military explosions of Hiroshima and Nagasaki, and now with Chernobyl, than with natural radioactivity or the benefits of radiotherapy. Our intention here is simply to present the methods and concepts used in the nuclear industry to ensure a satisfactory safety level for this activity. Safety results from a set of technical and organizational measures taken at all stages in the life of an installation to ensure that its operation and, more generally speaking, its very existence, present a sufficiently low-level risk as to be deemed acceptable for the staff, the general public and the environment. So what is actually involved is: • ensuring normal operating conditions which are conducive neither to excessive exposure of workers nor to release to the environment of radioactive waste with a high activity level • incident and accident prevention • limiting the consequences to workers, populations and the environment of any incidents and accidents which could nevertheless occur. This gives rise to provisions covering plant operation, but also its design, construction and decommissioning. It is to be noted that the idea of an acceptable risk is not grounded on clearly defined, absolute criteria, but is rather the result of choices of a sociopolitical nature which may evolve over a period of time and may differ from one country to another, depending on local economic conditions. In

2


this context, it is the role of the technicians to propose, but the final decision is based on political assessments integrating other contingencies. For any given installation, the process begins with identification of the nature and extent of the risks entailed. Only after this has been done can methods for ensuring safety be defined and analyzed. Several decades have now elapsed since nuclear plant construction and operation began in France. The reactors of the first type used in France, which were natural uranium-fuelled, graphite-moderated and CO2-cooled, have now all been shut down. Several of the installations currently in service were built to earlier standards, at least as regards technological developments and safety issues. Most of the pressurized water reactors presently operating in France were designed on the basis of the American plants under construction at the end of the sixties and the beginning of the seventies, at a time when world experience in this type of undertaking was limited. It is consequently not surprising that, although the basic principles defined at the outset of a project are not easily called into question, safety criteria approaches and analysis methods have considerably altered over the period of time involved. Now that substantial experience has been acquired, we are, or course, able to check whether the principles underlying the initial approach are still satisfactory and to compare actual plant behavior with the estimates made beforehand. The world's two most dramatic nuclear accidents, Three Mile Island in 1979 and Chernobyl in 1986, figure largely in this analytical process, without however overshadowing the many minor difficulties to be contended with in the daily running of an installation. Rather than describe current approaches to safety from a static status angle, we have opted for a partly historical presentation which reveals more clearly their dynamic and evolutive character. We shall base most of this presentation on the pressurized water reactors operated in France, although many other examples will also be used. In this document, we shall consider successively: • the deterministic approach, which is the main safety approach method • safety analysis methods based on accident analysis • the enhancement of these methods by development of the probabilistic safety approach and preparation for the management of particularly severe accident situations • operating feedback • subsequent evolution paths and the international dimension. Each subject will be illustrated with a number of examples.

Introduction

3

General topics such as the human factor or the importance of quality, could have been dealt with in separate chapters, but we have preferred, on the contrary, to avoid isolating them so that they can be referred to in the many contexts directly concerned by them. Finally, we shall insofar as possible base our discussion of the elements of this approach on general aspects, applicable to all nuclear installations, for it will be seen that if responses in each case must be adapted to specific potential risks, the same types of questions re-occur and have to be systematically examined. In order to situate the purpose of nuclear safety, we shall summarize in an introductory chapter the biological effects of radiation together with the main basic principles of radiation protection. This should enable the reader to better comprehend the extent of the consequences of the phenomena discussed. Similarly, safety awareness and practice involve a sharing of responsibilities defined by regulatory texts. In order to conserve the technical and philosophical rather than administrative disposition we have adopted, the second chapter will describe the organizational principles governing relations between the safety partners. This will give rise to reflections on the determination of "acceptable" risks and on what is now referred to as Safety Culture, to which we trust the present document will contribute.

This page intentionally left blank

1

Radioactivity and the biological effects of ionizing radiation

At the International Conference on the Safety of Nuclear Energy: Strategy for the Future, held in Vienna (Austria) on September 2-6, 1991, it was deemed advisable to present the basic biological effects of radioactivity to enable at least overall understanding, with a view to prevention, of possible radiological consequences of abnormal situations and of the basic principles of radiation protection. It is on the same grounds that the present work begins with a chapter on this subject. The text is adapted from the conference document prepared by an international working party entrusted with presenting the basic principles of safe use of nuclear energy. It draws extensively on the conclusions formulated by the organizations competent on this question, the International Commission on Radiological Protection (ICRP) and notably its publication No. 60, but also on certain more recent observations on the populations exposed following the Chernobyl disaster.

1.1. Units used The radioactivity unit is the becquerel (Bq), equal to 1 disintegration per second. As this unit is extremely small, multiplying prefixes are often employed: mega (M) = 106, giga (G) = 109 or tera (T) = 1012. The former unit is the curie (Ci), equal to 3.7 1010 disintegrations per second or becquerels and historically defined as the activity of one gram of radium 226. Since this unit is relatively large, minimizing prefixes were used: micro ( ) = 10-6, nano (n) = 10-9, pico (p) = 10-12.

Two units are used to express radiation effects on the human body. The gray (Gy) expresses the energy deposited in matter by a particle or radiation. 1 gray = 1 joule per kilo of material. It is the SI absorbed dose unit, replacing the former rad (1 Gy = 100 rad).

6


The shorter the path of each energy depositing particle, the greater will be the potential noxiousness of the absorbed dose. For comparison purposes, quality factors are used to express absorbed doses of any type in terms of dose equivalents for reference X and radiation effects. This quality factor is, by definition, 1 for electrons and X and radiation, 20 for alpha particles and heavy nuclei and from 5 to 20 for neutrons and protons. The dose equivalent is expressed in sievert (Sv). The former unit is the rem (1 Sv = 100 rem). Each tissue and organ has a specific sensitivity to cancer risks. For 100 cancers observed following homogeneous external exposure, there are 12 lung cancers, 5 breast cancers and 1 skin cancer, for instance. So a weighting (or sensitivity) factor is introduced to transpose the dose equivalent into an effective dose. In the event of internal contamination, irradiation continues until the radioelement responsible has been removed. In this case, we calculate the dose commitment due to the contamination, extrapolated over the next 50 years. In accordance with current regulations, this calculation is performed at the time of contamination. Effective and committed doses are also expressed in sievert. In accordance with regulatory practice, the term "dose" shall generally refer in what follows to an effective dose. The relationship between a becquerel and the corresponding gray or sievert number depends on the particle or radiation energy and its mode of interaction with the substance considered and, in the case of internal contamination, on the length of time the radioelement stays inside the organism.

1.2. Natural radioactivity Since the origin of man, humanity has been exposed to a wide spectrum of natural ionizing radiation. This exposure is due to cosmic radiation, gamma radiation from the earth and radioactive products naturally present in the human body, originating from food and water (mainly lead 210 and potassium 40) and from inhalation (mainly radon 222). The annual dose due to these natural sources averaged over all populations of the globe is between 2 and 3 millisievert (mSv), but varies between 1 and 5 mSv according to the place considered. Under average conditions, the contributions of the cosmic rays, the gamma rays from the ground and ingested products are approximately the same and equal to 0.3 to 0.4 mSv. So the fraction due to radon inhalation is much larger, representing up to 40% of this natural irradiation. It varies considerably according to place, dwellings, living conditions.

1 - Radioactivity and the biological effects of ionizing radiation

7

These values encompass marked variations and higher local doses can be observed in various places. Doses due to cosmic rays can be up to five times higher in high altitude inhabited areas. Annual doses due to terrestrial gamma rays can reach 35 mSv in certain places. The highest doses are due to radon and extreme annual doses can be in the region of 1 Sv. In France, the dose received by an individual can vary by a factor of 4, or even more for people living near uranium mines. On a worldwide basis, the variation factor is 16. In developed countries, the use of radiation for medical purposes adds a mean individual dose of 1 mSv per year. Obviously, the fact that natural radiation exists is no justification for additional exposure to artificial sources, such as nuclear energy. The only justification could be the overall benefit to society. However, these natural radiation dose levels are useful for purposes of comparison.

1.3. Biological effects of ionizing radiation 1.3.1. Biological processes Ionization, which involves the dispatch of an outer shell electron by a particle or radiation, modifies the atoms and molecules, at least momentarily. This can sometimes cause cell damage, which, unless correctly repaired, prevents the cell from surviving or reproducing or, more rarely, gives rise to a viable but modified cell. If enough cells are destroyed, the damage will be observable, corresponding to the loss of a tissue function. Beyond a certain exposure level, or threshold, impairment will be evident and its seriousness will increase with the dose. This type of effect is called "deterministic" or certain. A transformed but still living cell can sometimes lead to a malignant tumor or cancer, after a fairly long time lapse, known as the latent period. The probability of this type of cancer occurring depends on the dose received but the seriousness of the cancer is not conditioned by the dose. In this case, we describe the effect as "stochastic", random or probabilistic. If the function of the damaged cell is to transmit genetic data to descendants, effects of varying types and degrees of seriousness could appear in the descendants of the person irradiated. These are hereditary or genetic effects. As can be seen, it is not easy to appraise the consequences of exposure. They can include the probability of death, which perhaps would not occur for 20 or 30 years, the certainty of illness or death if the dose is strong

8


enough and the possible transmission of negative effects to future generations. It is customary to express effects in terms of probability of deaths incurred or serious hereditary deficiencies. This simplification makes no reference to the time intervals involved nor to less serious but significant consequences, such as non-fatal cancers, but these aspects are covered in the ICRP publication N. 60. Radioactive products released to the environment can transit from the environment to man. Other living species will also be exposed. In this context, the rules deemed appropriate for the protection of man ensure that no overall risk is run by the other living species, which are generally less sensitive than man. Certain species could occasionally be affected, but this would be a transitional, localized phenomenon. This is the case for a wooded area in the vicinity of the Chernobyl plant. Accidental release can result in limitations to use by man of plant and animal products without the products themselves being affected.

1.3.2. Quantitative radiation risk assessment The best sources of information on the biological effects of radiation are constituted by direct observation of the effects on man. However, biological research on microorganisms, in vitro cells and animals provide much complementary data on damage mechanisms and dose response relationships.

1.3.2.1. Deterministic effects Data on deterministic effects on man are provided by the effects observed on the pioneer radiologists, the effects of the Hiroshima and Nagasaki atomic bombs, the secondary effects of radiotherapies and the consequences of severe radiological accidents, some of which have occurred at nuclear power plants, due to medical or industrial sources. For most human organs, the serious deterministic effect threshold is equal to or above 1 Gy, especially if the dose is received in as short a time as about a minute. It is to be noted that what counts at these levels is directly the energy absorbed, i.e. the number of grays, regardless of quality factor aspects. Certain organs, such as the crystalline lenses or the skin, are more sensitive in the event of external exposure. With present radiation protection practice and standards, deterministic effects can only occur in accident situations.


9

The following guide data are based on experience of brief high level exposure: • beyond 10 Gy, death occurs rapidly • an untreated 5 Gy dose proves fatal in 50% of cases within 2 months • a 2 Gy dose causes rashes, loss of head and body hair • first short term effects (nausea, vomiting) are observed for a 1 Gy dose.

1.3.2.2. Stochastic effects To date, the three main data sources on stochastic effects are the epidemiological studies performed on the survivors of the bombing of Hiroshima and Nagasaki, on patients exposed to radiation for medical treatment or diagnosis and on certain classified workers, exposed professionally to radiation or radioactive products. Considered in the light of biological research results, these studies form the basis of the principles of radiation protection. The interpretation aspects of epidemiological studies are extremely demanding and under no circumstances enable conclusions to be reached as to the effects of very low doses, i.e. those below or approximately equal to the inevitable natural doses. This is because cancers and genetic illnesses frequently occur naturally in the population. The increase in cases of cancer causing death or other consequences of very low doses is so low as to be indistinguishable from other variations related to a lack of precision in relevant statistics or to various demographical factors. A significant increase in malignant tumors in human beings has only been observed for large, homogeneous populations, and for doses exceeding about 0.2 Sv, which was the case for the Japanese populations exposed. It should be borne in mind that the inevitable lifetime integrated dose for an individual due to natural radioactivity always exceeds 0.1 Sv. Epidemiological studies are proceeding in France and throughout the world, with the active participation of the IPSN (French Institute for Nuclear Safety and Protection). They notably concern the effects of radon on classified workers, such as those employed in uranium mines, and on living accommodation in certain regions. They also concern nuclear energy workers, including for France the staff of the CEA (French Atomic Energy Commission). Victims of the Chernobyl accident are also providing input for such studies, since the medical assistance they receive gives rise to the recording of scientific observations. Available observations corresponding to doses well beyond natural levels, interpreted on the basis of biological research results, can be extrapolated to give a reasonably accurate estimate of low dose risk levels. Radiation protection specialists are generally at one in considering that in the light of present knowledge in this respect and from the standpoint of protection

10


and regulatory procedure, thus implying extreme prudence, a linear relationship without a threshold should be adopted between doses and stochastic effects. It is generally accepted that taking 5% as the probability of occurrence of fatal cancer due to one sievert for the whole population exposed to low doses should not underestimate the risk involved. Genetic effects have not been explicitly demonstrated in man. Assessments are consequently based on experiments on animals, on lines consistent with human observations. The extensive scale of gravity of genetic disorders makes it difficult to define a proportionality coefficient, but for deficiencies classified as "severe", the ICRP considers a coefficient of 1% per sievert for the whole population. A child in the womb can be affected by exposure, although this would not appear to be the case during the first weeks of pregnancy. Beyond this period, a dose to the fetus exceeding 0.1 Sv can impede its development. Certain child cancers may be related to prenatal exposure, as shown by the thyroid cancer studies carried out on children exposed during the Chernobyl accident. The sensitivity of the fetus is doubtless slightly higher than that of the adult. Japanese data indicate that the intelligence quotient of infants irradiated during pregnancy may be affected. The most sensitive period is between 8 and 15 weeks after conception but there is probably no significant difference for doses below 0.1 Sv.

1.3.2.3. Data derived from the Chernobyl accident The health monitoring of populations irradiated by the Chernobyl fallout and of the "liquidators" entrusted with cleaning the site during the weeks and months which followed the explosion of the reactor core, has enhanced our knowledge of radiation effects in two specific areas. The number of thyroid cancers in exposed children is much higher than expected. The most exposed populations and especially some of the liquidators whom it has been possible to trace, revealed a degree of morbidity, i.e. a relative frequency and gravity of diseases not specific to radioactivity, far higher than observed on an average for their fellow citizens. This health deterioration was first interpreted as evidence of post-traumatic stress disorder, characterized by anxiety, depression, psychosomatic illnesses and causing strained family relationships, divorces, increased consumption of alcohol, excessive use of medicines, violence, suicides and, more generally, behavioral problems.


11

Russian researchers and doctors from the All Russia Center of Ecological Medicine* noted, in studies which had remained secret, similarities between what they observed in the highly contaminated areas around Chernobyl, especially in the case of certain liquidators, and what they had noted in the Ural areas contaminated by the Kyshtym accident in 1957, involving the explosion and dispersion of a vessel containing a large quantity of radioactive products, and the Kazakhstan zones irradiated during atmospheric nuclear tests. These researchers are notably considering the possibility of radiation-induced impairment of the immune system resulting in the development of various non-specific pathologies. This team has now collected data concerning 75 000 of the 450 000 liquidators. Respiratory, digestive and central nervous system problems were observed in a significant proportion of those where exposure had exceeded 0.25 Gy. This value is below the generally accepted threshold for the appearance of deterministic effects. Many publications on this subject are now available, either from the United Nations Scientific Committee on the Effects of Atomic Radiations (UNSCEAR) or the Organization for Economic Cooperation and Development (OECD). Mortality assessments for these populations have so far given conflicting results. If it is certain that deaths occur in these populations, it is obvious that this is also the case in unexposed populations, so that without accurate data on the mortality rates in both populations it is difficult to reach conclusions. The ICRP publication N. 60 gives an idea of annual mortality rate variations according to sex and age for the populations of 18 industrialized countries where health conditions are considered satisfactory (Fig. 1.1.). These graphs are not directly applicable to populations where the average lifetime is shorter. However, they give minimum estimates showing, for instance, that in a 10 year period, about 10 000 to 20 000 deaths should be expected in a population of 1 million men aged between 20 and 30 at the beginning of the period considered. Owing to the problems involved in assessing the exposures due to the Chernobyl disaster, it has not yet been possible to determine the relationship between doses and effects. Doctors and scientists are presently concentrating on collecting as much reliable data as possible with a view to launching the requisite complementary studies.

This is an interministerial organization responsible to the ministries for health and for defense, the State Committee on Chernobyl, the State Committee on health supervision and epidemiological surveys and the Military Academy of Medicine.

12


Fig. 1.1. Annual mortality probability as a function of age (developed countries).

1.3.3. Epidemiology limitations Observation of low dose effects is impeded by the statistical and demographical limits of epidemiological studies.

1.3.3.1. Statistical limitations The mean cancer mortality rate observed in developed countries is about 20 to 30%, covering cancers of all origins and notably any natural radioactivity effects. This mean rate masks significant variations from one population to another. In particular, as cancer is an illness which generally develops slowly, the risk of death by cancer increases with age. This means that the cancer


13

mortality rate tends to increase in long-lived populations, where other causes of death have diminished.

Fig. 1.2. Number of deaths observed in metropolitan France.

This is what can be seen on the charts presented, based on the annual tables of numbers and rates of death from all causes (Fig. 1.2.) and by cancer (Fig. 1.3.) recorded and published in France by INSERM* for male and female populations. The statistical significance of these tables, based on a population of over 50 000 000 people, is considerable. They report yearly more than 500 000 deaths, where cancer is the identified cause in 130 000 cases. The following facts are noteworthy: • a slight drop in the annual mortality rate whereas there is a slight increase in the population due to an increase in the average life span • fluctuations in these figures, which can reach 3% from one year to another • the slow, fairly regular increase in the number of cancer deaths • the much higher number of fatal cancers in men than in women, notably due to tobacco and alcohol • a certain increase in the proportion of cancers as causes of death, this increase tending to be higher for men (Fig. 1.4.). Despite the size of the sample, fluctuations are obvious but the reasons for them are difficult to identify. This gives an initial idea of the limits to what can be conclusively established by observation alone. * INSERM, Service d'information sur les causes medicales de deces, SC8, 44 Chemin de ronde, 78110 Le Vesinet.


14

Number of cancer deaths per year

Fig. 1.3. Number of cancer deaths in metropolitan France.

On the basis of statistical considerations and bearing in mind the relationship between the absorbed dose and the probability of fatal cancer being induced, we have to compare two homogeneous population groups, each comprising about 1 000 people, in order to establish significant observations as to the effects of a 1 Sv dose on all the members of one of the groups.

%

Fig. 1.4. Percentage of cancers in causes of death in metropolitan France.


15

To be able to observe the effects of a 0.1 Sv dose, we should need two groups of 100 000 people, with one group having systematically received the dose considered. For a 10 mSv dose, which is still higher than the mean natural exposure level, we should need two equivalent groups of 10 000 000 people, which is not realistically obtainable.

1.3.3.2. Demographical limitations The second difficulty pertains to the necessity to check that no factor which could influence the proportion of cancers has varied between the observed group and the reference group. But there are a large number of these factors. The first concerns sex and age distributions, but corrections can be made. Others concern living conditions, feeding habits, genetic composition (degrees of consanguinity), the environment, various infection hazards. Corrections in all these fields are inaccurate or inexistent. For geographically separated groups, it is highly unlikely that these different factors could be satisfactorily controlled, which introduces an additional uncertainty of a few percent. Two reference groups may be characterized by cancer percentages in the causes of death of 25% for one and 23 to 27% for the other, without it being possible to explain exactly why this is so. This prevents significant observation of the effects of doses smaller than 0.5 Sv, even for very large groups. The only exception, of course, concerns the studies undertaken following the Japanese explosions where irradiated and reference groups came from a homogeneous population. On the other hand, if there is no difference between the two groups, the harmlessness of doses lower than 0.5 Sv cannot be confirmed.

1.3.3.3. Other uncertainties There are, in addition, other sources of significant uncertainties. Most of the ionizing radiation effects observed pertain to brief high level exposures with high dose rates. However, in the case of high dose rates, several ionization phenomena can occur in the same cell in a short space of time, thereby amplifying the biological effects as compared with those resulting from low doses and low dose rates. The International Commission for Radiological Protection (ICRP) considers that this increase in the biological effect per unit dose of high doses at high dose rates as compared with low doses at low dose rates, the total exposure being, of course, constant, can be by a factor of 2 in cases amenable

16


to direct observation. This coefficient* is applied by the ICRP to determine the effects of low doses received over long periods, postulating a linear dose response relationship. We have little precise knowledge of this factor and in certain UNSCEAR studies, it is considered that it may vary between 2 and 10. The choice made by the ICRP is again intended to promote a prudent approach to protection. Moreover, it is difficult to accurately determine the dose received by each survivor of the Hiroshima and Nagasaki bombings, as for each victim of an accident. A re-assessment of the doses caused by the neutrons released during the Hiroshima and Nagasaki explosions is one of the factors which led to modifications to the ICRP recommendations. Another uncertainty is related to the fact that since the entire population observed is not yet deceased, we have to extrapolate the number of deaths to be attributed to radiation. There are two possible approaches. The additive approach consists in adding to the expected cancer rate in a population a surplus related to radiation. This would produce a wave of additional cancers, followed by a return to normal. The total would be easy to assess once the wave had passed. The multiplicative approach, on the other hand, considers the expected cancer rate in a normal population to be multiplied by radiation effects. In this case, the excess cancer among survivors will continue to increase throughout the lifetime of the sample group and can only be estimated once the entire population considered has died. It is difficult to model the reality of the problem set. As a precaution, the ICRP adopted the more pessimistic multiplicative model, but this pessimism should not exceed a factor of 2. Finally, it is no simple matter to apply observations made on a specific ethnic group to other groups. The cancer percentage for a specific organ may vary considerably, maybe by a factor of 10, but this difference is attenuated when all cancer cases are considered. It is most unlikely that the overall radiation sensitivity of a specific population of a country where the standard of living is relatively high would differ from the mean value by more than 30%.

1.4. Radiation protection principles In the light of present knowledge of the effects of ionizing radiation, the purpose of radiation protection is to preclude insofar as possible deterministic health effects by keeping doses below the specified thresholds and stringently limit the incidence of stochastic effects to a level deemed acceptable. * DDREF dose and dose rate effect factor.


17

In order to structure the principles to be applied, radiation protection specialists differentiate between two types of activity, both related to the existence, creation or use of radioactive products. These are known as "practices" and "interventions". The term "practice" refers to any human activity liable to increase the level of exposure of populations to radiation, as for example, by creating new sources of radioactivity. Using nuclear reactors for the generation of electricity falls within this category. The term "intervention" refers to any human activity liable to diminish the exposure level by modifying, for example, the transfer pathways between the source and man. An "intervention" is any protective action taken after an accident. The radiation protection system recommended by the ICRP for practices is based on the following three general principles: • no practice shall be adopted if the benefit to be gained by it is not sufficient with respect to the radiological detriment which it could cause. This is the principle of justification. • the doses induced by any radioactive source related to a practice shall be maintained as low as reasonably achievable (ALARA), taking social and economic factors into account. This is the principle of optimization. • the exposure undergone by any person due to controllable sources shall be subjected to individual limits deemed acceptable. This is the principle of limitation of individual doses. The new ICRP document, publication N. 60, published in 1991, deals in similar fashion with exposures liable to result from incidents or accidents and necessitating interventions. The principles to be respected in this case are as follows: • the dose reduction expected to be achieved by an intervention must be sufficient to counterbalance the prejudice to the workers involved and the cost, including the social cost, of the intervention • the intervention shall be planned in detail to ensure that the net benefit of the dose reduction be as comprehensive as could be reasonably expected • certain interventions liable to give rise to high doses for certain workers can only be justified by the need to prevent serious deterministic effects for a wider population. In this case, the principle of limitation of individual doses is inapplicable, since this could limit the beneficial effects for the community of undertaking an intervention. On the other hand, using the notion of potential exposure for installation design assessment raises difficulties discussed in 30.3. It can only be based on measurable individual risks, like the induction of a fatal cancer which has to be associated with the corresponding exposure probability. But both these terms are questionable.

18


The probability that a quantity of radioactive products liable to involve consequences for surrounding populations will be released can only be assessed with a considerable margin of uncertainty since it depends on the probability of the initiator, on the various events contributing to the scenario and on the behavior of retaining and containment systems. This uncertainty usually covers several powers of 10. It is also obvious, since the Chernobyl accident, that the individual health risk (probability that a fatal cancer will be caused) is not an adequate criterion for measuring the consequences of a nuclear accident. The number of persons involved, the degree to which the lives of individuals and communities will be disrupted and the economic consequences of countermeasures which will have to be implemented may themselves be unacceptable, without it being possible to associate a proportionality factor with an exposure level. Discussions are proceeding. These general radiation protection principles are formalized as specific norms relating to the different radioactive products, their modes of transmission to man, their "biological efficiency", differentiating between different categories of workers concerned and different population groups. Transposing from radioactivity expressed in Bq to exposure levels for individuals is discussed in sections 5.8, 6.4.1, 21.3.2 and 30.4.2. The ICRP N. 60 publication fixes annual dose limits which must not be exceeded: • 20 mSv per year over 5 years for workers without exceeding 50 mSv for any year. • 1 mSv for the general public. Adoption of these limits in France is presently proceeding.

2

Nuclear safety organization

The organization of nuclear safety in France has undergone modifications with passing time. It initially depended on the Atomic Energy Commission, which, when it was founded in 1945, was entrusted with the development of all aspects necessary to the utilization of this type of energy. In 1973, a specific safety organism was set up by decree within the ministry in charge of industry. This was the SCSIN (Central Service for the Safety of Nuclear Installations). In 1988, this central service was, in addition, placed at the disposal of the State Secretariat for Major Risks, the functions of which were subsequently taken over by the ministry for the environment, although it remained attached to the ministry for industry with regard to staff management. In 1991, this service became a directorate, the DSIN (Nuclear Installation Safety Directorate), with the same attributions. On a parallel, in 1976, that part of the CEA particularly assigned to the analysis and assessment of safety and radiological protection, was grouped in an institute, the IPSN (Institute for Nuclear Safety and Protection). The autonomy of this institute within the CEA has been reinforced several times and again in 1990 with a view to emphasizing the independence of safety structures with respect to all operating authorities. Other organizations are also involved in safety activities (Fig. 2.1). These are notably: • the Parliamentary Office for Assessment of Scientific and Technological Options, the scope of which is not limited to nuclear matters • the Interministerial Commission for Basic Nuclear Installations which is consulted for basic nuclear installation creation and modification license applications and on the relevant regulations • the High Council for Nuclear Safety and Information grouping managerial technical staff, representatives of the trade unions and of associations for the protection of nature and the environment and journalists. Its assignments cover all questions relating to the safety of nuclear installations and the information of the general public and the media • the Standing Groups, comprising high level experts who may be consulted by the Nuclear Installation Safety Directorate on the main assessments requested from the IPSN


20

• the Local Information Committees attached to all major power generating installations, most of which are nuclear. PARLIAMENTARY OFFICE FOR ASSESSMENT OF SCIENTIFIC AND TECHNICAL OPTIONS THE MINISTER IN CHARGE OF INDUSTRIE

ASSESSMENT STUDIES CONSULT • the high council for nuclear safety and information • the interministerial for basic Nuclear Installations

THE MINISTER IN CHARGE OF THE ENVIRONMENT

GOVERNMENTAL AUTHORITIES

TECHNICAL

Regional Industry Research and Environment Directorates

NUCLEAR INSTALLATION SAFETY DIRECTORATE DSIN

DRIRE

SUPPORTS INSTITUTE FOR NUCLEAR SAFETY AND PROTECTION IPSN

NUCLEAR

WASTE

REACTORS

REPOSITORIES

OTHER NUCLEAR INSTALLATIONS

NUCLEAR SECTION OF THE CENTRAL COMMISSION FOR PRESSURE VESSELS

STANDING GROUPS OF EXPERTS

Fig. 2.1. Nuclear safety in France, organization of the public authorities They are fully described in a brochure published in 1995 entitled "Nuclear Safety Supervision in France"*.

2.1. Nuclear security and safety Since the boundaries between these two terms are not always perceived in exactly the same way, it may be helpful to reiterate the comparative definition given by the DSIN itself: Nuclear safety implies the prevention of accidents - including those induced with malicious intent - and the mitigation of their effects. It also encompasses the technical provisions made to ensure the normal operation of facilities, without excessive exposure of workers, by optimizing the production and management of radioactive wastes and effluents.

* Direction de la surete des installations nucleaires, Documentation.

2 - Nuclear safety organization

21

Its scope falls within that of nuclear security, a wider concept, aimed at ensuring the overall protection of people and property against dangers, harmful effects and any forms of inconvenience which could result from the construction, operation and decommissioning of fixed or mobile nuclear installations, as well as from the storage, transport, use or transformation of natural or artificial radioactive substances.

2.2. Nuclear safety organization and responsibility sharing It should be noted that both the presentation below and the entire document only directly apply to fixed civil nuclear installations and concern neither military activities nor sources used for medical or industrial purposes. The principles of nuclear safety organization in France comply with the recommendations formulated by international organizations such as the IAEA (International Atomic Energy Agency) but also integrate national specificities. The main French nuclear installations are operated by particularly large organizations: EDF (Electricite de France) for the nuclear power reactors, COGEMA for most of the fuel cycle installations, the CEA (Atomic Energy Commission) and its subsidiaries for most other installations. This means that the operating authorities are far less partitioned than in most other countries and generally take part in the design definition of their plants, which implies a particularly high level of competence in the field concerned. In addition, the CEA has acquired special scientific and technical competence in safety related areas. This leads to a three-party nuclear safety organization where functions are complementary. It is the operator who is first and foremost responsible for the safety of his installation since he alone is in a position to implement directly safety related measures. However, he must vindicate his actions before the public authorities responsible for ensuring the protection of people and property throughout the national territory. Public authority actions in the nuclear field are conducted by the DSIN (Nuclear Installation Safety Directorate). This directorate is a relatively light structure, entrusted with conducting all actions related to regulatory procedures, the definition of technical regulations and surveillance of the installations. For the latter activity, the DSIN is assisted by the 8 nuclear sections (DIN) set up within the DRIRE (Regional Directorates for Industry, Research and the Environment). For technical assessment of the justifica-

22


tions put forward by the operators, the DSIN is assisted by an expertizing organism which is uninvolved in the "production" of the installations, the IPSN (Institute for Nuclear Protection and Safety). DSIN and IPSN are both required to contribute to informing the general public on the safety of the installations. So nuclear safety is basically structured on three independent, but very closely related sectors, where only the supervisory ministries, usually represented by the DSIN and the DIN, are empowered to enjoin. This is "the safety authority", whereas the DSIN, the DIN and the IPSN constitute "the safety organizations". We must not overlook an additional sector, which has no institutional role but which could have played such a vital role in some countries. We are referring, of course, to public opinion. A safety assessment starts with a written report from the operator, which contains his own safety analysis and which is binding on him. A documentary working basis is indispensable for reference purposes. An analysis may also be initiated by the DSIN or the IPSN on questions they require clarified. An assessment terminates with an IPSN document, which is equivalent to a binding expert opinion, followed by a document issued by the public authorities, generally the DSIN. The necessity for written documents by no means implies that only administrative tasks are involved, even if correct application of current regulations always has to be checked. A detailed, continuous technical and scientific interchange must be set up. This implies that all concerned are steeped in safety principles and practices and thoroughly acquainted with the installations, their operating conditions and the phenomena involved. The competence of the nuclear safety technical assessment organism is an indispensable factor in the controlled evolution of principles and their practical application. It notably prevents risks of going astray in response to demagogic and unrealistic demands devoid of technical consistency. The fact that the safety partners are independent does not imply hostility. Transparent technical interchange is both a token of mutual respect and a means of communicating know-how and preoccupations. It must in particular enable the safety concerns of the safety organisms to be shared with the operators. The ideal situation is not to have to impose anything on the operator since, convinced by the arguments presented, he has dealt with the problem on his own. This, in fact, is one of the aspects of his responsibility. It is in a context such as this that solutions representing optimum trade-offs are most likely to emerge. What then remains is to assess whether the technical solutions proposed are appropriate for the problems set.


23

2.3. Safety analysis reports and regulations The examination of applications received by the safety authorities involves extensive discussions with the applicant, focused on the safety analysis reports. These are the basic documents to be submitted by the operator in support of requests for authorization to construct, start up, begin commercial operation and finally shut down. From the start-up stage, general operating rules must be submitted at the same time as safety analysis reports. To facilitate the drafting of these reports and their subsequent analysis, ministerial directive were issued on March 27, 1973 giving a plan for guidance, together with indications as to the manner in which installation safety analysis reports should be presented regarding basic methodology and a number of special cases. The highly formalized American method has not been adopted in France, even for those nuclear units manufactured directly under license. We have no highly detailed standard format and no standard review plan based on the same breakdown. The contents are however entirely equivalent, as is shown by the safety analysis reports prepared by the plant builders for export projects. It is not left entirely up to the safety analysis technician to make judgements based upon his own references, as to what is enough or not. As the role of the public authorities is to safeguard persons and property, it is up to them to specify, at any given moment, the aims of safety measures and the limits of acceptability, without necessarily resorting to strictly formalized presentations. It must be borne in mind that these concepts are liable to change for reasons other than the purely technical, which will be discussed later on. Public authority requirements and provisions are contained in what is generally referred to as the regulations. Since a 1963 decree, the ministry in charge of industry has been responsible for technical regulations governing nuclear safety. This responsibility is currently shared with the ministry in charge of the environment. There are various levels of documentation (Fig. 2.2.), but only those at the highest level are of a statutory character. General technical regulations The general technical regulations are contained to date in three ministerial orders. The first, dated June 15, 1970, dealt with prestressed concrete nuclear reactor vessels and did not concern light water reactors.

24


DRAWN UP BY GOVERNMENTAL AUTHORITIES

MINISTERIAL ORDERS

BASIC SAFETY RULES

APPROVED

DESIGN AND CONSTRUCTION RULES

BY GOVERNMENTAL AUTHORITIES

DRAFTED

BY OPERATORS

DOCUMENTS SPECIFIC TO AN INSTALLATION

Fig. 2.2 Organization of French regulatory documents.

The second, dated February 26, 1974, dealt with the application of regulations governing pressure vessels to light water reactor main primary systems. The third, dated August 10, 1984, dealt with the quality of design, construction and operation of basic nuclear installations. The text and associated application circular constitute Appendix B of the present document.

Basic safety rules (RFS) A number of technical rules of a general nature have been drawn up by the DSIN and their technical advisors and are published in the form of "Basic Safety Rules". These documents specify those conditions which must be met in order to comply with French technical regulatory practice. They are generally issued after a certain experience of the problems considered has been acquired. Operators and manufacturers thus have access to the provisions deemed acceptable by the safety authorities in the areas dealt with. Observance of these rules facilitates safety analysis and justifications but is not compulsory. Operators and manufacturers have the right to propose alternative arrangements provided they can show that they fulfill the safety requirements defined in the rules to at least an equivalent level. Publication of these documents, a full list of which is appended, began in 1980. More than twenty of them apply to pressurized water reactors, nearly twenty to other installations.


25

The RFS are not, unless otherwise explicitly specified, to be applied retroactively. Furthermore, in order to ensure that standardization of plant series is maintained, they are only required to be taken into account for installation design after three years if nuclear units of the same standardized plant series have already been authorized. These documents have thus been drafted with an eye to the future. However, an underlying concern for continuity is apparent in their contents, since the state of the art and operating feedback are taken into account.

Design and construction rules The French nuclear industry has drawn up codes and standards called Design and Construction Rules (RCC), which formalize standard practice to be used in the field of nuclear engineering. Drafting and publishing these detailed documents is beyond the competence of the safety organizations. However, the safety authorities carry out detailed analyses of the RCC and their later revisions to ensure that they meet the objectives specified during the authorization stage for each installation. These investigations can give rise to requests for modification. The DSIN can then officially formulate their agreement to use of the RCC by means of specially prepared Basic Safety Rules. There are sets of design and construction rules for several different engineering branches: • mechanical equipment - RCC.M • electrical equipment - RCC.E • civil engineering - RCC.G • fire protection - RCC.I • fuel - RCC.C. Finally, a last type of RCC, the RCC.P, concerning processes, is drafted by EDF and describes all the safety principles and provisions adopted for each of the standardized plant series. Other sets of codes and standards concerning inservice surveillance are drawn up under the same conditions as the RCC. The first of these, the rules for the inservice surveillance of nuclear island mechanical equipment in PWRs (RSEM) is presently being analyzed by the safety organisms. It should be followed by equivalent documents on civil works (RSEG) and electrical equipment (RSEE).

26


Ministerial directives The documents which have just been described are all of a general character. They apply to all French nuclear power plant units, taking into account the rules concerning retroactivity which are considered on a case by case basis. Following examination of the safety options relating to the most recent standardized nuclear units, ministerial directives issued in 1979 and 1983 define the obligations and main installation characteristics for the 1300 MWe and 1400 MWe series of nuclear units, notably regarding safety. More recently, a safety option exercise on next generation reactors was carried out in a French-German context. It is presented in Chapter 29. These directives supplement the rules of a technical nature published by the DSIN in the form of basic safety rules.

Letters and advices issued by the DSIN A number of DSIN letters, although not strictly speaking of a regulatory nature, establish the aims and specify the requirements which constitute the statutory legal aspects of nuclear safety in France. The importance of this is not to be overlooked, as we shall see in Chapter 11. All these documents together have gradually replaced the corresponding American documents which were previously used as references for analysis of French 900 MWe units and the first group of 1300 MWe units. Those issued by the public authorities are to be found in Document 1606 published by the French Republic Official Gazette, "Safety of Nuclear Installations in France - Legislation and Regulations" published in January 1995.

Developments in the content of safety analysis reports Regulatory and quasi-regulatory documents require prior technical discussion between the safety authorities and the organizations wishing to build and operate nuclear plants of the type considered. These exchanges mainly take place at the time of plant safety assessments. The results of these discussions are progressively incorporated into the successive revisions of the safety analysis reports, as are also the results of discussions on options and technical decisions which are outside the scope of the regulations. Attention is drawn to the overlapping character of the regulations and the contents of the safety analysis reports. The endorsement of safety reports which are the result of technical discussions and the formulation of


27

which justifies the technical options taken up with respect to the criteria to be met have, in effect, a certain regulatory status. This endorsement is in fact formalized since the license authorizing construction of a basic nuclear installation, which ratifies the preliminary safety analysis report commitments, is issued in the form of a decree. The publication of "doctrine" in the form of regulatory documents can consequently be considered to be less urgent when common agreement has been reached and is reflected in the safety analysis reports and when the entire process is sustained by continuous interchange. Other trends relating to principles, plant design or operating modes will be adopted during the lifetime of installations. Each application from an operator which has been assessed and approved becomes an integral part of the contract between the operator and the safety authorities.

2.4. Developments in safety goals Safety is by no means an immutable, conclusive concept. It develops as greater insight is gained from continued research, from innovative experiments at the plants themselves or direct operating experience in France and throughout the world. Standard aims may change, as we shall see, but in this context, the role of the technicians is simply to propose. Decisions are political, since only at this level can all the economic, environmental and social parameters be considered. To date, for the main installations, the acceptability limits adopted regarding accident situations have been based on limitation of the effects of an accident on the health of the nearby population, calculated with all due circumspection. This involves limiting increases in the probability of occurrence of fatal cancer to such low values as to be imperceptible with respect to the cancer mortality figure for developed countries, standing at about 25%. The Chernobyl accident showed that it was also important to provide against psychological, social and economic consequences due to the displacement of populations, should this prove necessary, or, in a wider context, to restrictions in the consumption or marketing of foodstuffs. It also confirmed the interest of more realistic assessment of potential release levels. This will result, in the future, in far more stringent limitations for anticipated accident release levels. These new constraints will be integrated in the design of future plants. In France, the main driving force behind safety aim developments is represented by the IPSN, which contributes to the detection of safety problems and makes proposals accordingly. These developments are also influ-

28


enced by international trends in the nuclear world, stimulated by the innumerable contacts between the countries concerned but also by the major international organizations in charge of these questions, the Nuclear Energy Agency of the Organization for Economic Cooperation and Development (OECD) and the IAEA. At all these levels, public opinion is an unremitting stimulus but plays no technical role. The definition of technical solutions, on the other hand, is the task of the organizations entrusted with the operation of the installation and the related financial liability. If this were not so and solutions were proposed by the analysts themselves, certain aspects might be overlooked and there would no longer be provision for external expertise.

2.5. Safety Culture It was also further to the Chernobyl accident that the IAEA and the experts it had convened introduced and developed the concept of "Safety Culture". We have no hesitation in recommending that our readers consult the reports issued by the International Nuclear Safety Advisory Group (INSAG) concerning the basic safety principles for nuclear power plants (INSAG 3) and Safety Culture (INSAG 4), but the most important points are nevertheless reproduced below. These two documents concern explicitly nuclear power reactors but there is nothing in their content which limits application of the principles they contain to nuclear installations. Two aspects are dealt with, one concerning individual and small group attitudes, the other focusing on structures and organizations actively involved. These two aspects are indissociable (Fig. 2.3.). Safety culture is that assembly of characteristics and attitudes in organizations and individuals which establishes that, as an overriding priority, nuclear plant safety issues receive the attention warranted by their significance. Safety culture refers to the personal dedication and accountability of all individuals engaged in any activity which has a bearing on the safety of nuclear power plants, an all pervading safety thinking which allows an inherently questioning attitude, the prevention of complacency, a commitment to excellence, the fostering of both personal accountability and corporate self-regulation in safety matters and acknowledgement of the absolute necessity for all forms of communication. In any important activity, the manner in which people act is conditioned by requirements set at a high level. The highest level affecting nuclear plant safety is the legislative level, at which the national basis for safety culture is set. Within an organisation, similar considerations apply. Policies promoted at a high level create the working environment and condition individual behaviour.


29

It is the responsibility of managers to institute such practices in accordance with their organisation's safety policy and objectives.* STATEMENT of SAFETY POLICY

DEFINITION of RESPONSIBILITIES

POLICY LEVEL COMMITMENT

MANAGERS' COMMITMENT

REWARDS and SANCTIONS AUDIT, REVIEW and COMPARISON

RESOURCES SELF-REGULATION

DEFINITION and CONTROL of SAFETY PRACTICES QUALIFICATIONS and TRAINING

— MANAGEMENT STRUCTURES

QUESTIONING ATTITUDE INDIVIDUALS' COMMITMENT

RIGOUROUS and PRUDENT APPROACH COMMUNICATION

SAFETY CULTURE

Fig. 2.3. Diagrammatic presentation of safety culture (INSAG 4).

As will be seen, this concern for safety culture and its behavioral component will be extensively reflected in the various chapters of the present document, but a culture and the attitudes it induces are not grounded solely on apprehending facts. Administrative structures, the sharing of responsibilities but with room left for personal initiative, social ties and other factors inherent to life in a large organization have intersecting influences on these attitudes. This subject is the topic of on-going discussions, notably at EDF.

* These extracts are taken from paragraphs 6, 7,16 18, 35 and 62 of the IAEA document, Security Collection N. 75 - INSAG 4 published in 1991.


3

Deterministic safety approach

This chapter, like most of the following ones, is focused on pressurized water reactors of the type developed in France, but the principles are more general in scope. These reactors stem from the license agreement with the American company Westinghouse, from which the French power plant builder Framatome gradually withdrew, to achieve an entirely French design for the N4 standardized series of reactors. However it must be said that, as compared with other pressurized water reactors in different parts of the world, the design consistency is still very apparent. Appendix C gives certain technical information and indicates the locations and first criticality dates for the French power reactors.

3.1. Determination of specific risks Nuclear reactors have two specific characteristics which differentiate them from other energy production installations: • these reactors accumulate a large quantity of radioactive products (Table 3.1.) from which staff must be protected and the large scale dispersal of which to the environment would constitute a major accident • significant energy release continues for a very long time, even after reactor shutdown, since it is related to the radioactivity of the fission products contained in the reactor core. Plant safety therefore depends on adequate protection with respect to radiation sources together with their confinement. If the sources are localized in the appropriate areas provided, radiation protection can be achieved by the judicious installation of absorbent shields of a suitable material and thickness. Difficulties arise mainly from dispersal of radioactive products outside the standard localized areas. The possible causes of such dispersal shall therefore be investigated. Radioactive products are, for the most part, produced within the fissile material itself and it is desirable that they remain there until the fuel has

32


been reprocessed in a suitable plant. Correct cooling of the fuel and fuel cladding is therefore essential. Table 3.1. Maximum activity of some of the main fission products in TBq*. Core, 2 hours after shutdown Rare gases Iodine Cesium

107

Spent fuel

2 10

106 106

107

2 104

7

Primary system

Gaseous effluents

3 102 20

2 102

It should be pointed out that: • under normal operating conditions, a nuclear reactor has no "natural" power level. In order to be able to operate for at least a year without refuelling and counterbalance various power-related effects, the core has to contain a quantity of fissile material far exceeding the critical mass at cold shutdown. The power level produced by this material consequently results from combining various parameters which must be controlled from outside • under particular operating conditions, the energy released in a nuclear reactor can increase extremely quickly, in an uncontrolled manner and can then only be limited by neutron feedback effects related to temperature rises or fuel dispersal • energy released in fuel which was part of a chain reaction cannot afterwards be annulled, even when the reaction is over. In fact, radioactive products deriving from fission must themselves release a certain amount of energy in order to reach a stable state. They do this with a decay period specific to each element which can be very short (less than 1 second), or average (months or years) or very long (hundreds or thousands of years). Although decreasing, the power produced will for a long time be greater than one-thousandth of the rated power and this calls for continuous cooling (Table 3.2). Prevention of specific risks therefore requires: • efficient control of the chain reaction and hence the power produced • fuel cooling assured under thermal hydraulic conditions designed to maintain fuel clad integrity, thus constituting an initial containment system • containment of radioactive products in the fuel but also in the primary coolant, in the reactor building constituting the containment or in other parts of the plant unit. Maintaining these three safety functions is the key to reactor safety. * 900 MWe PWR, maximum burnup 33, 000 MWd/tU. 1 TBq = 1012 Bq = 27 Ci (Curie)

3 - Deterministic safety approach

33

Table 3.2. Radioactive decay power*. Time after shutdown 1 second 1 minute 1 hour 1 day 1 week 1 month 1 year 10 years 100 years 1000 years

Percentage of the initial thermal power 17

%

5

%

1.5

%

0.5 0.3 0.15 0.03 0.003 0.001 0.0002

% % % % % % %

Thermal power produced in MW 500 150 45 15 9 4.5 1 0.1 0.03 0.006

3.2. Potential risks, residual risks, acceptable risks Estimation of the risks associated with operation of a nuclear installation requires that a distinction be made, as for all industrial facilities, between potential risks, which would exist in the absence of all protective measures, and residual risks, which remain despite provisions made to prevent accidents and, if an accident occurs, to minimize the consequences. Nuclear safety is specifically concerned with this dual objective. Potential risks are clearly defined by the radioactive substances involved, so that the only difficulties involved concern estimating residual risks, since it is impossible to claim that these can be reduced to zero level. These risks are subject to a double estimation, in terms of the probability of possible accidents and in terms of seriousness, depending on the gravity of accident consequences. The idea of probability arises naturally when problems of safety are broached. The logical and instinctive approach is to ensure that an accident is all the more unlikely the higher the risk of serious environmental consequences. It is essential that a very severe accident with major consequences be considered as highly improbable.

* 3 000 MWth reactor (approximately 1 000 MWe) at end of cycle, uranium fuelled, maximum burnup: 33 000 MWd/t.

34


This natural approach was the guiding principle in the early work carried out in the field of nuclear safety. The "Farmer curve" (Fig. 3.1.), produced at the beginning of the seventies, shows an authorized area and a forbidden area on either side of a curve plotted on a probability versus consequences graph, with the consequences expressed as radioactive iodine release. Only the symbolic aspect is presented here. The designers of nuclear power plants then engaged upon a thorough study and more precise definition of this curve by matching probability ranges with radiological consequences which could be considered acceptable. A few years later, the safety organizations specified an indicative limit for the maximum accident probability likely to give rise to consequences deemed unacceptable. This by no means implies that situations of even lower probability should receive no attention. It has to be shown that all types of accidents considered credible have been taken into account and are covered by the accident studies performed and that the systems provided to prevent their development or mitigate their consequences, the engineered safety systems built into the installations, effectively enable the safety objectives to be achieved. Safety specialists have progressively developed an entire arsenal of principles, concepts and methods applicable both at the design stage and at the construction and operating stages.

Fig. 3.1. Relation between probability and consequences. Farmer graph.

These are, firstly, the barriers, secondly the defense in depth concept, which has been gradually extended, and thirdly the probabilistic studies, which will be discussed in other chapters.


35

3.3. The barriers When France adopted the pressurized water reactor system, built under American license, our country had already built several major nationallydesigned installations and perfected an appropriate safety approach, the barrier method. It is this method which was applied to the light water reactors in the first place. The defense in depth concept, of American origin, was subsequently adopted by the plant designers and safety organisms in France and adapted in the light of their experience. Jean Bourgeois, former director of the Institute for Nuclear Safety and Protection (IPSN) described the barrier method as follows, at the Congress held in Vittel in 1973. "Protection of the public against the consequences of an accidental release of fission products rests on the interposition of a series of leaktight barriers. Safety analysis therefore consists firstly in ensuring the validity of each of these barriers and their correct operation under normal and accident reactor operating conditions. This kind of analysis emphasizes the progressive nature of safety by distinguishing three successive but interrelated stages: • prevention: the validity of each barrier must be demonstrated for the materials selected, their adaptation to the operating conditions and maintenance of the specified characteristics over a period of time. It is essential that the technological limits be shown so that the real margin between these limits and the operating conditions can be defined with a good degree of certainty 3nd barrier: Reactor containment building

Fig. 3.2. Main PWR barriers.

36


• monitoring: this is designed to detect any drift to within the margins defined above in order to be able, if necessary, to actuate a corrective action, either manually or automatically, in good time for return to normal operating conditions • mitigating action: in the event of accidental exceeding of the technological limits, the purpose of protective action is to prevent the release of radioactive products or to limit the scale of the release. For each type of reactor, there are generally three or four barriers (Fig 3.2.), considered to be both leaktight and resistant: the fuel cladding, the reactor coolant pressure boundary, the primary containment and possibly the secondary containment. Each of these is examined in detail under the three operating conditions described below: • normal operation: the simplest and best defined category for which the fixing of margins with regard to technological limits must take into account any uncertainties which might exist • normal operating transients (startup, power buildup, load variations): as a general rule, the safety margins fixed for normal operating conditions must allow these transients to be absorbed without tripping irreversible corrective actions • abnormal operating transients, following equipment failure or induced by human error: the drawing up of various possible sequences reveals critical points and hence enables improvement of reliability or monitoring processes. In order to synthesize this survey of the barriers and particularly to determine their independence from each other, which is essential for safety assessment, an examination of the development of typical major accidents must be undertaken. This final process has a rather formal character as, in certain cases, it involves postulating events which cannot be precisely identified. This has the advantage of allowing assessment of the dynamic response of radioactive products to transfer from the core to the outside containment vessel and of providing an order of magnitude for site radiological consequences if the integrity of all barriers were to be breached". This method is deterministic, since it attests the possibility of a certain number of accident situations. It was applied during the first 900 MWe PWR unit examinations at the beginning of the 1970s and revealed certain difficulties. If the definition of the first barrier is simple despite its extent, i.e. fuel clads for all fuel rods, this is not true for the other two barriers. The reactor coolant pressure boundary is clearly defined within the reactor building. It branches out, however, in a fairly complex manner in the auxiliary building where volume and boron concentration control is carried out, together with primary fluid purification. The spent fuel pit has the same function, despite its free surface. As we have just seen, the reactor building containment is not the only place containing spent fuel or primary coolant. Delimitation of the third barrier is thus also fairly complex.


37

Finally and most importantly, this succession of three barriers implies one markedly important fact: the steam generator tubes with a considerable total surface area (more than 1 hectare) and a very thin wall (about 1 mm) simultaneously fulfill the function of primary coolant enclosure and containment (second and third barriers). The secondary system, where the design pressure is below that of the primary system, must be protected against overpressures by safety valves. It can consequently not be considered as leaktight if a steam generator tube break allows a secondary system pressure buildup imparted by the primary system. This is a serious and difficult to avoid strain on the notion of a succession of independent barriers. It is a characteristic and well-known PWR problem, which we shall return to in Chapter 8.

Fig. 3.3. Vertical section of a 1300 MWe PWR P'4 standardized unit.

These reflections have contributed to the evolution of safety thinking from the barrier method to the defense in depth concept. This concept in fact includes the barrier method, but enables an analysis of installations to be carried out which is both more comprehensive and more detailed.

38


For other nuclear installations, whether large or small, the barrier method has also been applied from the outset and remains an essential principle of safety assessment.

3.4. The defense in depth concept The defense in depth concept is not an installation examination technique eliciting a particular technical solution, as is the case in a graded barrier context, but is a method of reasoning and a general framework enabling more complete examination of an entire installation and the objective is as much design improvement as analysis. It was developed in the United States in the sixties and was notably the design basis for the Westinghouse nuclear power reactors. The approach linking successively prevention, monitoring and mitigating action is broadened to cover all safety related components and structures. We shall see that this approach, initially developed for plant design analysis, is also well adapted to operating organization. Before describing the different stages involved, the principle can be simply summarized as follows: Although the precautionary measures taken with respect to errors, incidents and accidents are, in theory, such as to prevent their occurrence, it is nevertheless assumed that accidents do occur and provisions are made for dealing with them so that their consequences can be restricted to levels deemed acceptable. This does not obviate the need to study still more severe sitautions, the causes of which may as yet be unknown, and to be ready to confront them under the best possible conditions. The approach combines the prevention of abnormal situations and their degradation with the mitigation of their consequences. It is a deterministic method, since a certain number of incidents and accidents are postulated. The defense in depth concept consists in a set of actions, items of equipment or procedures, classified in levels, the prime aim of each of which is to prevent degradations liable to lead to the next level and to mitigate the consequences of failure of the previous level. The efficiency of mitigation must not lead to cutbacks in prevention, which takes precedence. The approach itself has been gradually perfected and its various stages will be referred to throughout this document. In July 1995, the IAEA International Nuclear Safety Advisory Group adopted a document on this subject (INSAG 10, Defense in Depth in


39

Nuclear Power Plant Safety). Its publication in English, followed by the other official IAEA languages is currently proceeding. This document presents the history of the concept since its inception, how it is currently applied and indicates advisable modifications for its application to the next generation of reactors. It is fully discussed in what follows and we shall revert to it in Chapter 29, devoted to the next generation of reactors.

3.4.1. The defense in depth levels The defense in depth concept now comprises five levels. The way in which these levels are structured may vary from one country to another or be influenced by plant design but the main principles are common. The presentation below is consistent with the new INSAG document.

First level: prevention of abnormal operation and failures The installation must be endowed with excellent intrinsic resistance to its own failures or specified hazards in order to reduce the risk of failure. This implies that following preliminary delineation of the installation, as exhaustive a study as possible of its normal and foreseeable operating conditions be conducted to determine for each major system, structure or component, the worst mechanical, thermal, pressure stresses or those due to environment, layout, etc. for which allowance must be made. Normal operating transients and the various shutdown situations are included in normal operating conditions. The installation components can then be designed, constructed, installed, checked, tested and operated by following clearly defined and qualified rules, while allowing adequate margins with regard to specific limits at all times to underwrite correct behavior of the installation. These margins should be such that systems designed to deal with abnormal situations need not be actuated on an everyday basis. A moderate-paced process with a computer-based control system will diminish operating staff stress hazards. Man-machine interface provisions and time allowances for manual intervention can make a significant contribution. In the same way, the various disturbances or hazards deriving from a source external to the plant and which the installation must be able to withstand without operating disturbances or, in other cases, without causing significant radioactive discharge, shall be specified. Site selection with a view to limiting such constraints can play a decisive role.

40


In this way, it is possible to determine a reference seismic level, extreme meteorological conditions expressed as wind speed, weight of snow, maximum overpressure wave, temperature range, etc. The new stress factors thus derived shall be used in the same way as before. Sets of rules and codes, previously described, define in a precise and prescriptive manner the conditions for design, supply, manufacture, erection, checking, initial and periodic testing, operation and preventive maintenance of all safety related equipment and structures in the plant in order to guarantee their quality in the widest sense of this term. The selection of appropriate staff for each stage, from design to operation, their appropriate training, the overall organization, the sharing of responsibilities or the operating procedures contribute to the prevention of failures throughout plant life. This also applies to the systematic use of operating feedback. On this basis may be defined the authorized operating range for the plant and its general operating rules.

Second level: control of abnormal operation and detection of failures The installation must be prevented from straying beyond the authorized operating conditions which have just been defined and sufficiently reliable regulation, control and protection* systems must be designed with the capacity to inhibit any abnormal development before equipment is loaded beyond its rated operating conditions, so defined as to allow substantial margins with respect to failure risks. Temperature, pressure and nuclear and thermal power control systems shall be installed to prevent excessive incident development without interfering with power plant operation. With a plant design procuring a stable core and high thermal inertia, it is easier to hold the installation within the authorized limits. Systems for measuring the radioactivity levels of certain fluids and of the atmosphere in various facilities shall assume monitoring requirements and check the effectiveness of the various barriers and purification systems. Malfunctions clearly signalled in the control room can be better dealt with by the operators without undue delay.

* Control systems are sometimes included in first level provisions. The INSAG document places automatic shutdown at third level. But these variations make no difference to the general principle.


41

Finally, the protection systems, the most important of which is the emergency shutdown system but also including, for example, safety valves, shall be capable of rapidly arresting any undesirable phenomenon, inadequately controlled by the relevant systems, even if this entails shutting down the reactor. Furthermore, a periodic equipment surveillance program enables any abnormal developments in major equipment to be spotted. Such developments would otherwise be likely to lead to failures over a period of time. Periodic weld inspections, crack and leak detection, routine system testing pertain to these preventive surveillance activities.

Third level: control of accidents within the design basis The first two levels of defense in depth, prevention and keeping the reactor within the authorized limits, are designed to eliminate with a high degree of reliability, the risk of plant failure. However, despite the care devoted to these two levels and with the obvious aim of safety, a complete series of incidents and accidents is postulated by assuming that failures could be as serious as a total instantaneous main pipe break in a primary coolant loop or a steam line or could concern reactivity control. This places us in a deterministic context, which is one of the essential elements of the safety approach. We are then required to install systems for limiting the effects of these accidents to acceptable levels, even if this involves the design and installation of safety systems having no function under normal plant operating conditions. These are the engineered safeguard systems*. Startup of these systems must be automatic and human intervention should only be required after a time lapse allowing for a carefully considered diagnosis to be reached. In the postulated situations, the correct operation of these systems ensures that core structure integrity will be unaffected, which means that it can subsequently be cooled. Release to the environment will consequently be limited. The choice of incidents and accidents must be made from the beginning of the design phase of a project so that those systems required for limiting • For PWR's built in France, these systems are: • the systems injecting emergency water into the reactor coolant system • the steam generator auxiliary feedwater supply system • the containment withstanding an overpressure of about 4 bar rel associated with the sytems ensuring internal spraying, the automatic isolation of penetrations, containment atmosphere monitoring and, in the case of double-wall containment, depressurization of the annulus.

42


the consequences of incidents or accidents integrate perfectly with the overall installation design. This choice must be made with the greatest care as it is very difficult to insert major systems in a completed construction at a later date.

Fourth level: control of severe plant conditions including prevention of accident progression and mitigation of severe accident consequences In the context of on-going analysis of risks of plant failure, such as the accident which occurred at Three Mile Island in 1979 (Chapter 13), it was decided to consider cases of multiple failure and, more generally, the means required to contend with plant situations which had bypassed the first three levels of the defense in depth strategy or which were considered as part of the residual risk. Such situations can lead to core meltdown and consequently to even higher release levels. The concern here is consequently to reduce the probability of such situations by preparing appropriate procedures and equipment to withstand additional scenarios corresponding to multiple failures. These are the complementary measures described in Chapter 11. Every endeavor would also be necessary to limit radioactive release due to a very serious occurrence which would nevertheless have involved core meltdown and to gain time to arrange for protective measures for the populations in the vicinity of the site. It is then essential that the containment function be maintained under the best possible conditions. The latter accident management actions are defined in emergency procedures and are outlined in the internal emergency plan (PUI) for the plant concerned and will be discussed in detail in Chapter 15. These measures can only be implemented efficiently if operators are suitably trained and duly supported by the organizational structures provided by the utility.

Fifth level: mitigation of radiological consequences for populations of significant offsite release of radioactive materials Population protection measures because of high release levels (evacuation, confinement indoors, with doors and windows closed, distribution of stable iodine tablets, restrictions on certain foodstuffs, etc.) would only be necessary in the event of failure or inefficiency of the measures described above. So we are still in a defense in depth connotation.


43

The conditions of this evacuation or confinement are within the scope of the public authorities, including the Civil Security Authority. They are supplemented by the preparation of long or short term measures for checking the consumption or marketing of foodstuffs which could be contaminated. Such measures are included in the external emergency plans (PPI) and will be described in Chapter 17. The decision to implement such measures will be based on analysis of the situation by the operator and the safety organisms and then on environmental radioactivity measurements. The corresponding methods are described in the same chapter. Periodical drilling will also be necessary in this area to ensure adequate efficiency of the resources and linkups provided.

Mitigation of radiological consequences of significant off-site release of radioactive materials Control of severe plant conditions including prevention of accident progression and mitigation of severe accident consequences Control of accidents within design basis Control of abnormal operation and detection of failures Prevention of abnormal operation and failure by conservative design and high quality in operation Control, limiting and protective systems and other surveillance features Engineered safety features ensuring safety functions and accident procedures Complementary measures and accident management Off-site emergency response

Fig. 3.4. The defense in depth concept: purposes, methods and means (INSAG 10).

44


Elements common to the different levels Defense in depth can only be satisfactorily implemented if care is taken at each level to ensure an appropriate degree of conservatism, quality control and attitudes stemming from safety culture. The notions of conservatism and safety margins, very closely linked with the deterministic approach, apply particularly to the first three levels of defense in depth under conditions discussed in the following chapters. Severe accidents, on the other hand, generally require a less conservative approach and realistic assessments are preferable when populations have to be protected against substantial radioactive release. Quality control will be dealt with at the end of this chapter. Finally, as mentioned in the previous chapter, all those actively involved in plant safety, whether they be operators, constructors, contractors or members of safety organisms, must be thoroughly versed in safety culture.

3.4.2. General comments The notion of successive defense levels implies that these levels be as independent as possible. It will consequently be very important to ensure that the same event or failure, whether single or multiple, could not affect several levels simultaneously, thereby calling the entire approach into question. This would be the case, for example, if a specific failure inhibited the systems provided to limit the consequences of the event considered. We shall come back to this problem several times. Safety system reliability must be adequate. Special design, layout and maintenance rules are applied to this aspect. These will be presented in the next chapter. The fourth level was set up to fill in the gaps revealed in the situations envisaged prior to 1975. This level thus covers measures for the prevention of substantial core meltdown which ought to have been included in the third level and provisions for the management of more severe accidents which fit better into this stage in the phasing of preventive actions. In the most recent French standardized plant series, the N4, complementary preventive measures decided on at the design stage are dealt with in a manner which is closer to the method used for engineered safeguards, without this being a matter of principle. The fourth level nevertheless conserves its dual character, covering management of the most severe accidents with particularly low probabilities and compensation for any initial design deficiencies.


45

However, in view of the efforts made, it should now be possible to considerably limit radioactive release in a substantial majority of even highly degraded situations. Until recently, levels 4 and 5 were combined in one level. In accordance with the logic of the defense in depth concept, the need for protective actions with respect to populations in the vicinity of the site effectively corresponds to the failure, or relative failure, of the measures taken at the previous level. There must consequently be a differentiation between the two levels involved.

3.5. Quality control The efficiency of these principles and methods would be limited if the quality control of all activities involved in the design, supply, manufacture, erection, tests and inspections, operating preparations and the actual operation itself were not fully ensured. This depends on the motivation of all concerned and implies appropriate organizational procedures. Provisions relating to quality are structured in a regulatory document, the ministerial order of August 10, 1984 concerning the quality of the design, construction and operation of basic nuclear installations, together with its application instructions. The importance of these documents is such that they are appended (Appendix B). The reader may thus consult them directly. However, although they are not summarized in the present text, there will be many references to them. Quality control was first implemented by EDF with the following activity organization rules: • specify in writing what has to be done • do what is specified • report in writing what has been done. This procedure ensures clear, accessible records of all safety-related activities but can cause communication problems between those preparing interventions and those carrying them out. The former, required to specify work to be done by others, must be familiar with safety principles and with the specific risks associated with the intervention. Their technical background must be such as to enable them to determine what has to be done, but they may lack detailed knowledge of how it is to be done. Those responsible for actually doing the work, on the other hand, are well acquainted with the close range details, but may have difficulty in interpreting the specified instructions in terms of their own practical working methods. Moreover, they are usually not accustomed to writing detailed reports.

46


These apparently straightforward principles are consequently not always easy to apply. As for safety culture, discussions are proceeding on this subject, especially at EDF.

4

Analysis of operating conditions

An essential part of safety analysis comprises investigation of the various situations which the installation can be required to withstand, ranging from normal operating conditions to more and more severe accident conditions. According to the defense in depth concept, prevention does not suffice to make a plant absolutely accident-proof. The few exceptions to this rule will of course be examined. As we shall see, the first accidents considered were those due to possible weaknesses of the installation itself. Risks deriving from interaction between the various power plant systems have been progressively identified and taken into account. Similarly, the possibility of external hazards, either natural or connected with human activity, has been investigated and the results used to determine design or installation constraints. These different families of accidents will be examined successively in this and the following chapters.

4.1. Classification of operating conditions The principle that incidents or accidents can occur despite precautions taken to prevent them is an inadequate basis for determination of the characteristics of these phenomena. All accidents do not have the same degree of probability and acceptable consequences are therefore not the same in each case. Discussions conducted in France in 1975 on the basis of an American standard (ANSI N. 18.2) led to acceptance by the safety authorities of an EDF plant design proposal, featuring a table showing the correspondence between estimated frequency ranges and the maximum allowable orders of magnitude for radiological consequences. As the estimated frequency of incident or accident operating conditions is not directly derived from experience but from assessments, it is natural that the figures given are only orders of magnitude covering, in each case, a factor of 100. Regarding the levels of acceptable radiological consequences indicated for the third and fourth categories, these figures are only orders of magni-


48

tude suggested by the operating utility and accepted by the safety authorities. They have no statutory character (Table 4.1.). Table 4.1. Classification of plant operating conditions (The frequency/consequences relationship is only valid in the context of the defined conditions of analysis)

Categories of operating conditions

Order of magnitude of annual frequency per unit

Order of magnitude of maximum allowable radiological consequences at site perimeter

Category 1 normal operating conditions

permanent or frequent

Observance of effluent release permit limits for the site, over the year (some 10 Sv)

Category 2 minor but frequent incidents

10-2 to 1 per incident

Observance of effluent release permit limits for the site per incident (some 10 Sv)

Category 3 unlikely incidents

10-4 to 10-2 per incident

Whole body < 5 mSv, Thyroid < 15 mSv

Category 4 limiting faults

10-6 to 10-4 per accident

Whole body < 150 mSv, Thyroid < 450 mSv

The value adopted for the maximum allowable third category conditions, 5 mSv is the same as that for the annual permissible exposure level for members of the public proposed by the International Commission for Radiological Protection (ICRP) in 1977. This is an accepted value but has no regulatory character. The table is common to the three generations of PWR's presently operating, the 900 MWe, the 1300 MWe and the 1400 MWe. We shall see in Chapter 29 that significant changes are to be expected in the next series of PWR's. It should be noted that the expression "operating condition" was preferred to the terms transient, incident or accident, since it is more general and concerns the entire plant. This terminology also avoids use of the term "situation" which is more correctly used to describe the status of a specific item of equipment and is used notably in the statutory regulations governing pressure vessels. The term is however commonly used to describe any plant condition.

4 - Analysis of operating conditions

49

4.2. Definition of design basis operating condition categories It is worth drawing out the implications of the various categories given in Table 4.1. Normal operating conditions correspond to states and transients taken into account at the first level of defense in depth. They cover the entire range authorized by the Operating Technical Specifications. This is the normal daily routine of the plant. If there is any possibility of release of radioactive substances into the environment, this release must be totally controlled, carried out under special specified conditions and, of course, accounted for. The annual cumulative release must not exceed values laid down by an interministerial authorization order for liquid and gaseous release levels unique to each site. The effects of these bounding case release levels, calculated under pessimistic conditions, does not exceed a few tens of Sv. Minor but frequent incidents in the second category are those considered at the second level of defense in depth. They can result in plant operation outside the prescribed limits and must be controlled by regulation and protection provisions. Analysis of these incidents can provide a basis for determining the salient features of these provisions. They are associated with a fairly high frequency level and they are therefore considered as almost inevitable. Because of this, the release resulting from each such incident, accounted for in this case over a period of a few hours, must not exceed the annual authorized release levels. This implies that any release of radioactive substances due to an incident of this type must take place through monitored channels, stack or discharge piping, so that, although these releases are inadvertent and uncontrolled, they can nevertheless be fully accounted for. The unlikely accidents of the third category can involve uncontrolled releases but estimation of the consequences of these releases must show that they remain at relatively low levels: the equivalent whole body dose after exposure of two hours for members of the public occupying the most unfavorable position at the site boundary and with the least favorable weather conditions must be less than 5 mSv. If we refer to the coefficients presented in Chapter 1 linking absorbed dose and probability of fatal cancer being induced, we find that a 5 mSv dose would increase the cancer risk for an individual by 0.025%, whereas the "natural" percentage observed in the French population exceeds 25%. The limiting fault accidents in the fourth category are the most serious accidents under consideration in this first approach.

50


Significant damage to fuel is admitted, but the installation must nonetheless remain in a stable or only slowly developing situation after automatic implementation of protection or engineered safety systems. The equivalent whole body dose received in two hours at the site boundary must remain below 150 mSv under assessment conditions as unfavorable as the foregoing. Despite the very low occurrence of such accidents, we are still far removed from doses inducing inevitable biological effects, the thresholds for which are at least three times higher. The probability of fatal cancers being thereby induced remains below 1 %.

4.3. Choice of operating conditions The second category transient initiating events are investigated among the possible causes for the variation of parameters affecting fuel cooling. These families of initiators are examined one after the other. The neutron flux, and hence the energy released in the fuel, can increase due to the following direct reactivity effects: • uncontrolled rod withdrawal • gradual inadvertent dilution of boric acid present in the primary coolant but also to indirect effects: • inadvertent opening of a secondary system valve • increase in turbine drawn power. The primary coolant flow which transfers the energy produced in the core to the steam generators can decrease due to shutdown of a pump but also, and in this case more sharply, due to the coastdown of all the primary coolant pumps, moderated by their flywheels, in the event of loss of offsite power. A drop in primary pressure level, which is also detrimental to correct fuel cooling, could be due to the inadvertent opening of a pressurizer valve or excessive spraying in the pressurizer. Another phenomenon, connected with the long term strength of the reactor vessel, is also considered: inadvertent actuation of the safety injection system. Neutron irradiation modifies the characteristics of the vessel metal and welds: the vessel metal embrittlement temperature rises to a level in the vicinity of that of the safety injection water. It is consequently important to prevent such loads or ensure their surveillance. Postulated accidents divided between the third and fourth categories are investigated along the same lines (excessive power increases, inadequate fuel cooling) by identifying the events or malfunctions liable to involve the loss of barriers. The initiators are no longer parameter variations but real failures, even involving pipe breaks, despite the significant design margins allowed.


51

Neutron flux increases analyzed could be due, for instance, to control rod ejection or a steam line break. Drops in primary coolant flowrate will be due to more and more rapid pump coastdown. Pressure losses will be accompanied by loss of primary fluid since they will be due to increasingly serious breaks. Double-ended guillotine pipe breaks without forewarning are postulated, with displacement of the two pipe ends allowing the fluid to flow out unchecked. We shall come back to the various assumptions associated with pipe breaks in Chapter 7 and shall discuss the leak-before-break concept which is less used in France than in certain other countries. Direct release of radioactive products contained in the radioactive gas or contaminated water tanks inside the various facilities is considered, as is total rupture of all fuel rods in a fuel element during handling in the reactor building or the fuel building. This results in a large number of possible accident scenarios from which a selection is made based on two main principles: • identification of bounding case accidents • exclusion by additional prevention of a certain number of accidents.

4.3.1. The bounding case accident concept The number of accidents or incidents to be investigated can be decreased by identifying the most penalizing situation within a group of incidents of the same type. An example will demonstrate this approach. Auxiliary buildings comprise a number of radioactive gas or contaminated water tanks. If these tanks are of a similar design and quality and are located in facilities equipped with retention or ventilation systems of equivalent efficiency, it is not necessary to examine the consequences of rupture of each of these containers. It is sufficient to investigate the worst case in each family of events and ascertain that the consequences are acceptable in order to be able to generalize this finding to other tanks of the same type. The accident which is investigated will be considered the "bounding case accident" for the entire family. We shall see below that the choice of the hypotheses relative to the investigated accident scenarios gives the idea of "bounding case accident" a still more significant aspect, which goes beyond simply maximizing radiological consequences.

52


4.3.2. Exclusion by prevention of a certain number of accidents If, as we shall see below, devices can be found to limit the consequences of most accidents to acceptable values - these are the engineered safeguard systems, included in some countries under the heading "engineered safety systems" - analysis is rather less straightforward for certain particularly serious accidents. In view of the difficulty of limiting the consequences of these accidents, efforts were focused on optimizing the prevention of such situations, with a view to "excluding" them. This is the case for fast fracture of large components like the reactor vessel, the steam generator outer shell, the pressurizer or the primary pump casing. The mechanical stress to which vessel internals, fuel elements, steam generator tubes, or the containment building might be subject makes direct control of these accidents extremely difficult, or even impossible. Worldwide industrial experience in this field would appear, however, to indicate that for apparatus of this kind which has been well designed, well constructed and carefully monitored, the probability of this type of fracture is extremely low. We have therefore agreed that accidents of this type should not be taken into account and that the third level of the defense in depth concept be omitted from the design basis but that this decision should be counterbalanced by an increase in design, construction and operating safety margins and by special initial and in-service inspection.

4.4. Operating conditions: list and subdivisions In 1970, when the preliminary safety analysis report for the first 900 MWe nuclear unit constructed in France at the Fessenheim power plant was submitted, the operating conditions were subdivided into three groups: • operating transients and incidents • accidents activating safety devices (engineered safeguard systems) • loss of coolant accidents. Both the list and the division were derived from American practice and represented the outcome of discussions between US plant designers and safety authorities. Acceptability criteria were not always clearly defined. During the progressive adaptation of this reactor system to French codes and standards culminating in the 1300 MWe reactors, this list was reconsidered and slightly expanded by the French safety partners. The four categories listed in Table 4.1 were specified with their estimated frequency


53

ranges and indication of the maximum allowable radiological consequences for the design studies. The operating transients and incidents were placed in the second category. The accidents were subdivided and assigned to either the third or fourth category, without making a special case of loss of coolant accidents. This gave, in 1976, the following lists:

Category 2: incidents of moderate frequency the consequences of which must be extremely limited Reactivity incidents • Uncontrolled withdrawal of rods with the reactor subcritical or power operating • Gradual uncontrolled dilution of boric acid • Startup of an inactive primary loop • Incorrect operation of steam generator main feedwater supply • Excessive load increase. Disturbance of core physics • Incorrect position, drop of a control rod, or control rod bank • Partial loss-of-flow accident • Total turbine load loss, turbine trip • Loss of offsite power causing loss of reactor coolant pump power supply • Loss of steam generator main feedwater supply. Primary breaks • Brief inadvertent opening of a pressurizer valve • Momentary depressurization of the primary system. Secondary breaks • Inadvertent opening of a secondary system valve. Reactor vessel enbrittlement • Inadvertent startup of safety injection or emergency boration.

Category 3: very infrequent accidents the consequences of which must be sufficiently limited Reactivity • Control rod withdrawal at full power. Disturbance of core physics • Forced reduction of primary coolant flowrate • Incorrect position of an assembly in the core.

54


Primary breaks • Loss of primary coolant, small break • Inadvertent opening of a pressurizer valve, long term depressurization. Secondary breaks • Small break in a secondary pipe. Radioactive release • Rupture of chemical and volume control system tank • Rupture of gaseous waste treatment system tank.

Category 4: serious postulated accidents the consequences of which must remain acceptable Reactivity • Control rod ejection. Disturbance of core physics • Primary pump rotor blocked. Primary breaks • Loss of coolant accident • Total rupture of a steam generator tube. Secondary breaks • Large break in a main secondary water or steam line. Radioactivity release • Fuel handling accidents. Worldwide experience has since shown a classification error which will be examined below (Chapter 8). Rupture of a steam generator tube, here classified in the fourth category, has in fact a probability level which should place it in the third category. This modification was introduced into the list of operating conditions to be taken into account for the design of nuclear units of the new 1400 MWe N4 standardized plant series. This formal classification modification cannot be made for nuclear power plants which have already been designed and constructed, but compensatory measures have been taken. One might be tempted to believe that a category transfer of this kind would help to resolve the problem as accidents in the third category are less serious than those in the fourth category. The reality of the situation is, however, quite different. This accident was transferred because its probability was found to be much higher than was initially assumed, but this does not make the accident less serious, rather, it requires that the accident be made less serious. In order to respect the specified new radiological consequence


55

limits, which are thirty times lower, the operating utility had to modify certain equipment and impose special constraints with regard to primary coolant activity, for example. Of course, in both cases, as for all other design basis accident studies, the calculation of consequences is based on a set of conservative postulates which will be discussed further on. Another classification error concerns primary coolant pump rotor blocking. The frequency of occurrence of this accident worldwide is also higher than that initially estimated. However, as it does not affect fuel and involves no radioactive release, the only modifications made have consisted in reinforcing inspection provisions for primary coolant pump shafts, with a view to limiting outage risks. Moreover, the division of accidents into two categories has certain limiting effects on the concept of a bounding case accident. If the consequences of a major secondary break cover the consequences of a minor secondary break, this does not obviate the need for detailed examination of the latter failure. The fact that a major break has acceptable consequences in the fourth category does not imply that a minor break necessarily has acceptable consequences in the third category.

4.5. Operating condition analysis process As we have just seen, the incidents and accidents which were chosen were generally not the fruits of experience but of research into the conditions under which the characteristic operating parameters of the reactor and of associated systems develop along lines unfavorable to safety. These conditions will therefore not be examined for their own sake but rather to guard against a type of transient or phenomenon giving rise to risks. For this reason, the incident or accident under investigation shall be interrogated from the point of view of a whole set of postulates or design conditions chosen to aggravate the situation and therefore ensure that the result can function satisfactorily as a new bounding case. The probability of occurrence of these more penalizing conditions is disregarded in determining the probability order of magnitude for the scenario considered. This will also be the method for proceeding from incidents or accidents with single initiators to those with combined initiators, which are more representative of what actually occurs. In this way, we shall examine in the rest of this chapter, the choice of initial conditions, the qualification of calculation codes, the "single failure criterion" and the rules for conventional load combinations.

56


4.5.1. Choice of initial conditions A nuclear power plant has an entire range of authorized operating levels at its disposal, from full power to shutdown for refuelling. At each of these levels the characteristic parameters - pressure, temperature, flowrate, volume, voltage, frequency, radioactivity and contamination - have authorized variation limits. Measurement, adjustment and control methods for these parameters do not however provide complete accuracy. For each study, pessimistic parameter values are chosen for the anticipated occurrence considered and for equipment precision. As the examples will show, this set of values is liable to change even during investigation stages of a single accident. If the anticipated phenomenon is the departure of nucleate boiling on the fuel clads, which is a highly undesirable cooling condition involving possible loss of cladding integrity, increased values of the heat produced and the average primary temperature will be used. The coolant pressure value, on the other hand, will be chosen by combining conditions which lead to its reduction. In order to analyze a primary coolant leak, contamination of the fluid by radioactive iodine, the most significant substance in the short term from the radiological standpoint, is set at a value exceeding that authorized for permanent operation. It should be noted that this value has rarely been overstepped in the course of several hundred reactor-years, and then only very briefly. Accidents which call into question reactivity injections by control rod movements are examined at the beginning of the cycle when the moderator feedback is weakest. Those due to a cold surge in the secondary system are examined at the end of the cycle when, in the absence of boron in the primary coolant, the reactivity will be most affected. Furthermore, if there is a release of fission products normally retained by the cladding, it shall be assumed that the fuel is at the end of an equilibrium core cycle, which will increase the quantity of radioactive products present. Although these initial conditions are only representative of a very short time period in the life span of an installation - a few percent of the total life span in each case - this decrease of probability will not be taken into account for the physical situation under consideration. This is thus a resolutely deterministic approach to design basis accident analysis and the estimated frequency ranges only concern the initiators.


57

4.5.2. Use of qualified computer codes Despite the very large number of old and recent studies, it is extremely difficult to represent exactly the complex phenomena which come into play during an accident. We do not therefore have at our disposal a computer code representing the precise development and maximum values of the most significant parameters. Uncertainties and inaccuracies remain into which current research and development programs are endeavoring to provide greater insight. For investigation of conventional accidents and checking of the acceptability of their consequences, only those codes shall be used which are sufficiently stringent as determined by their qualification testing. This method does not eliminate uncertainties but demonstrates plant safety. These codes shall be subject to additional studies and constant amendment in order to reduce, through a more thorough knowledge of phenomena and modelling methods, those safety margins which are thought to be excessive. These improvements shall also enable the happily rare discovery of occasions when certain former results were insufficiently stringent. This was the case at the beginning of the 1980s for estimation of overpressure in the P'4 reactor containments resulting from a main steam line break. Adequate margins allowed for elsewhere enabled this unexpected setback to be absorbed with no consequences for the reactor containment design. This example, which is not unique, confirms the importance of significant margins in the various phases of estimation of system and equipment characteristics. Due to their deliberately exaggerated character, these codes cannot be used for drawing up accident operating procedures as the accident development which they outline is too far from contingent reality. In these cases, "best estimate" codes have to be used.

4.5.3. The single failure criterion In view of their importance, systems actuated during incidents or accidents must have a very high level of reliability. As a reliability study is extremely difficult to carry out at the point of installation design and schematic drafting of systems, a deterministic approach, which is perhaps more approximate but easier to use on the drawing board, was preferred at the design stage. This is the "single failure criterion" which can be summarized as follows: Safety related systems must be able to fulfill their function in an adequate manner even in the event of failure of any one of their components.

58


The application of this criterion to electrical systems is simple: it is postulated that at the moment a system is actuated a single component is faulty. Of course, the component selected will be that with the most serious consequences in the event of faulty operation in the context considered. For mechanical systems, active components for which correct operation requires external actuation (pumps, valves, power-assisted check valves) are differentiated from passive components (pipes, heat exchangers, simple check valves, etc.). An active failure might just as easily be due to failure to operate of a required component as to inadvertent operation of that component. A passive failure could be a worsening leak, the consequences of which could be limited if it were located and contained. In the opposite case, all the fluid involved shall be assumed to be lost. Blocking of a flow would also be a passive failure. Bearing this distinction in mind, the single failure criterion is applied in the following manner; even if there are slight differences between its use as a design criterion and as an analysis criterion: • protection and engineered safeguard systems must fully ensure their function despite any electrical or active mechanical failure • any of these systems having to ensure service over a long period of time must continue to function even if, after about 24 hours, an active or passive failure occurs. The manner in which this principle should be applied has given rise to much discussion in the world of nuclear engineering, particularly regarding two related themes: • how should equipment or system unavailability due to already recognized breakdowns or maintenance be allowed for? • should human error be taken into account and if so, how? Some countries opted for the installation of triple or quadruple systems, each of them with the capacity to ensure two-thirds or half of the required functions. These are known as 3 or 4 "train", "line" or "channel" systems. The French nuclear partners, after investigation of a wide range of possible solutions, decided, as had the licensor for the 900 MWe units, on a solution comprising two trains each capable of fulfilling the required function on its own. This technical solution limits equipment requirements and thereby capital outlay and simplifies the installation. On the other hand, this solution imposes a high degree of vigilance regarding availability of the two channels, which results in severe constraints on the allowable duration of contingent unavailability and stringent limitations on voluntary unavailability of one line, for maintenance for


59

instance, during operating periods when the system is required for safety reasons. For the investigation of each accident or incident, the most penalizing failure is identified for the phenomenon being examined. In certain circumstances, where normal operation of the two channels is the most penalizing condition, this is the condition that should be taken into account. Finally, during investigation of a LOCA, the choice of faulty equipment will be different, depending on whether fuel rod cooling or overpressure levels in the reactor containment are examined. An explanation of the single failure criterion can be attempted a posteriori, in terms of reliability, while remaining within the confines of orders of magnitude and rough approximations. Experience shows that, in general, a complex system comprising valves, pumps, sensors and various motors fails to start up when switched on about one time out of a hundred. If therefore a fourth category accident is allotted the maximum corresponding probability, i.e. 10-4 per year, the risk of seeing this initiating event and the failure of a postulated corresponding single channel engineered safeguard system occur together is 10-4 x 10-2 i.e. 10-6 per year. The corresponding situation would be a particularly serious occurrence and its estimated probability has been found to be excessive. However, in an equally simplified manner, a redundant system comprising two independent channels, each capable of fulfilling the required function, would have a total failure-to-start probability of about 10-4, if failures liable to simultaneously affect the two channels are ignored. This degree of probability, combined with that of the same initiating event as above, gives a serious accident probability of 10-8 per year, which is considered acceptable. However, in order to be able to disregard, as we have just done, simultaneous failure of the two redundant channels (usually called common mode failures or simply common modes), a double condition must be fulfilled: • avoidance of the possibility of a single hazard affecting equipment in both channels • limitation, insofar as possible, of failures common to several identical items of equipment. The first condition, concerning hazards outside the systems themselves, resulted in very strict layout and installation rules. "Redundant" system channels shall be installed in different, completely separate facilities. This geographic separation leads, for example, to the two diesel generators being located in completely separate facilities, with a calculated distance between them, which is great enough to ensure that even if an aircraft were to crash into the installation it would not destroy both generators.

60


Figure 4.1. gives an example of engineered safeguard equipment layout for a standard P4 plant unit.

Fig. 4.1. Equipment layout in a P4 1300 MWe PWR.


61

In the vicinity of the circuits to which redundant systems must be connected, geographical separation is no longer possible. Physical separation by means of suitable walls is then required. Equivalent solutions have to be found for electrical equipment or control and instrumentation systems in the vicinity of the control room equipment. Internal common mode failures are much more difficult to identify and prevent. These failures concern design, manufacturing or maintenance errors which are liable to affect several items of equipment. They therefore concern the general quality of the plant or its operation. Reliability statistics for equipment show that the combination of common mode failures represents about 3 to 5% of the causes of simultaneous failure of two identical items of equipment. This level falls to about 1 to 2% for triple failure. For example, if the failure-to-operate probability is 10-2 for a single train, • it is 3 10-4 and not 10-4 for two identical trains • and 10-4 and not 10-6 for three identical trains, taking the low levels for the common mode failure rates. Hence the benefit obtained by single redundancy diminishes as additional channels are added. This approach to the prevention of common mode failure overlooks a component the importance of which has only gradually been fully perceived. We are referring to the incidence of human factors and to failures related to maintenance activities or to plant operating procedures. It was not until the Three Mile Island accident, in 1979, that the full importance of human factors in nuclear engineering activities was realized. A few more years then elapsed before the detection, reporting and circulation of examples of errors related to repair work or maintenance, which had imperilled the availability or smooth running of several, or even all safety related devices. The few examples below are among the most spectacular but obviously do not suffice to fine down the common mode failure probability values. The first example concerns a plant unit abroad, characterized by a 4 train redundancy level, each with a 50% capacity. The function is therefore entirely assured by 2 trains out of 4. With this system, maintenance work can be carried out train by train, without any particular constraints. This plant is also equipped with a 4 train ultimate emergency system, which means that there are eight diesel-generator sets. In 1987, in the course of a routine inspection to adjust a setpoint on the eight diesels, a maintenance team unaccustomed to dealing with this equip-

62


ment and using a procedure which was not clearly formulated, terminated their work leaving the eight diesels in a configuration preventing their automatic startup. The abnormal condition was identified and corrected 15 hours later by a patrol inspection team. In 1989, there were many occurrences of this type in France, which will be discussed in Chapters 24 and 26, such as the wrong parts left on the three safety valves of a pressurizer or the isolating of four out of the five level sensors on another pressurizer. For the 900 and 1300 MWe plants, the single failure criterion was applied to equipment actuated in the first stage of the accidents analyzed, corresponding to the automatic response of the plant. For the N4 series, it has been extended to include other equipment required by the operators to bring the accident under control and achieve safe shutdown of the reactor. An example of such equipment is the pressurizer spray system.

4.5.4. Conventional load combinations The single failure criterion is not the only convention used in accident analysis to heighten the bounding case character of the cases considered and, where possible, of their consequences. In an equally formal manner, we consider load combinations comprising the mechanical effects of a major earthquake (the safe shutdown earthquake, SSE, described in Chapter 10), total loss of offsite power and fourth category large breaks, without increasing the reference radiological consequences. Although the facts had not been presented from this angle, it is entirely logical to combine a major earthquake with loss of the electricity transmission lines which are not designed to withstand a phenomenon of this nature. So this is an additional way of worsening the most serious postulated accident conditions in order to increase the bounding case character. We have seen that the single failure criterion required, in its French application, that all equipment necessary for control of accident situations should be duplicated with provision for two completely separate channels. With this new load combination, the electrical equipment for each of these lines must be backed up by a self-contained automatic startup generator, independent of the national grid. Each nuclear unit is therefore equipped with two diesel generators, with a unit power rating of a few MW and capable of supplying this power 40 seconds after the startup command. This response time is taken into account in accident studies since engi-


63

neered safeguard systems are only fully efficient after this time lapse. An earthquake must neither cause an accident, since the mechanical loads it could include are used, as we shall see, as a basis for equipment design (first level of defense in depth), nor must it prevent the engineered safeguard systems or reactor containment from functioning normally. This constraint added to the preceding ones signifies that equipment required during large break fourth category accidents must be fully effective during and after an earthquake. The diesel generator sets are clearly concerned by compliance with this requirement.

4.5.5. Prevention of accident degeneration Among the acceptability criteria for second and third category incident and accident consequences, it is specified that such events must not be the cause of an accident in the next category. Detailed analysis of each of these incidents or accidents must therefore determine the mechanical or other stresses brought to bear on devices other than those responsible for initiating the events considered, in order to ensure that they will not also subsequently fail. A whole series of load combinations is established which must be taken into account in equipment design. Similarly, a fourth category accident occurring in one part of the installation must neither spread to other parts of the installation nor prevent correct operation of the equipment provided to limit the consequences of such an event to acceptable values. For example, a primary loop break must not cause another break in the same loop, nor a break in another loop, nor serious disturbance of the safety injection system. The stresses due to piping deformation and jetting induced on the concrete and the primary loop bunker are studied in detail, since these structures provide the basic support for the affected loop as well as the adjoining loops. The results of studies required by the third level of defense in depth are thus used as design basis data at the first level of this process (the repetitive nature of which is now apparent) at least during the initial phase of new projects. Appropriate safety margins are then introduced in the course of preliminary studies and their adequacy is confirmed during the final demonstrations.

64


4.6. Consideration of internal or external hazards In 1971, when the licensing procedure for the first 900 MWe units at the Fessenheim site was initiated with the relevant safety authorities, safety investigation was not limited to accidents caused by direct failures of safety related equipment. A seismic load level was taken into account for the design of safety related equipment and structures. Protection of this equipment (safety injection accumulators, equipment connected with containment spraying, etc.) from missiles coming from primary system high pressure devices should also be added. Concern regarding various external or internal hazards had thus long existed but, under the impetus of safety analysis, this awareness was to be extensively developed. It will be the subject of Chapters 9 and 10.

5

Assessment of the radiological consequences of accidents

Analysis of each of the listed conventional accidents terminates with an assessment of the associated radiological consequences. It has to be demonstrated that these consequences are effectively acceptable, as only very high limit values are indicated in Table 4.1. This assessment involves phenomena and areas of knowledge which are fairly remote from those discussed in relation to equipment design. However, to ensure consistency with the other aspects of safety assessment, the same precautions have been taken to guarantee the bounding case character of the results. Intermediate calculation values are in fact used for the design of a certain number of systems, structures or equipment. This implies notably defining equipment qualification conditions with respect to the accident conditions described in Chapter 7, certain measuring ranges or radiological protection constraints. This requirement has led to the adoption of very extended bounding case values, suitable for the design options considered. But in this context, radiological consequence results are highly overestimated and difficult to use for the preparation of external emergency plans. We shall show in the next chapter the discrepancy there can be between a conventional assessment of radiological consequences and a more realistic estimate of the same sequence. On the other hand, in compliance with a convention the inadequacy of which was only realized much later, assessments were first based on the potential radiological consequences for an individual exposed for two hours at the site boundary to rare gases and iodines, i.e. products liable to have significant short term health effects. Similarly, radioactive products such as cesium, which has slight early effects becoming far more significant in the long term, are disregarded in this approach. The evolution of safety towards international projects and also the Chernobyl accident point to the necessity for more exhaustive, but also more realistic assessments, although maintaining provision for comfortable margins on equipment and components.

66


In the studies concerning current nuclear units, the accidental release mode considered is by air. Normal release, which will not be discussed here, is also discharged in liquid form to rivers or the sea. There should normally be no direct release into the ground and the water table. The relevant calculations comprise the following stages: • quantity of radioactive products in the core or reactor systems • release rate for these products during the accident considered • possible modes of transfer and deposit in reactor systems • modes of transfer and deposit in buildings • eak rate from the facility considered to the outside atmosphere and, where applicable, filtering efficiency • environmental diffusion, transport and deposit conditions • pathways to man • conversion of the activity absorbed by exposure, inhalation or ingestion, expressed in becquerels, to doses expressed in sieverts. These stages can be dealt with fairly independently, but attention is particularly drawn to radioactive products with the following unfavorable characteristics: large quantity, easy emission, relatively long decay time, severe biological impact. In the next Chapter, we shall describe in detail a large primary break accident (LOCA), up to the numerical application stage. Only more general data will be given in the present chapter.

5.1. Quantities of radioactive products involved Multiple fissioned fuel contains a more or less complete spectrum of possible radioactive products having an atomic number below that of uranium. It also contains small quantities of transuranians and transplutonians resulting from neutronic capture without fission. These are generally very long decay period alpha emitters. Depending on their radioactive half-lives and any interaction with the neutrons, these substances accumulate incessantly in the reactor fuel as burn-up increases or reaches saturation. The radioactive products in the primary coolant are due to activation of corrosion products and possible fission product leakage through the fuel clads. In this case, accumulation is limited by the periodic renewal of part of the water and by purification.

5 - Assessment of the radiological consequences of accidents

67

Chapter 3 contains a table indicating the quantities of the main radioactive products to be found in a 900 MWe PWR at end of cycle loaded with uranium oxide fuel with a burnup of up to 33 000 MWd/tU. These values and their relative importance would not be the same for a mixed oxide UO2-PuO2 fuel, thus containing plutonium from the outset or for significantly higher burnups. The term "core inventory" is often used to refer to the quantity of radioactive products in the core.

5.2. Release rates The characteristic release rate for each fission product is a particularly important factor. Light water reactor fuel is made of a type of ceramic which is both difficult to melt and relatively impermeable, enclosed in leaktight clads, from which fission products cannot easily escape.

Pellet temperature in °C Fig. 5.1. Release rates of fission products from a PWR UO2 fuel pellet.

68


The release rates of the various elements depend to a considerable extent on their physiochemical nature and the temperature of the fuel pellets. Certain substances, notably some iodines and noble gases, manage to migrate in small quantities from the fuel to the clad-pellet gap under normal operating conditions. We are presently able to specify release rates versus time and fuel temperature. The curves (Fig 5.1.) confirm that extensive release generally only occurs when the fuel pellets have melted, which does not happen in design basis accidents, where the clad temperature is limited to 1200 C, that of the pellets being only slightly higher. The clad failure* rate considered in each accident study is obviously an important factor, representative of a phenomenon which can occur at lower temperatures, such as those reached during certain design basis accidents. Radioactive substances located at the onset of the accident in the primary coolant water, the structural materials or the gaseous effluent tanks could escape far more easily.

5.3. Transfer and deposit in reactor systems When clad failure occurs under accident conditions, the radioactive products emitted at high temperature enter the primary cooling system as steam. Some of them will settle on the walls of the system, but this is not the case for the noble gases. The steam cools and may condense forming aerosols, which may also settle on the system walls, depending on thermal hydraulic conditions. In addition, there is the possibility that deposited material may return to circulation, but this also depends on subsequent thermal hydraulic conditions. These phenomena are only taken into account in the event of direct discharge to the atmosphere, as is the case with a steam generator tube break for example. All other cases where the release path is through the containment are consequently rather overestimated.

5.4. Transfer and deposit in buildings When they reach the buildings, all radioactive products are in aerosol form, except the noble gases. They generally stay there for a few hours to several days. High density aerosols tend to agglomerate. "Clad failure" means any lose of tightness, even if this is due to through-wall microcracking. In an accident situation, more severe defects will be involved


69

Soluble aerosols will be entrained by steam close to condensation or spray water, thereby gradually reducing their concentration in the atmosphere. This happens with the iodine soluble aerosol, cesium iodine, which can on the other hand, undergo radiolysis in the sump water to produce the gaseous iodine I2. In the other cases, the aerosols settle more slowly, by sedimentation, steam condensation on walls (diffusiophoresis) or due to a thermal gradient between the vector gas and the walls (thermophoresis). These phenomena, the impact of which on release rates is highly significant, are imperfectly known and are currently the subject of research*. Extremely prudent values were defined in the 1970s for the conventional assessments.

5.5. Leak rate to the outside atmosphere and filtering provisions The radioactivity leak rate to the outside atmosphere depends on any overpressure in the building induced by the accident and on the building leak rate and any ventilation and filter systems. Building leak rates and filter system efficiency must be determined with circumspection and periodically checked. Consideration must also be given to the risk of direct leakage to the atmosphere bypassing any filter systems and thereby reducing their overall efficiency.

5.6. Environmental transport and deposit conditions Release directly leaving the buildings or discharged via the stack blends with the outside atmosphere and its behavior depends on local meteorological conditions. Inert gases like the noble gases and certain forms of iodine diffuse. Aerosols, including iodine in particle and molecule form, also diffuse but, in addition, they spontaneously drop to the ground in dry weather or are washed down by rain (Fig. 5.2.).

* See also section 28.3.

70


Fig. 5.2. Behavior of release in the atmosphere.

At this stage, the atmospheric transfer coefficients (ATC), expressed in s m-3, and surface transfer coefficients (STC), expressed in m-2, are determined (Fig. 5.3.). The atmospheric transfer coefficient, in association with the activity released, suppresses the time element by considering the total number of disintegrations per m3 which take place throughout plume transit. In the surface transfer coefficient, the time element is kept, since it enables the activity per surface unit to be derived from the number of becquerels released. Design basis accident consequences are appraised using the Le Quinio charts based on continuous release for one hour under weather conditions covering 95% of the possible meteorological situations.

71


The characteristic coefficients are then as follows: • atmospheric transfer coefficient for gases: 6 10-5 s m-3, 500 m from the release point (10-6 at a distance of 10 km) • surface transfer coefficient at the same location: 6 10-7 m-2 considering a deposit rate of 1 cm/s (10-8 at a distance of 10 km). For different release times, these values must be corrected by multiplying them by the following corrective factors Fd (Table 5.1.).

Table 5.1 Release duration correction multiplicative factors Fd. Release and exposure time

5 min

10 min

15 min

30 min

1h

2h

8h

12 h

1 day

Corrective factor Fd

3.46

2.45

2

1.41

1

0.71

0.59

0.54

0.45

Charts determined by Robert Le Quinio

Distance from the source in km

Fig. 5.3. Atmospheric diffusion coefficient for aerosols.

72


The release time corrective factor takes into account wind swirling effects around a postulated constant mean direction throughout the release time, causing the plume to widen. For a given quantity of release, when the release time increases, the maximum consequences will thus be less severe but will concern a larger angled sector.

5.7. Pathways to man In the event of atmospheric release, the following pathways to man are considered: • immersion in the plume, causing whole body exposure to gamma radiation • inhalations of iodine which will then settle in the thyroid • external exposure to radioactive products deposited on the ground • ingestion of radioactive products deposited on the ground by direct consumption of leafy vegetables or by consumption of meat or milk from animals fed with contaminated grass. In the event of exposure to the plume for more than 2 hours, a respiratory capacity of 30 m3 per day is considered for the first 12 hours. Beyond this, the respiratory capacity considered is reduced to 20 m3 per day to take periods of sleep into account. The thyroid dose for infants is calculated assuming that they are entirely fed on milk from cows which have grazed in pastures so situated as to have been contaminated by iodine deposits. The krypton 85 in the plume also causes skin exposure to beta radiation.

5.8. Dose conversion factors In order to transform the activities of the various substances or families of substances (noble gases, iodines, etc.) into possible effects on individuals, dose conversion factors are used which take into account the corresponding radiation characteristics (type, energy, radioactive half-life, organ where it accumulates, biological half-life), the way in which organs are affected and their sensitivity. There are several different dose conversion factors (DCF): • plume DCF (Sv/TBq s m-3) which gives the integrated dose as the plume passes or immersion dose • deposit DCF (Sv h -1 /TBq m-2) which gives the dose rate for the first hour • effective DCF by inhalation (Sv/TBq s m-3) which gives the whole body dose commitment, weighted for receptor sensitivity

73


• thyroid DCF (Sv/TBq s m-3) which gives the thyroid dose commitment by iodine inhalation. These factors have fixed values only for given isotopes. For iodine, for instance, the table below can be drawn up on the basis of the iodine quantities in the reactor core. Considering the wide range of decay periods and dose conversion factors involved, the factor corresponding to 1 TBq of iodine varies with time and tends towards the value associated with I 131 which has a much longer decay period. Table 5.2. Characteristics of iodine isotopes. Isotope Activity (TBq) at t = 0

Decay period

Plume

Deposit

DCF

DCF

Inhalation Thyroid effective inhalation DCF

DCF

I 131 I 132 I 133 I 134 I 135

2.9 106 4.2 106 6.1 106 4.7 106 5.7 106

8.02 2.30 20.8 53 6.55

d h h min h

0.0257 0.161

0.0417 0.178 0.111

1.89 11.2 2.99 12.2 7.13

2.93

96.7

0.0303 0.500 0.00996

16.3

0.566 0.0966 2.83

0.101

The thyroid dose conversion factor of 1 TBq of the mixture of iodine isotopes will be as follows, depending on the time lapse since reactor shutdown: Table 5.3. Thyroid dose conversion factor of the mixture of iodine isotopes. Time

1h

2h

6h

12 h

1d

2d

4d

10 d

30 d

Thyroid DCF

17.2

19.3

24.5

28.1

33.2

40.3

50.2

69.2

93.9

The integrated dose as the plume passes or the dose commitment by inhalation is obtained by the formula: where D is the integrated dose or dose commitment i the exposure mode A the activity released ATC the atmospheric transfer coefficient Fd the release duration correction factor DCFj, the dose conversion factor for exposure mode i.

74


The dose rate due to deposits during the first hour after the accident is obtained in the same way: DR = A x STC x DCFd where DR is the dose rate and STC the surface transfer coefficient. After the first hour, the radioactive decay of the element considered must be taken into account, also, in the longer term, its trajectory following rain-washing or penetration into the ground. In both these cases, the activity released is obtained: • from the core inventory for the radionuclides considered, with allowance for decay • from the release rate from the initial medium (core or primary coolant water, for example) associated with the clad failure rate in the case of fuel.

5.9. Changes in radiological consequence calculation methods We have mentioned the conventional character of the approach described. Many coefficients are extremely penalizing, as is shown by extensive comparisons with international practice elsewhere. It is incomplete in that it does not include assessment of the problems raised by the medium and long term management of contaminated areas resulting from the accidents considered. Developments with respect to these two aspects will be discussed further on. Moreover, the dose conversion factor values used are those given in ICRP publication 30, issued in 1979. But the notion of public has since changed and it is no longer a homogeneous adult population which is considered. In more recent texts (publications 56, 67, 69 and 71), attention to age-related biokinetic differences is recommended. For example, the new dose conversion factor for iodine 131 is 5 times higher for an infant than for an adult. For other iodine isotopes, this factor is comprised between 10 and 13. These modifications are not taken into account in the French regulations in force in 1995.

6

An example of accident analysis: LOCA

This chapter consists of a rapid and qualitative account, from the point of view of the physics of the phenomena as much as the design hypotheses, of a loss of coolant accident (LOCA) corresponding to the largest primary system break considered, serving as the design basis for essential safety related components of the installation. This description shall take into account all conventional conservative assumptions. Under real conditions, the situation would not evolve in such a prejudicial fashion. There is a whole spectrum of potential primary system breaks, from those which are sufficiently minor for leakage to be counterbalanced by the Chemical and Volume Control System flowrate, up to complete doubleended rupture of a main primary loop pipe with deflection of both pipe ends. Ruptures of the latter type are liable to occur on the hot leg between the reactor vessel and the steam generator, on the intermediate leg between the steam generator and the primary pump, on the cold leg between the primary pump and the reactor vessel on return towards the reactor core (Fig. 6.1.). The complete spectrum and all locations must be investigated, since the physical and mechanical phenomena and the behavior of engineered safeguard systems vary from one case to another. It will then be possible, as we shall show in the next chapter, to select the most penalizing cases for analysis. Among large breaks, those which occur on the cold leg are the most serious from the thermal hydraulic standpoint, as steam venting can only take place after core dewatering. The pressure loss incurred in the steam generator tubes is extremely high and, in addition, much of the safety injection water will escape directly through the break. Hot leg breaks, on the other hand, involve the most penalizing stresses for reactor vessel internals since the blowdown wave will strike this equipment without any damping effects.

76


6.1. Physical effects of a large break The description below concerns a cold leg break located between a primary pump and the reactor vessel.

Fig. 6.1. Diagram of a 3-loop 900 MWe.

6.1.1. Mechanical effects of blowdown During pipe rupture, a depressurization wave of between 50 and 100 bar will sweep through the primary system at a speed of about 1000 meters per second.

6 - An example of accident analysis: LOCA

77

The arrival of this wave front in the vessel will induce negative pressure in the downcomer. The resulting stress on the vessel shell rings and especially on the core support structures, will be about 1500 t, far more than the effect of an earthquake, for example. The control rod mechanisms and reactor vessel internals will be subjected to major stresses, some of them being lateral stresses. As pressure upstream or downstream of the affected primary pump would fall sharply, the pump would operate at a speed which could reach twice the rated speed in forward or reverse flow. The centrifugal force applied to the flywheel would therefore be very high.

6.1.2. Thermal hydraulics and fuel behavior Four distinct phases are involved: • primary system depressurization (blowdown) and drainage • core reflooding • fuel rod rewetting • long term behavior.

6.1.2.1. Blowdown As soon as the break occurs, the primary system rapidly drains. The fluid issues from each broken pipe end at the critical flowrate, i.e. the unstable mixture of water and steam and water and steam emulsion flows out at the speed of sound. Since the fluid flows out from both sides of the pipe, there will be a zero velocity point in the primary system, the stagnation point. The position of this point will change as the process proceeds and will condition core cooling. When this point is located in the core, it will be in an environment where there is little convective heat exchange since there is no circulation. In this case, removal of the heat produced by the fuel rods will depend solely on conduction and radiation. The location of the stagnation point is contingent on vaporization conditions in the different areas of the primary system, pressure losses, notably in the steam generators and the pumps, the position of the break and the fluid characteristics at both pipe ends and on steam and water separation in slow flow areas. Primary system drainage is accompanied by a rapid fall in the primary system pressure level down to saturation pressure in the hot zones between the upper part of the core and the steam generators. Then bulk water flashing occurs in the affected zones. Flow through the core tends to reverse, thereby shifting the stagnation point.

78


Fig. 6.2. Cross-section of a 900 MWe PWR reactor vessel.

The vaporization slows down pressure reduction in the primary system, but spreads through the core water which is at a slightly lower temperature. When bulk vaporization conditions are reached in the cold zones, between the steam generators and the reactor vessel inlet, the speed of depressurization reduces still further. Normal core flow resumes.


79

The accumulator tanks empty automatically into the primary system when the pressure falls below 40 bar, but without reflooding the core. This phase ends when the containment pressure balances that of the primary system, a few tens of seconds after onset of the accident. In the core, the chain reaction was stopped by the moderator void effect when boiling occurred between the fuel rods, even before emergency shutdown was implemented. Despite the shutdown of nuclear power production, the fuel rods still contain energy and continue to release the decay heat due to fission products. Fuel cooling conditions quickly become unfavorable. As soon as the pressure reduces, burnout occurs and the cladding becomes surrounded with steam, which reduces the heat exchange coefficient by a factor of 100 to 1000. The cladding temperature rapidly increases by transfer of the energy accumulated in the fuel pellets. When there is no liquid left in the core, an adiabatic phase begins. Energy transfer can only take place by radiation and steam conduction. Clad temperatures rise again, but more slowly. An exothermal reaction between the zirconium and the water or steam begins on clads where the temperature has exceeded 850 °C, which further exacerbates the phenomenon. Beyond this temperature, the power released by the water-zirconium reaction doubles every 50 °C and increases in an uncontrollable manner for temperatures little above 1300 °C. It then becomes impossible to stop the reaction before total oxidation of the zircaloy. Under the design basis accident conditions, clad temperatures must not exceed 1200 °C, thus preventing this critical phenomenon. The pressure inside the fuel rods very quickly becomes higher than the outside pressure. The hottest rod clads swell elastically and then plastically and are liable to burst. If this happens, it will occur during the adiabatic phase.

6.1.2.2. Core reflooding By the end of the preceding phase, the accumulator tanks have filled the core lower plenum and the downcomer with water. Low head safety injection, also connected to the cold legs, then takes over. As with the accumulators, the safety injection system is connected to cold legs. The water reaches the level of the bottom of the fuel rods where it vaporizes, thereby preventing direct refilling of the primary system.

80


Core reflooding is a purely gravitational phenomenon. The weight of the water column in the downcomer must overcome steam head loss and water droplets moving through the core and, in the event of a cold leg break, the steam generators and pump. The water level in the core rises gradually, without however rewetting the fuel rods. There is a film of steam around the rods preventing direct heat transfer between the cladding and the water. During this phase, a degree of cooling is ensured by steam convection and also by radiation between the dry parts of the fuel rods and water droplets entrained by the steam. In this way, the core is rapidly reflooded without however rewetting the clads, the temperature of which will increase slightly before decreasing.

6.1.2.3. Fuel rod re wetting Unlike core reflooding, which is an essentially gravitational phenomenon, rewetting of the cladding is a thermal phenomenon. It consists of axial conduction along the rods which enable the "wetting front" or "quench front" to move out of the lowest fuel element zone which is the site of relatively low energy release. At this quench front and for several millimeters beyond it, the cladding temperature drops from a possible 1000/1100 °C for the hottest fuel rods to a temperature close to that of boiling water at a pressure of several bar i.e. 130 °C approximately. Axial conduction in the cladding enables cooling of the rods to take place just above the quench front thereby enabling progressive rewetting which continues to the top of the core.

6.1.2.4. Long term behavior and operator intervention When the accident takes place, the energy present in the core, the cooling water and primary system structures is found in the containment in the form of hot water and steam under a pressure of several bar. The residual power due to fission product decay will be gradually added. The safety injection and containment spray are initially supplied by the reserve water provided for this purpose (Reactor Cavity and Spent Fuel Pit Cooling and Treatment System tank). When the low level in this tank is reached, these two systems are connected to the containment sumps collecting overflow water which can then be recycled. Exchangers with a suitable capacity located in the containment spray circuit ensure energy transfer to the site ultimate heat sink.

6 - An example of accident analysis: LOGA

81

This recirculation phase is liable to be very lengthy i.e. months or even years. Given the speed of the initial phenomena, automatic protection methods are alone capable of adequately rapid response. Operators can only verify the correct operation of systems and protection devices and recirculation switching. Their first direct action is connected with the risk of boron crystallization in the core. Water in the primary system contains boron in the form of boric acid* H3BO3 in solution with a boron concentration varying between 0 and 2000 ppm (parts per million) for neutronic reasons (compensation for fuel burnup and temperature effects). Safety injection water always contains 2000 ppm of boron. Special smaller tanks from which water is injected into the primary system to cope with criticality accidents can contain solution with 7000 ppm of boron for the 1300 MWe PWR's and 21 000 ppm for the 900 MWe reactors. But since boric acid, which is relatively insoluble, is not entrained by the steam produced in the reactor core, there is a danger of a gradual buildup of boron concentration and then its crystallization which would block all fluid circulation in the hottest channels. To prevent this from happening, it is planned to change water flow direction in the core periodically by injecting water from the hot legs after a certain time and then reverting to the initial configuration. For the 900 MWe units, the first switch in flow direction must be carried out about 18 hours after the beginning of the accident and be repeated several times afterwards.

6.1.3. Effects on the reactor containment and internal structures In the event of a large break, out-spill into the reactor containment of all the primary system water and a substantial quantity of the safety injection water for cooling fuel and structures causes a significant rise in temperature and pressure in this containment. This phenomenon first occurs in the room containing the damaged pipe, each leg of each loop being more or less separated from the others by the reactor building internal structures which ensure support and routing of these pipes.

* Natural boron comprises 2 isotopes, 10 B (18.3%) and 11 B (81.7%). The 10B has a very high thermal neutron capture cross-section: 4017 barns (1 barn = 10-24 cm2 per atom). By reaction (n, ) it gives stable 7 Li. Natural boron is added to the core coolant water in the form of boric acid, the molar mass of which is 61.8 g, including 10.8 g of boron. A 4% boric acid solution contains 0.7% of boron (7000 ppm).

82


Some of the walls of these structures are therefore subjected to major stresses due to pressure differences, the effect of water jets, pipe whip and hydraulic stresses within the primary system. In order to avoid the risk of additional pipe breaks, these stresses must not be transferred to other pipes. These compartments are, however, sufficiently open for the steam contained in them to escape rapidly into the containment itself. Within this area, a first pressure peak is reached at the end of primary system depressurization. Condensation on the walls reduces this pressure and the associated temperature. The steam produced by rewetting the fuel rods could cause the pressure and temperature to rise again until startup of the containment spray system. Startup is automatic when the containment pressure exceeds 2.4 bar abs. but, in view of the startup delay for diesel generators, spraying can only be effective during the reflooding phase. From this point, temperature and pressure reduction will be practically continuous. The containment is consequently subjected to one or two internal pressure peaks, but also to thermal stresses which develop more slowly following progression of the temperature front through the containment concrete. The containment might be subject, at a later period, to overpressure due to explosion of a mixture of hydrogen and oxygen. Oxygen is present in the containment air and hydrogen is released from the following sources: • small quantities of hydrogen deliberately dissolved in the primary system water to "neutralize" water radiolysis in the reactor core • zirconium - water reaction • water radiolysis in the sumps due to radiation of the radioactive products this water contains. Under the specified conditions of this design basis accident, radiolysis in the sumps would have to be extremely intensive for the hydrogen concentration to be sufficient to initiate a deflagration. This allows time to bring to the site the specially designed hydrogen recombination equipment, which is available on demand, but not routine power plant equipment.

6.2. Assumptions adopted in safety analysis In conformity with the principles outlined in Section 4.5, the assumptions retained are intended to give a conservative bounding character to the accident analysis with a view to determining the required characteristics for equipment, protection systems, engineered safeguard systems and the reactor containment.


83

These postulates will not always be the same, since the most penalizing are selected for each phenomenon considered. Only the most significant are outlined below.

6.2.1. Assumptions concerning estimation of fuel behavior The postulated conditions are aimed at maximizing the fuel cladding temperature. To this end, the containment pressure is reduced to a minimum, thereby minimizing the density of the steam, which is the only cooling means available during the adiabatic phase. The initial power is taken as equal to 102% of the rated power, increased by the pump power. The neutron flux and power distribution in the core is the least favorable of all the scenarios made possible by the operating conditions and authorized transients. The ratio between power produced in the hottest centimeter of fuel rod and the mean linear power density exceeds 2.3. Residual power due to buildup of fission products corresponds to the reactor state where these values are highest (end of equilibrium cycle). The figure obtained is increased by 20% to cover calculation uncertainties. Thresholds for signals tripping the emergency shutdown and safety injection systems which are normally set at 131 bar and 119 bar respectively are reduced to 129 and 117 bar. Offsite power is assumed to have been lost as soon as the accident occurred. The safety injection and containment spray system pumps must consequently await emergency diesel powering. Safety injection only starts 30 seconds after the startup signal has been sent. In compliance with the single failure criterion, only one channel is operative, thereby slowing down reflooding, rewetting and the overall cooling of the primary system. However, containment spraying is assumed to start up 27 seconds after onset of the accident. Both channels function normally. These two postulates reduce the pressure in the containment and accelerate energy transfers.

6.2.2. Assumptions concerning estimation of consequences for the containment Although we are still discussing the same accident, everything is now arranged so as to worsen the consequences for the containment. Certain specific postulates modify the assumptions outlined above.

84


The primary system water temperature is increased by 2.2 °C. The volume of this water is assumed to be 103% that of the cold primary system water. The adiabatic phase during which there is negligible energy transfer between the core and the reactor building atmosphere is not taken into account and this accelerates mass and energy transfer in the containment. The accumulators normally start operating at 42 bar, hence a little earlier than in the above scenario. The safety injection flowrate is maximum. Both channels are operating, which accelerates energy transfer and increases the pressure in the containment. Initial pressure and temperature levels in the containment are maximum permissible values for normal operation. In conformity with the single failure criterion, only one spray channel is assumed to be operating in the containment.

6.3. Acceptability criteria and results These criteria were specified in 1973 by the American Safety Authorities (U.S. NRC) and have not been modified since that time. They are four in number: • peak cladding temperature must remain less than 2000°F (i.e. 1204 °C), to prevent runaway of the reaction between water and zirconium • cladding oxidation rate must, at all points, remain less than 17% of its thickness to prevent embrittlement of the fuel rods at rewetting • the average oxidation rate for core zirconium must remain less than 1 % to limit the quantity of hydrogen produced • the core must retain a geometrical configuration which enables it to be cooled. Parametric investigations have revealed that the break giving rise to the most difficult conditions for the fuel is not a double-ended guillotine break with complete separation, but a break on the cold leg with partial separation. In this case, the accident scenario is more or less as follows: • emergency shutdown signal after 0.5 seconds • safety injection signal after 1 second • start of accumulator injection after 16 seconds • end of blowdown after 25 seconds • start of pump safety injection after 31 seconds • start of core reflooding after 35 seconds • bursting of the hottest fuel rod after 24.5 seconds. The temperature of the hottest fuel clad reaches 1200 °C. The clad with the highest rate of oxidation is only at 6.6%. The quantity of hydrogen produced by zirconium oxidation only repre-


85

sents 0.3% of its potential value, hence one-third of the specified value. Under these conditions the general geometrical configuration of the core remains unaltered.

6.4. Evaluation of radiological consequences As we saw in Chapter 5, evaluation of the radiological consequences of a LOCA rests upon a certain number of postulates: • the quantity of fission products built up in the fuel rods before the accident, the "core inventory" • the fission product release rate during the accident, taking into account the fact that some have already accumulated in the clad-pellet gaps and that the others are retained in the fuel • the proportion of fuel rods which have lost their cladding leaktightness, referred to as the clad failure rate • the behavior of released fission products, considering their physicochemical forms and the various phenomena tending to retain them: physical barriers, deposition in the primary system or the reactor containment, entrainment in the containment spray water, etc. • the containment building leak rate and the radioactive product release scenario both from the containment building and from auxiliary buildings • meteorological conditions on the site and the radioactive product mode of release to the environment. Estimates are based on several sets of postulates. The disparity between the results obtained gives an idea of the conservative nature of certain options. Work is in progress to set up a more consistent set of postulates. The extension of international comparisons and, even more so, the preparation of an industrial project for a French-German designed reactor, emphasize requirements in this area. The first set of assumptions we shall discuss was drawn up between 1970 and 1976 by the Nuclear Safety Department, which has now become the Institute for Nuclear Safety and Protection. These assumptions have changed little since then, are considered as "reasonably realistic" and have been used up till now for safety demonstrations. The second set is, by contrast, extremely pessimistic. Of American origin, it was designed to be applied to several types of reactor featuring a reactor containment and only explicitly takes into account systems common to all installations.

86


In conclusion, we shall describe a more recent set designed not for safety demonstration but for the preparation of external emergency plans. In this context, a compromise has to be found between the advantages and drawbacks of evacuating populations, confining people indoors or restricting consumption of foodstuffs and the risks actually incurred. Release estimates made in the safety demonstration context could lead to unsuitable provisions being made.

6.4.1. "Reasonably realistic" assumptions Buildup of fission products corresponds to the maximum value during the reactor life span: a third of the core was irradiated for one year, a second third for two years and a third for three years. The accident is postulated as occurring just before a refueling shutdown. We have seen that the limit cladding temperature is 1204 °C. This criterion of course applies to the hottest centimeter of cladding in the core. Neutronic and thermal hydraulic studies show that the power given off by the hottest centimeter of fuel rod is 2.3 times higher than the mean power level. Despite optimization of core loading patterns, the power varies axially along each fuel rod. The discrepancy between maximum and mean values in this direction, called the axial hot spot factor, is about 1.55. The radial power factor reflects power distribution between the different fuel elements, which do not all have the same burnup fraction and are not located in the same neutron flux. This factor is about 1.5. Clad bursts are liable to occur at the hottest points on the hottest fuel rods. Despite temperature restriction for the hottest fuel clad to 1204 °C and the fact that a larger number of fuel rods each release a fairly low amount of power, it is assumed that the integrity of all fuel clads is breached. It is obviously impossible to imagine a worse cladding failure rate, but this scenario is not intended for realistic assessment. In the event of clad failure, release from the rod concerned consists mainly of fission products which had already migrated from the fuel pellets or which did so during the brief thermal transient. The space freed by the fuel pellets inside the clads is assumed to contain 2% of the noble gases but 30% of the krypton 85 and 3% of the iodine. At the time of the accident, the core is considered to contain 5.2 106 TBq of krypton including 0.2 TBq of krypton 85, 14.7 106 TBq of xenon and 28.7 106 TBq of iodine. It is then assumed that all these gases are released in the containment without any retention in the primary system.


87

This will lead to 4 105 TBq of noble gases and 8.6 105 TBq of iodine in the containment. The noble gases remain free in the containment but iodine might be retained in varying proportions, depending on its physicochemical form. Iodine might be released in molecule or particle form or combined with organic products. It is assumed that 90% of the iodine is molecular and 10% organic. Only containment spraying is taken into account; deposition on structures is disregarded. 99.9% of the molecular iodine is entrained in the spray water; which has no effect on organic iodine. The containment atmosphere now still contains 4 105 TBq of noble gases, 8.6 104 TBq of organic iodine and 7.7 102 TBq of molecular iodine. In the case of 900 MWe nuclear unit reactor containments - single-wall containments with a metal liner - the allowed daily leak rate at peak pressure is 0.3% by weight of the gas mixture in the containment. A part of this leakage is conventionally assumed to reach the environment without filtering. This is the maximum authorized leak rate. It then decreases but is assumed to remain at half this value for 9 days whereas the internal pressure has practically reverted to normal. With these postulates, within two hours, 0.022% of the products in the containment atmosphere will have escaped, involving 88 TBq of noble gases, 19 TBq of organic iodine and 0.17 TBq of molecular iodine. With the 1300 MWe nuclear units, equipped with double-wall containments, no liner but leak recovery systems with discharge of iodine through active charcoal filters, the release levels are slightly lower. Atmospheric diffusion coefficients and ground deposition coefficients are calculated using charts developed in France by R. Le Quinio. This method considers meteorological conditions covering 95% of the possible scenarios and postulates that release occurs at ground level, which is unfavorable, especially for short distances. These conditions are maintained throughout the release period. As we saw in the previous chapter, the atmospheric transfer coefficient at a distance of 500 m for release lasting two hours is 6 10-5, multiplied by 0.71 to take the release period into account. Using the dose conversion factor corresponding to 1 TBq of iodine in its isotopic composition after a decay period of two hours (19.3), we can then determine the dose commitment to the thyroid. The calculated thyroid absorption dose due to inhalation of iodine within the plume is consequently (19 + 0.17) x 6 10-5 x 0.71 x 19.3 = 15.8 mSv. For whole body exposure due to the plume, the effect of iodine, calculated using the dose conversion factor corresponding to external exposure (DCF = 0.097), must be added to the effect of the noble gases calculated under the same conditions (DCF = 0.024).

88


giving a total of approximately 0.17 mSv. The above numerical applications are approximate and simplified. The most recent EDF safety reports contain the following results: • external whole body exposure due to the plume lasting two hours at a distance of 500 m: 0.146 mSv. • internal adult thyroid exposure due to iodine inhalation for two hours at a distance of 500 m: 11.5 mSv. It is clear that, despite the use of pessimistic sets of assumptions, individual dose levels remain low, considering the estimated frequency of the occurrence considered and are well below the values given in the table in Chapter 4 for fourth category accidents, i.e. 150 mSv and 450 mSv respectively. The safety reports also indicate the estimated thyroid dose for an infant fed exclusively and for a long period on milk from cows which had grazed on contaminated grass for two hours at a distance of 500 m: 1.58 Sv. This value is high, but corresponds to a theoretical scenario making no allowances for emergency plan provisions.

6.4.2. Highly pessimistic American assumptions The assumptions specified by American Regulatory Guide 1.4 which is not a statutory document, are as follows: • complete loss of cladding leaktightness • maximum fission product buildup in the fuel. (These two assumptions are identical to those of the previous set.) • release into the containment of 100% of the noble gases and 50% of the iodine contained in the fuel. This does not correspond to the physics of a LOCA but rather to what is known as a core meltdown accident, a less frequent occurrence causing severe damage to fuel with loss of its geometrical configuration and hence significant overheating of the combustible mass. • absence of containment spraying but adsorption on the structures of 50% of the iodine released in the containment. As French reactor containments are equipped with a spray system supplied from two separate trains, this is a more serious scenario than that under investigation. • peak leak rate is postulated for the containment for the first 24 hours, followed by 50% of this leak rate for the remaining duration of the accident. • particularly penalizing environmental dispersion and deposition models.


89

The results of these assumption are as follows: • external whole body exposure at 500 meters in two hours: 62 mSv • thyroid exposure under the same conditions: 1.28 Sv. The external exposure in this case is moderate. Thyroid exposure, on the contrary, is high. The total absence of spray facilities increases the consequences due to iodine by a factor of about 10.

6.4.3. International comparisons In view of the extension of international relations, the Commission of the European Communities and the OECD organized comparisons between methods of assessing the radiological consequences of accidents. These comparisons will only be meaningful if it is possible to distinguish differences due to technology and specific accident conditions from those due simply to varying degrees of stringency in the postulates. At the present time, discrepancies of well beyond a factor of 100 are to be found on estimated iodine consequences. The conventional values used in France for safety demonstration purposes are the least favorable. In other countries, however, radioactive products such as cesium or strontium are considered, since they have a significant medium and long term impact.

6.4.4. Realistic assessments for the preparation of emergency plans The accident we are discussing is by no means a specified requirement for preparation of the external emergency plans for population protection which will be discussed in Chapter 17. For the time being, there are no special detailed investigations of assumptions based on a realistic approach to be taken into account in the event of a LOCA. No consensus has consequently been arrived at on this question. However, the calculations given in Section 6.4.1. can be used for this purpose, providing certain coefficients are changed. Nothing need be changed in the core inventory. On the other hand, a clad failure rate of 33% instead of 100%, should cover all contingencies. Similarly, in view of the temperatures involved, the clad-pellet gap will be assumed to contain only 1 % of the noble gases, including krypton 85, and 0.5% of the iodines and cesiums. Finally, only 0.3% of the iodine is considered to be organic, the rest being in particle or molecule form.

90


Containment spray efficiency will be penalized by a time lag, but this has no implications for the noble gases, nor for the organic iodine, which would, in any case, be unaffected. A containment leak rate below the design value could also be postulated, but this would have less impact than the changes proposed above. On this basis, we obtain the following release estimates: • 14.4 TBq of noble gases • 0.031 TBq of organic iodine • 0.10 TBq of other iodines. The thyroid dose will then be 0.107 mSv instead of 15.8. The dose due to exposure from the plume is 0.015 mSv instead of 0.17. Doses at these levels require no special immediate provisions with regard to the population. From this realistic standpoint, on the other hand, iodine and cesium deposits must be estimated in order to assess the necessary agri-foodstuff restrictions. The surface transfer coefficient at a distance of 500 m is 6 10-7m-2 (cf. 5.6). Organic iodine behaves like a gas rather than an aerosol. Deposit will consequently be 42 600 Bq m-2 For cesium, the complete calculation starting from the value of the amount in the core indicated in Chapter 3 gives 15 000 Bq m-2. Concentrations at these levels could entail certain provisional agri-foodstuff restrictions over 2 or 3 kilometers in the direction of the wind at the time of the release, but that is a far cry from the maximum permissible consequence limits.

6.5. Safety demonstration evolution The safety approach described above is inherent to the authoritative foundation on which the first 900 MWe nuclear units built in France is based, even if we have referred to certain modifications. In view of available world experience, this foundation was considered an adequate one. Accidents on the reference list were studied in their initial most active phase, covering a period of about thirty minutes or possibly more, to investigate boric acid crystallization risks. No further studies of subsequent phases or of alternative accident scenarios entailing major radioactive release with contingent population evacuation were required from the operating utility as a preliminary to authorization procedures. This approach, although it has not been judged invalid, has been considerably supplemented by input from the constant evolution of safety concerns, significantly disturbed by the Three Mile Island accident and then by the Chernobyl disaster. Answers have gradually been found, after often lengthy investigations.

7

Assessment of safety justifications

As already mentioned, the operator of a nuclear installation is primarily responsible for the safety of his installation. He must consequently perform his own safety analysis. In order to obtain the specified authorizations for plant construction and then its operation, he must submit his analysis to the safety authorities. The IPSN will then proceed to the technical analysis of the justifications presented, whilst the DSIN will procure the official and administrative documents required in conformity with current regulations and government policy in this respect, taking into account the opinion formulated by the IPSN and, where applicable, that of the competent Standing Group. Safety analysis is therefore conducted in the first place by the plant operator who must be able to demonstrate the soundness of all safety related technical decisions he has made. This analysis is carried out in close collaboration with the system designer and manufacturer but overall answerability to the public authorities remains the responsibility of the operator. Assessment of the justifications presented is carried out by the IPSN, in its capacity as technical adviser to the DSIN and appraises the validity and exhaustiveness of the justifications, the efficacy of safety provisions made by the operator and their conformity to regulatory requirements. It is obviously preferable for permanent, iterative technical interchange to be set up between safety organizations and plant operators, thereby enabling any difficulties to be expressed and acceptable solutions to be found before the final completed documents are submitted for approval. This naturally implies consistent observance of the functions and responsibilities of all those concerned. The DSIN can then define the conditions under which will be issued the various decrees or ministerial approvals authorizing the building, startup tests, commissioning and commercial operation of the installation. Appraisal of the safety justifications for an installation comprises two main aspects.

92


The first consists in checking for each plant that safety principles and methods of approach, together with any regulatory texts interpreting them, are effectively applied by the operator with the plant designers and builders and that the resulting technical solutions fulfill their purpose. In addition, all consequences of the various normal, incident and accident operating conditions must be examined. The second, more general and unconnected with a specific project, consists in carefully considering the principles and methods themselves with a view to optimizing them by examining them in greater depth and identifying weak points or inconsistencies in these approaches and their application to the design, construction and operation of nuclear installations. As regards light water reactors, changes in safety appraisal have been based on more and more extensive use of the probabilistic approach and on operating feedback concerning both French reactors and others throughout the world, constituting a complementary approach. In this chapter, we shall deal with the first part of the analysis, whilst main developments, operating surveillance and operating feedback will be discussed in later chapters.

7.1. Data drawn from operating condition studies Operating condition studies carried out according to the conventions outlined in the preceding chapters are designed to check that, in view of the protection, safeguard and waste treatment systems, the planned operating modes and the postulated accidents will have acceptable radiological consequences. Furthermore, these studies are the source of a large amount of detailed data which forms one of the bases of safety analysis. From this data can be deduced: • reactor core physical and thermal hydraulic operating conditions • design stresses for structures and equipment • the safety importance of each structure and item of equipment • the functional requirements for each of these items • the functional capacity required for each system • incident and accident procedures • the limits taken into account and the authorized operating range for each installation • assessment of normal and accident release levels • radiation protection conditions on the site.

7 - Assessment of safety justifications

93

We must also include options and investigations aimed at incident and accident prevention based on appropriate selection of materials and manufacturing and control techniques for major items of equipment implying competence in highly specialized fields. These will be considered later on in the context of discussion of operating surveillance and difficulties encountered in this respect.

7.1.1. Physical and thermal hydraulic operating limits for the reactor core The gravity of the radiological consequences of the incidents and accidents considered will obviously depend on the fuel damage caused by these situations. But this damage is directly contingent on the mean thermal output of the fuel, on the maximum local power level and on core cooling conditions defined by the reactor coolant pressure, temperature and flowrate. The phenomena which must be prevented or limited are fuel pellet bursting, their internal meltdown, excessively high clad temperatures liable to cause clad failure or meltdown or repeated mechanical stressing which can cause embrittlement. The main thermal output of the fuel is obviously proportional to the overall thermal output of the reactor. The local power level depends in addition on the shape of the neutron flux in the core and the fuel enrichment distribution pattern. The flux shape and power distribution are notably affected by fuel burnup, control rod positions and degrees of core insertion, control rod movements and the resulting xenon poisoning buildup. Mechanical stresses on the clads may be related, for instance, to the rapidity of power increments. As we have said, the thermal output of a reactor core is regulated by controlling the core reactivity.*

* Reactivity expresses the departure from unity of the number of fissions between one generation and the next. In France, a very small unit is used, the pcm (pour cent mille), which corresponds to an effective multiplication factor of 1.00001. Other countries use the % unit. The greater part of the neutrons involved in the chain reaction are directly released when fission occurs. Their lifetime is short, 25 sec for light water reactors. For some, however, release is delayed, depending on the radioactive decay of certain fission products. These neutrons play an important part in reactor kinetics. Their contribution, named (3, notably depends on the fissile nuclei : 1470 pcm for U 238, 650 pcm for U 235, 210 pcm for Pu 239. The effective (3 value depends on the propor-

94


The first condition of this control is core stability with respect to reactivity variations. This is obtained by ensuring that the volume of water between the fuel rods is slightly below that required for optimum neutron slowdown**. A power build-up will increase the temperature of this water, reducing its density and thereby neutron moderation and their capacity to produce more fissions. This negative temperature coefficient introduces a negative reactivity feedback which is essential to the stability of the system and consequently to safety. So it is when the core is cold and when the density of the water it contains is highest that maximum potential reactivity levels are reached. The quantity of fissile materials inserted in the core at each refuelling enables the reactor to operate for at least a year. This available reactivity is compensated for by means of control rods and boron dissolved in the primary coolant water. But control rods which are highly neutron absorbent considerably disturb the local neutron flux and hence the local power level and cause mechanical stressing of the clads. So highly absorbent "black" rods are used for reactor shutdown and less absorbent "grey" rods for short term regulation. Another compromise has to be found between the number of control rods and the overall and individual rod worths used to guarantee rapid shutdown of the reactor by rod drop with a sufficient margin, without ejection of the rod with the highest worth, which is a 4th category accident, giving rise to unacceptable consequences for this category. Using boron dissolved in the water does not entail the same drawbacks, since it is evenly distributed. However, altering the concentration is not a fast process and there is a maximum concentration limit which has serious safety implications. Care has to be taken to prevent the overheating of a moderator containing an excess of neutron poison, which could reduce the density of the poison, thereby causing an increase in reactivity and consequently a power buildup which could be divergent. This is known as a positive temperature coefficient, which is a prohibited situation for the reactors considered. Many plant design and operating constraints, together with protection and engineered safeguard system design are determined by such considerations. tion of these nuclei. For the uranium-fueled French PWR's, the eff varies between 500 and 700 pcm. In the case of mixed oxide fuel, it is between about 450 and 510 pcm, thereby necessitating more control rods. When reactivity is higher than the eff, the time separating two generations of neutrons is very short. Extremely fast power variations can then occur. In some countries, the ( eff is used as the reactivity unit, usually expressed in dollars ($). ** Cf. Section 30.5.3.


95

Obviously, the physical and thermal hydraulic design studies must encompass all types of load, all fuel depletion conditions and all reactor states, from rated power to cold shutdown. Any change in fuel characteristics such as, for instance, the introduction of a significant proportion of plutonium oxide mixed with uranium oxide, requires the revision of these design studies.

7.1.2. Assumptions on primary breaks Analysis of possible primary system pipe breaks has direct implications for the analysis of core cooling in an accident situation which we have just discussed. It helps to define the requisite safety injection and containment spray characteristics. Pipe breaks are also considered in the stress analysis of many items of equipment and devices which may be required to withstand the mechanical effects of such breaks without worsening the accident conditions. Examples of such equipment would be: • the NSSS itself (vessel, internals, other piping and associated supports) • the containment and its internal structures including the reactor pit. The size of postulated breaks also has repercussions on the qualification of containment equipment required during and after the accident.

7.1.2.1. French position on this question In France, eleven possible primary pipe break locations are considered. In each case, the break is assumed to be instantaneous. One is longitudinal and the others are perpendicular to the pipe axis (guillotine breaks). A guillotine break on the cold leg at the primary pump outlet is conventionally analyzed, postulating a double-ended break: the gap between the pipe ends is assumed to have widened so that flow from both sides is unhindered. For other breaks, whipping is assumed to be restricted by devices impeding movement. This method is derived from the American licensing provisions, where the breaks were selected according to mechanical criteria and postulated in the most heavily stressed parts of the primary system. Since the introduction of the 1300 MWe nuclear units, safety demonstration has consisted in checking that break postulates considered were bounding cases for all possible primary system breaks in these plants.

96


7.1.2.2. The LBB (Leak Before Break) postulate Some countries, like the United States, Germany and the former Soviet Union have considered that, providing adequate precautions were taken in selecting materials and manufacturing processes, in the design, calculation, installation, initial inspection and in-service inspection of piping, the possibility of a major instantaneous pipe break during reactor operation could be excluded, even under stressed conditions. This is the "Leak before break" postulate, which is gradually becoming "Break preclusion". We would point out that the concept of break preclusion is applied in France to the reactor vessel, the primary pump casing, the steam generator bundle wrappers and those parts of the steam lines located between the containment and the main steam line isolation valves. This postulate is justified by special precautions regarding the selection of materials, manufacturing processes, design, sizing and layout rules and in-service inspection routines. The consequences of steam line breaks for the reactor core were nevertheless calculated to ensure that they would not be unacceptable. On the other hand, pipes may be subjected to various degradation mechanisms, such as wastage, vibrations, water hammer, fatigue due to thermal stratification or even to load drops. Owing to the difficulty of mastering such a complex range of phenomena, the break exclusion concept has not so far been adopted in France for main primary system piping. Despite progress in inservice surveillance and potential harmfulness assessments, it would be unreasonable to modify the reactor containment and engineered safeguard system detailed design, presently sized to contend with a double-ended guillotine break.

7.1.3. The importance of items of equipment for safety and safety classification The importance of each item of equipment for safety can be ascertained by two complementary paths. The first has already been touched upon. This is the importance of an item of equipment as incident or accident initiator. It is, therefore, the direct consequences of a component failure which shall determine the selection. If the list of operating conditions only includes the most serious initiating events for each category - the "bounding cases" - we shall here consider all the components likely to cause accidents or incidents of the same family.


97

It is in this way, for example, that the first tank of the Boron Recycle System was chosen to check the risks associated with release of its contents, as this tank contains, potentially, the largest amount of radioactive gas in the nuclear auxiliary building. The other tanks, of lower capacity, must not however be overlooked. The second path also resulted from study of incidents or accidents. In the course of these studies, the various systems required to limit the consequences of equipment failure of the first group became apparent. These systems and items of equipment which, of course, include the engineered safeguard systems, comprise not only piping, pumps and valves but also electrical power supplies, sensors and instrumentation and control systems. All these components are equally important, as malfunction of any one of them can impede correct operation of all the rest. Generally speaking, the importance of all support systems must be recognized. For example compressed air, required for operation of some valves and for diesel generator startup and which played a part in ensuring airlock airtightness on most of the 900 MWe unit reactor containment buildings, or the water or ventilation systems used for motor cooling. This approach has only been applied progressively. For example, the American reference for the French 900 MWe standardized plant series did not grant the same level of importance to the Component Cooling System (CCS) and the Essential Service Water System (ESW) as to the Containment Spray System (CSS). However, this latter system which ensures core cooling following a primary break is only effective if the exchangers are supplied, on the secondary side, by cooling water transported by the Component Cooling System which is itself cooled by the Essential Service Water System. The original approach can be explained by the fact that a break in the CCS and ESW Systems does not involve any 'direct radioactive release as these systems transport water which is, at least in theory, uncontaminated. Considered as initiating events, leaks from these systems have no consequences. The same can be said for the steam generator auxiliary feedwater supply system which also only carries clean water. This system is, however, a full engineered safeguard system. It is crucial in the event of a break in steam piping or normal steam generator water supply piping and also in the much more frequent event of interruption of main feedwater supply to the steam generators or loss of offsite power. Reclassification of this circuit in a more stringent category is hence confirmed, in this case too, as being necessary. All this work of analysis concludes with classification of equipment into three categories defined in the design and construction rules for mechanical equipment (RCC.M) and a category IE for electrical equipment (RCC.E).

98


The corresponding equipment is then required to comply with the following minimum requirements: • subjection to a design and construction code defining notably the methods to be used for design calculation, procurement, construction and layout • application of quality assurance procedures • performance of routine in-service tests • capability to withstand a safe shutdown earthquake • qualification for normal and accident ambient conditions and earthquake resistance. The category 1E electrical equipment shall in addition be redundant and provided with an emergency power supply. Equipment classification is the subject of a basic safety rule (RFS IV.I.a). This work was subsequently revised for application to the P'4 standardized series units and again for the N4 units, as we shall see at the end of this chapter.

7.1.4. Functional requirements and safety classification The equipment classification which we have just mentioned only represents a first level of prioritization. This is insufficient on its own. It is also necessary to specify precisely what is required of each component and hence define the required functional capacity of each individually. Clearly, following an earthquake which has been classified as a Safe Shutdown Earthquake, the installation is no longer in an operational state. Some pipes, useful in normal operation, might be bent. Pumps and valves required for electricity production might be blocked and incapable of functioning. This may obviate any hope of re-startup at a later time but must not, however, cause an accident involving unacceptable radioactive release. In particular, pipes carrying primary or secondary coolant must retain their leaktightness. For an engineered safeguard system component, however, the situation is entirely different. In compliance with accident design assumptions this component must retain its capability, even after an earthquake of this kind, of fully performing its function. It should be checked by any effective method that the pumps provide their rated flowrate, that piping allows pumped fluids to pass, that the valves can be opened and closed without any difficulty and that all sensors, electrical links and corresponding instrumentation and control systems provide the data required of them clearly and precisely.


99

This equipment, much of which is not used during normal operating conditions, must remain in normal functional state. For mechanical equipment it is necessary to differentiate firstly between equipment comprising mechanisms or parts which have to move to fulfill their function, i.e., "nonstatic" components, and other equipment which is referred to as "static". There are, therefore, three functional requirement levels: a - Integrity of the pressure barrier which applies to all the static mechanical components under pressure without consideration of requirements relative to their deformation. This level is designed to guarantee, for these items of equipment, containment of transported fluid. b - The functional capacity which applies to static equipment traversed by fluid is intended to limit equipment deformation to acceptable levels where flow reduction, for example, could not prevent performance of the safety function concerned. c - "Operability" applies to mechanical nonstatic equipment. This aims at ensuring correct operation of mechanisms or movable parts the movement of which is necessary for the carrying out of their appointed safety function. The codes defining equipment design and construction rules such as the American AMSE code or the RCC.M, define the design methods and the criteria levels to be applied to classified equipment and include four criteria levels of decreasing stringency for each category: these "criteria levels" are referred to by the letters A, B, C and D. In the special case of accident operating conditions (categories 3 and 4), it is assumed that: • application of level C and D criteria is, generally, equal to a demonstration of equipment integrity for accident operating conditions of category 3 and 4 respectively • application of level C criteria is, generally, equal to a demonstration of the functional capability of static mechanical equipment • application of level B criteria works towards the demonstration of the operability of nonstatic mechanical equipment: this demonstration must be completed by experimental checks and/or analyses. A detailed examination of safety-related equipment for 1300 MWe units was carried out jointly by Electricite de France and the safety organizations. This enabled the design load combination for this equipment and the applicable criteria levels to be established simultaneously. Following further discussions, a Basic Safety Rule has been issued concerning this data (RFS IV.2.a).


100

7.1.5. Equipment qualification under accident conditions We have just seen how the design conditions for mechanical equipment are defined with particular attention to accelerations and differential movement due to a safe shutdown earthquake. This is not, however, adequate to ensure the correct behavior of equipment immediately after an accident occurs and, possibly, for a long period afterwards. If the equipment is located within the containment, it will also be subject to several hours at a high temperature in a humidity and chemical-saturated atmosphere at a radiation level of several hundreds of kGray. As a precaution, we assume that all this occurs on an item of equipment which has already deteriorated through the effects of time, temperature, ambient radiation, and even several earthquakes lower in intensity than a Safe Shutdown Earthquake. Equipment located outside the containment will obviously not be subject to all these conditions. Two qualification programs have therefore been drawn up with a value equal to or higher than that given by the accident studies being taken for each parameter.

Fig. 7.1. Qualification program.

For equipment installed outside the reactor building: • tests introducing high stresses experienced by the equipment, e.g. 1500 startups for motors • seismic tests comprising at least five earthquakes equivalent to a Maximum Historically Possible Earthquake (MHPE) and called an Operating


101

Basis Earthquake (OBE) and at least one Safe Shutdown Earthquake (SSE)*. For equipment installed within the reactor building and which is required after an accident (Fig. 7.1.): • an initial aging comprising irradiation at 260 kGy at 70 °C • a series of seismic tests exactly as above, then a further irradiation at 600 kGy at 70 °C • chemical and thermodynamic conditions: 5.5 bar abs. and 156 °C in two thermal shocks followed by a 4-day decay period, equipment spraying with a solution containing boric acid and sodium hydroxide. These two tests simulate the accident period • maintenance of a humid atmosphere at 100 °C for 10 days to simulate one year's post accident atmosphere. The equipment being tested must continue to fulfill its function at all times during the test program. We can define a third qualification program concerning electrical equipment installed in the reactor building, required under normal operating conditions and under earthquake stresses but the availability of which is not required after a thermodynamic accident in the containment. This program comprises only: • aging with irradiation • the series of seismic tests.

7.1.6. Functional capacity of systems The study of listed operating conditions enables a number of operational points of the engineered safeguard systems to be defined, taking into account application of the single failure criterion. These isolated points are not sufficient to completely define these systems and a more detailed, more continuous study grouping together the requirements relative to the various system demands is necessary. Several examples of this process are given below. The safety injection system comprises, notably, low head injection pumps with a high flowrate but a low discharge pressure (20 bar), adapted to large breaks which were examined under the fourth category. Two other high or medium head pumps, depending on the standardized plant series, have a much lower flowrate and are adapted to third category small breaks.

These earthquakes are defined in Chapter 10.

102


A continuous spectrum analysis of the size of primary system breaks has shown that, in an intermediate situation not covered by the conventional design situations, the high pressure circuit flowrate was insufficient to offset the leak and that backpressure in the circuit prevented the low head pumps from discharging. Adaptations were therefore necessary. Similarly, if the spray system in the containment is examined, it will be seen to fulfill several major functions, none of which must be overlooked: • protection of the containment: - regarding overpressure - regarding increases in concrete temperature and thermal gradient • core cooling • containment barrier • control of chemical processes in the containment - trapping of iodine - neutralization of substances corrosive for equipment. As an example, the implications of one of these functions can be considered in detail: core cooling. This is a function of the Containment Spray System (CSS) as this system is the only one functioning after a LOCA that is equipped with heat exchangers. When the water suction phase from the reserve water for the spray systems in the containment and the safety injection phase in the core are finished, the systems switch over to suction from the sumps in the containment. The switching sequence, opening of certain valves, closing of others, must be examined in detail along with the data used to trip this sequence. Next, to make this hot water circulate over a period of months, there must be sufficient water in the reactor building sumps for the upstream pump pressure to be adequate. This depends on the quantity of water delivered by the primary system, the volume of water taken from the reserve tank, the shape of the sumps and the efficiency of the anti-vortex system. It is also important that water showering down from the top of the containment is not trapped at any points in the reactor building, particularly in the pools. For this reason the drainage systems at the bottom of these pools and the corresponding instructions must be checked. Circulation can only proceed correctly if the water does not contain too much foreign matter. The sumps are equipped with filters which must retain a sufficient quantity of impurities without clogging. Specifications shall be drawn up concerning the cleanness of the building or the quality of paint to be used, prohibiting, for example, the use of plastic sheeting. This circulation must be assured over a long period of time. All active systems, including the pumps, must consequently be adequately sized with margins regarding the minimum required flowrate and appropriate protection devices to avoid exceeding the maximum flowrate. This equipment must be qualified in all areas particularly regarding resistance to impurity laden fluids.


103

The periodic monitoring of this equipment must enable its initial good condition to be guaranteed in the event of an accident. Any devices for repair (after an accident) of the circuit conveying a highly radioactive fluid must be provided for and installed when the plant is built. This circulation is designed to make water pass through the heat exchangers to ensure that it is cooled. On the secondary side of these exchangers is the water for the Component Cooling System (CCS). The water for this system is itself cooled in other heat exchangers by raw water from the Essential Service Water System (ESW). The minimum characteristics of this entire chain must be ensured regarding flowrates and heat exchange capacity, even if the cooling water (sea or river water) is unusually warm. The overall study is, of course, presented on paper at the equipment design and construction phase, but actual tests which should be as complete as possible are also required. They generally take place at the time of unit startup. Finally the operating technical specifications and periodic tests must ensure the continuity of all required characteristics.

7.1.7. Accident or incident procedures Initially, incident or accident studies were essentially carried out, with the help of highly pessimistic codes, to check the acceptability of individual radiological consequences and the capacity of control and engineered safeguard systems alone to bring the installation to a stable condition in a relatively short period. To begin with, accident operating procedures were based on conventional accident studies, focusing on a specific initiator associated with pessimistic views of the various possible effects of a single failure. Subsequently, these procedures were totally rewritten, using realistic codes, and extended to cover much longer time periods. Systematic checking of the consistency and quality of data required for automatic and then manual control of the accident situation has been carried out. This concerns the precision, possible drift, redundance and qualification of all logic protection circuits along with required sensors. It also concerns all the data signalling methods in the control room or locally whether they be indicators or recorders, but also alarms or alarm records enabling the appropriate procedure to be identified. This was all re-examined following various French incidents but, above all, after the accident at Three Mile Island and also for the introduction of the N4 standardized series. The importance of the ergonomic aspect and, more generally, the man-machine interface has thus gradually been acknowledged.

104


We shall further discuss procedure assessment in Chapter 22.

7.1.8. Authorized limit values and operating range It has already been pointed out that the initial accident study conditions were chosen with reference to pessimistic values in order to penalize the possible consequences. To retain the bounding case character of these accident studies it is necessary that the installation be maintained at all times within the defined operating range. This will be the function of the technical operating specifications. Any infringement of established thresholds could have an unforeseen negative effect on the development or outcome of an accident. Similarly, the accident studies assume the availability of certain systems and items of equipment. The installation must be capable of coping with any unforeseen single failure at the moment of the incident or accident. The technical specifications* therefore outline for each reactor operating condition the list of equipment the availability of which is essential. It must be borne in mind that application of the single failure criterion to systems relying on only two trains enables just one unforeseen or latent but unknown failure to be dealt with. Discovery of the unavailability of an item of equipment following, for example, a periodic test, requires that, if operation is to continue, the single failure criterion be applied to the other line, since it is assumed that the entire system may be lost. This situation cannot be acceptable for any length of time. On the other hand, to impose immediate withdrawal to a fallback mode where this system is not required might engender a slight risk due to the transient operating condition which this would impose. The time periods for which operation with one channel unavailable for unforeseen reasons can be maintained have therefore been specified for each safety-related system, based on the judgement of the engineer and where necessary substantiated by the probabilistic considerations which shall be outlined in Chapter 20. It should be noted here that these considerations only apply to unavailability revealed by tests and not deliberate or programmed unavailability. The design of systems with two channels each with 100% capacity in French installations imposes, in this connection, certain constraints that three or four channel systems avoid. Operating technical specifications include, therefore, besides the limit values for safety parameters, tables specifying for each instance of unavailability of safety-related equipment, a maximum time period which can be

* See Chapter 22


105

tolerated before plant unit withdrawal to a fallback mode, which is itself specified, unless the equipment has been able to be repaired and requalified.

7.1.9. Normal and accident release and radiological conditions in the installation Definition of the various normal operating conditions, the acceptable fuel clad failure rate during operation, the number of each type of transients foreseen, the load following conditions and the type of rod cluster control assembly used enable evaluation of the quantities of water entering and exiting the primary system so as to be able to adjust accordingly the boron concentration and the quantities of radioactive products contained therein. This represents water and gas which must be treated and could subsequently entail deliberate release. This enables the treatment, storage, and waste release systems required to cope with the most penalizing foreseeable situations to be defined without exceeding the authorized release limits. If these systems are well designed, habitual release levels will be kept significantly below the authorized levels which are nonetheless stringent. Definition of the level of radiation sources directly due to fission or activation, or transported to other rooms by liquid or gas, also enables the thickness of required shielding and the level of ventilation in various facilities to be established. In this area, it is not sufficient to simply consider the various conditions connected with normal operation. It might be desirable, even necessary, to service a faulty component locally - outside the reactor building of course in accident conditions where, as the fuel has deteriorated, the primary coolant has become highly radioactive. This is, obviously, only possible if the radiation protection conditions already arranged allow it.

7.2. Checking the number of lines of defense It has already been pointed out in Chapters 4 and 7 that some accidents were not taken into account in the conventional list of operating conditions. These concern mainly the rupture of large apparatus such as the reactor vessel, the steam generator outer shell, the pressurizer or the primary pump casing. Rupture of the reactor vessel and, more simply, any major break in lower structures affecting, for instance a large number of in-core instrumen-

106


tation tubes, renders the safety injection system ineffectual. With the design of French installations, it is the water column located around the core between the vessel internals and the vessel, beneath the nozzle level, which enables gradual reflooding of the fuel after a major primary break. Any significant break undermining the efficiency of this water column will make core reflooding uncertain, with extremely serious consequences. Rupture of the reactor vessel is an unlikely event and the manufacturing and checking conditions for this apparatus are specified in such a way as to keep the likelihood of this occurrence to an extremely low level; these conditions are the subject of specific regulatory documents. The case of the in-core instrumentation tubes and their penetrations located in the lower part of the vessel is not dealt with in such a straightforward manner. Hence, the safety authorities have requested both specific precautions for design and construction of these tubes and their support structures to prevent rupture, checks on the risk of pipe whip of ruptured tubes and the consequences for neighboring sound or weakened tubes, and finally parametric studies of the consequences for the core depending on the number of broken tubes. These studies revealed that, for the safety injection system as currently defined to be impeded, five to thirteen tubes out of fifty-five would have to be broken, which seems highly unlikely (case of the 1300 MWe units). Regarding the secondary system, the steam generator outer shell and the main steam line pipe systems located between the containment and the stop valves also constitute a special case. Fast burst of the steam generator outer shell could cause rupture of a large number of steam generator tubes. In this way two major accidents are compounded: a very large secondary break in the containment and a primary break. Together these could cause a very serious situation. Once again it is due to design, construction and in-service inspection methods defined in regulatory documents concerning pressure vessels and carefully evaluated during safety analyses that the probability of this accident occurring is sufficiently low for it to be excluded from the conventional list of operating conditions. In the event of rupture of a main steam line between the containment and the corresponding stop valve, it is not possible to ensure a rapid and complete closing of this valve. As study of a fourth category accident of this kind requires application of the single failure criterion it is necessary to postulate the failure to close of another steam stop valve. There would then be rapid drainage of two steam generators out of three for 900 MWe reactors or out of four for 1300 and 1400 MWe reactors. The corresponding cold surge on the core would induce a power buildup which the concentrated boric acid injection systems associated with the safety injection systems and the


107

dropping of all rod cluster control assemblies would not be able to completely control. The reactor core, in particular, could become supercritical again. This would produce a certain fission energy which would further impede core cooling. The American license by defining a "superpipe" associated the idea with special design and checking criteria that enable ruptures of this kind to be disregarded by giving them a sufficiently low probability.

Fig. 7.2. Excluded ruptures.

Study of drainage of two steam generators was, however, requested by the French safety authorities. This study shows that, even under the worst conditions, the consequences remain fairly limited. Furthermore, special attention was focused by both operators and safety organizations on the results of periodic inspections carried out on these pipes and on the various welds connecting the lines of valves at these points. We shall come back to this aspect in Chapter 25. We have just specified those parts of the installation the failure of which has not been provided for by specific engineering safeguard systems (Fig. 7.2.). Therefore, one line of defense is missing in these areas, but this is compensated for by reinforced preventive measures. There exists moreover at least one case of multiple failure, investigated in the mid-seventies and capable of causing the simultaneous loss of two

108


lines of defense: in the event of total loss of power, which is a situation which is not provided for in the design arrangement we have just examined, a break could occur at the primary pump seals no longer cooled, whereas the safety injection system, apart from the accumulators, is inoperable owing to loss of pump powering. We shall see in Chapter 11 how and in the light of what studies it was decided to take measures to deal with such situations.

7.3. New safety demonstration requirements for the N4 series The transition from one standardized plant series to another always implies systematic re-examination of safety demonstration methods and consistency. We have already mentioned the changes introduced between the 900 MWe and 1300 MWe plant units. As the reactor design gradually evolved from almost entirely American (Westinghouse license) to become 100% French with the N4 series, this process was facilitated. The detailed re-examination of the steam generator tube rupture accident which we have just mentioned and which is fully discussed in Chapter 8, proved an important element in these decisions. The main points are: • explicit inclusion of the human intervention phase during accident situations • extended application of the single failure criterion • inclusion of earthquakes as initiating events • extension of safety classification.

7.3.1. Explicit inclusion of the human intervention phase during accident situations At the end of the previous chapter, we indicated that the initial analysis was particularly focused on checking engineered safeguard and protection system design and therefore centered attention on the first phases of the accident where these systems start up automatically. Analysis of the steam generator tube rupture accident after its reclassification as a 3rd category event revealed the need for a detailed investigation of the phase during which the operators are required to resort to manual actions. The most important systems for limitation of the radiological consequences of the accident were found not to be the safety classified engineered safeguard systems and the rapidity of operator action was found to be a


109

decisive factor with regard to the consequences. This is the case for the secondary system devices for discharge to the atmosphere. Another example is pressurizer spraying, which is indispensable for the management of primary system pressure reduction*. The operating condition design rules defined for the 1400 MWe standardized units explicitly include the human intervention phase until such time as the reactor can be maintained in a safe configuration. The accident studies only consider actions explicitly provided for in the procedures. With this approach, actions and items of equipment can be safety-prioritized, which is in fact one of the methods used for the safety classification of the equipment concerned. This naturally implies that the post-accident operating procedures comprise a means of securing a safe reactor condition using only safety classified equipment. Other equipment, which is not indispensable but may contribute to improving or facilitating reactor control, is also considered as safety related but subjected to less stringent requirements.

7.3.2. Extended application of the single failure criterion Observance of the single failure criterion is one of the characteristic elements of safety related systems. The basic safety rule concerning this criterion contains a long but limitative list of the systems to which it must be applied. As we have already seen, the primary system depressurization system and the secondary system dump to atmosphere devices are not included in this list despite the role they play in a specific accident scenario. Rather than attempting to draw up a new list, the exhaustiveness of which would not be any better demonstrated, it was decided to base the category 2, 3 and 4 accident studies for the N4 series on application of an active or passive failure to any system, component or control device affected by the transient considered and used in the safety demonstration. This is known as the "single aggravating circumstance" concept, proposed by EDF and initially accepted by the safety authorities on an experimental basis since it enhances consistency between the installations.

7.3.3. Earthquakes as initiating events We noted in Chapter 4 that loads due to large primary or secondary system breaks were conventionally assumed to be compounded by loads resulting

* See Chapter 8

110


from a safe shutdown earthquake, postulating, in addition, loss of offsite power. Moreover, safety classified equipment used in the safety demonstration shall be designed to withstand a safe shutdown earthquake. The change in approach consists in considering that any design basis incident or accident can be initiated by this earthquake and establishing a relation between this earthquake and loss of offsite power. This relation is, in fact, technically logical since the lines connecting the power plant to the transmission networks are not designed to withstand a severe earthquake. On the basis of its estimated frequency, the safe shutdown earthquake is classified in the 4th category operating conditions. The corresponding studies highlight the underlying logic of the accident analyses and enable it to be checked that provision is made for emergency powering whenever it could be required.

7.3.4. Extension of safety classification Since safety analysis involves examination in ever greater depth, two new categories of equipment have been defined concerning the P'4 type 1300 MWe plants, in an attempt to obtain closer compliance with detailed requirements. The LS category covers mechanical equipment not subjected to pressure. Introduction of the IPS-NC category (safety related, non-classified) is, on the other hand, associated with less stringent requirements, particularly concerned with operating conditions, periodic tests and maintenance for equipment already built. Such equipment is notably that required in the event of internal or external hazards (fire, flood, explosion, etc.), during unit outage. Also included are items of equipment which are useful but not indispensable for post-accident reactor control. The designation IPS-NC would appear to have come to stay, despite its obvious ambiguity. These developments continued throughout examination of the N4 series units, giving rise to the definition of two further categories. Category 2E concerns electrical systems required during the long term post-accident phase and enabling the reactor to be held in a safe configuration. Category SH concerns equipment used for a specific purpose under complementary operating conditions dealt with in Chapter 11. Items of equipment in the new categories LS and 2E are subjected to minimum requirements related to the following areas: • compliance with a design and construction code defining notably design, procurement, construction and layout methods • quality assurance procedures


111

• periodic in-service tests • safe shutdown earthquake resistance • qualification under normal and accident ambient conditions and earthquake conditions. The SH category equipment must comply with the following minimum requirements: • compliance with design, construction and qualification rules defined on a case by case basis • quality assurance procedures • periodic in-service tests. The IPS-NC equipment is only subjected to the following minimum requirements: • quality assurance procedures • in-service periodic tests.


8

A particular barrier point: the steam generator tubes

It has already been shown in Chapter 3 that the succession of three independent barriers between radioactive products derived from fuel fissions and the environment included a highly significant special case: the steam generator tubes. These tubes are clearly part of the reactor coolant pressure boundary since the core cooling water circulates within them. The third barrier, separating the reactor coolant pressure boundary from the environment is not in this case the containment. It can only consist of the enclosures protecting the secondary system, which is very large since it includes the steam header and even the turbogenerator turbines. We can however consider that, in the event of any difficulty, these circuits would be limited to the section between the steam generators and the main steam stop valves for each line. These pressurized enclosures are protected against possible overpressure by valves which vent to the outside atmosphere. The secondary lines also feature steam bypass systems venting to the atmosphere, equipped with control valves. This system is useful when the turbine or its condenser suddenly become unavailable, in which case both existing energy and afterpower can be removed by atmospheric steam release. Its control valves can also be useful at startup when the power produced is too low to start the turbine. However, in view of the volumes of steam discharged in these circumstances, the operator avoids resorting to this possibility in closed piping systems. The characteristics of 900 MWe unit secondary circuits are as follows: pressure of 70.3 bar at zero power and 56 bar at rated power. These circuits are protected against overpressure above 74 bar. For 1300 MWe units, these three figures are respectively 82.6, 71.5 and 86.5 bar. In both cases, the atmospheric steam dump valves open at a pressure one bar lower than the pressure safety relief valve opening threshold. As we know, the primary system is at 155 bar under all normal operating conditions. It is therefore only necessary for a sufficiently large break to occur on one of the steam generator tubes for a water and pressure transfer

114


to trip open the atmospheric steam dump and safety valves on the secondary loop concerned. There is, in this case, no barrier between the primary coolant and the environment (Fig. 8.1.). The steam generator tubes with a considerable surface area, greater than 10,000 square meters per unit and with very thin walls (about 1 mm) therefore comprise simultaneously the second and third barriers, in accordance with the usual description of the barriers. In fact, there are only two barriers in this case.

Fig. 8.1. Steam line atmospheric steam dump and safety valves.

The risk of complete rupture of a steam generator tube has not escaped the notice of the designers of this type of reactor and the list of operating conditions taken into account at the design stage places this event in the fourth category i.e. with an estimated frequency of occurrence below or equal to 10-4 per reactor-year.

115

8 - A particular barrier point: the steam generator tubes

Unfortunately, worldwide experience shows that the probability of such an event occurring is considerably higher than this value. Table 8.1. shows the main steam generator tube ruptures or major leaks observed on PWR's of a similar type to the French reactors. At the time of the most recent incident reported, operating experience with this type of reactor was based on about 2 500 reactor operating years. The observed probability of a major leak is consequently about 4 10-3 per unit per year. In probabilistic assessments, the value of 5 10-3 per unit per year is used for this initiator. Table 8.1. Main steam generator tube ruptures or major leaks Country USA

USA Belgium USA USA USA USA USA

Japan USA

Reactor Point Beach 1 Surry 2 Doel2 Prairie Island Ginna North Anna 1 North Anna 1 Mac Guire Mihama 2 Palo Verde

Power rating 500 MWe 800 MWe 400 MWe 500 MWe 500 MWe 940 MWe 940 MWe 1200 MWe 470 MWe 1300 MWe

Date

Maximum leak rate in m3/h

26/2/75 15/9/76 25/7/79 2/10/79 25/1/82 15/7/87 25/2/89 7/3/89 9/2/91 14/03/93

30

75 50 90 170 135 17 120

80

Although a steam generator tube fast break has never been observed in the French PWR's, the defects affecting these tubes and the impossibility to obviate the risk of loose parts would not a priori be compatible with a more favorable diagnosis.

8.1. Steam generator tube rupture without human intervention At this stage, it is worth briefly describing what happens during an accident involving complete rupture of a steam generator tube if the operators allow the installation to continue operating under automatic control. Once again, a pessimistic situation will be described, in this case for a 900 MWe unit, but the scenario would differ only slightly for a 1300 MWe. In view of the pressure differences between the primary and secondary systems, complete rupture of a steam generator tube causes the transfer of 45 kg per second of primary water into the secondary system.

116


Pressure rises rapidly in the secondary system to about 72 bar, the minimum pressure for opening the atmospheric steam dump valves. In the primary system, the pressure falls and this trips firstly reactor scram and then startup of the safety injection system when it drops below 121 bar. The corresponding signals cause turbine trip and closure of the stop valves on the steam lines. As the pressure difference has reduced, the water transfer flowrate from primary to secondary system stabilizes at 25 kg per second, i.e. 90 m 3 /h. Steam escaping to the atmosphere contains more and more water from the primary system and is hence slightly contaminated. The steam generator and then the steam line fill with water. After less than 30 minutes, the valves release water and no longer steam. This damages the valves and increases the release rate. Primary water is then progressively released into the atmosphere, along with its initial contamination. The fuel elements are correctly cooled during this phase, so that there are no clad failures. However, if the situation is allowed to continue with no human intervention, we can imagine that all the tank water used by the safety injection system would be transferred to the primary system, then to the secondary system and then to the environment. Unlike a break occurring on the primary system, the lost water is not collected in the containment sumps and is therefore not recycled. Finally, after about twenty hours, the fuel elements would be uncovered causing clad failure and direct transfer of volatile fission products to the environment, which would be a catastrophic, but fortunately highly unlikely event. It must nevertheless be emphasized that such a situation does correspond to correct operation of all automatic control and engineered safeguard systems equipping the standardized plant units. To avoid such a scenario, it would suffice that the operators intervene fairly quickly to reduce the pressure in the primary system and limit the safety injection flowrate. As soon as the pressure in the primary system is equal to or less than that corresponding to steam relief valve opening, these valves can close and there will be no further transfer of water nor release of radioactive products to the atmosphere. A detailed procedure has been drawn up and perfected. It is available in the control rooms and all operators have been specially trained in its use. Under these conditions, radioactive release should be extremely limited, which was in fact the case in the ten examples presented. This procedure restricts water transfer from the primary to the secondary system by controlling the safety injection flowrate and by reducing the primary pressure with sufficient speed. It also makes use of the steam generator blowdown system (APG) to limit the rising water level in the steam generator concerned. Its prime objective is to prevent the opening of devices venting directly to the environment. The refusal to close rate for


117

relief valves is by no means negligible, even when the equipment has been normally used. It becomes much higher when a valve designed for steam discharge is releasing water.

8.2. Complementary French studies We have mentioned steam generator tube rupture world statistics without reference to the specific French situation. If no major steam generator tube rupture has occurred in France on standardized nuclear units, many tubes have nevertheless revealed various faults which have sometimes required tube plugging. The different types of faults experienced in France are presented and analyzed in Chapter 25. Some of them could cause instantaneous, complete pipe rupture, without warning leakage beforehand. The risk of one ruptured pipe causing the rupture of one or several neighboring tubes, already in a weakened condition, is far from negligible. Parametric studies have been conducted to determine the behavior of an installation with regard to multiple ruptures in increasingly large numbers while taking into account various additional failures. It should be noted that beyond rupture of five to ten tubes, the overall kinetics only alter slightly as the rate of water transfer is limited by the relation between the safety injection flowrate and the discharge capacity of the secondary relief valves, which holds the system at a pressure of about 70 bar. Procedures have also been adapted to cover these cases. A main steam line break could also cause multiple ruptures of already weakened tubes. These scenarios have also been examined. They are equivalent for the containment to a steam line break occurring simultaneously with a small primary system break. The thermal hydraulic behavior of the reactor core and containment atmosphere will not induce conditions less favorable than the design basis conditions. It is easy to understand that to avoid this kind of accident, the periodic nondestructive test program for these tubes has a special importance, even if it is liable to slightly prolong unit outages and contribute to personnel radiation exposure. Since the radioactive release observed in the event of steam transfer to the atmosphere is directly proportional to the radioactivity of the primary coolant, the authorized activity limits for this fluid have been lowered, especially in plant units particularly affected by problems of steam generator tube weakening. Operating staff receive special training, with frequent refresher sessions, in the management of this type of accident.

118


In order to reduce the risk of steam generator tube rupture (and also avoid excessive loss of efficiency due to the plugging of more than 15% of the tubes in a steam generator), it is possible to replace all the steam generators in a unit, although this is by no means a commonplace operation. In view of the significant degradation of the Dampierre unit-1 steam generators, but also to obtain first-hand experience of such an operation carried out without undue urgency, the three stream generators of this unit were replaced in 1990. This large-scale undertaking gave rise to extensive analysis of both safety aspects (quality of major repair work on already contaminated circuits) and radiation protection implications. This test case has enabled more efficient scheduling of the same operation in other units, such as Bugey-5 in 1993, Gravelines 1 in 1994, Saint Laurent Bl in 1995*.

8.3. Dealing with the problem for the N4 series For the only PWR units where these modifications could be implemented at the design stage - the standardized N4 1400 MWe units the design of which was not definitive at the time this classification error came to light - one steam generator tube rupture has been placed in the third category of operating conditions and rupture of two tubes in the fourth category. The approach adopted to control the consequences of this kind of situation is based on analysis of the different accident phases, on thorough acquaintance with the behavior of certain equipment, further substantiated by operating feedback, and on the specific characteristics of the steam generators chosen for the N4 standardized plant units, where the secondary water volume is reduced. We have seen that the crucial element for the sequence of events considered and their consequences is the jamming of the secondary system pressure relief valves in open position. The solution then consists in finding a means of discharging the radioactive release through the atmospheric steam dump valves, which can be isolated, instead of through the pressure safety relief valves, which by definition can not. This implies that the steam dump valves must be sufficiently reliable and their operation guaranteed from the safety standpoint. So these devices must be safety classified, which is not the case in the previous standardized plants. This is not simply a formal arrangement, but the initiation of a whole process of design, sizing, procurement, manufacture, control, qualification, * Cf. Section 25.3.5..


119

assembly, periodic tests, including observance of the single failure criterion, emergency-powering, etc., more strictly organized and in general more stringent than for other equipment. This classification is essential if we are to take a system, its characteristics and its operation into account in a deterministic context, with a view to limiting the consequences of an incident or accident. On the other hand, these systems shall be systematically taken into consideration if their influence can be negative. The turbine bypass system to the atmosphere (GCT-A) in the N4 reactors consequently constitutes an additional engineered safeguard system. It is also important that all atmospheric discharge resulting from water transfer from the primary to the secondary system take place via the atmospheric steam dump valves and not the pressure relief valves. This is ensured by clearly differentiating the steam dump valve opening pressure (83 and 84 bar abs.) from that of the pressure relief valves (greater than or equal to 91 bar abs.), i.e. a minimum difference of 7 bar, whereas it was initially only 1 bar for the previous series of plants. The probability of a secondary system leak which cannot be isolated, following single or multiple steam generator tube rupture, is thereby significantly reduced. In addition, systems for the detection of even slight leaks have been optimized to enable fast diagnosis on the part of the operators, thereby limiting possible consequences. One such system notably employs the detection of nitrogen 16. This is a substance with a very short half-life (7.8 seconds) and very high disintegration energy (6.5 MeV), produced in the primary water as it circulates through the reactor core by neutron capture by oxygen 18. Its detection in secondary system water therefore signifies primary to secondary leakage. The high gamma radiation energy characterizing this disintegration enables continuous detection to be carried out through the secondary system piping walls. Some of these provisions, such as adopting different opening pressures for steam dump valves and pressure relief valves, optimization of the steam dump valves, more stringent periodic test programs, including nitrogen 16 measurement for instance, are progressively being introduced at the 900 and 1300 MWe plant units, in order to make it easier to bring such accidents under control and limit risks of significant release to the environment. However, these provisions in no way modify the safety demonstration requirements for these units.


9

Internal hazards

Under the American license, which is the basis for the 900 MWe standardized nuclear power plants, provision was made to protect installations against certain types of internal missiles (valve stems, sensor thimbles, Control Rod Drive Mechanism drive shafts) and for taking site-specific earthquakes into account in plant design. Continued analysis, both in the United States and in France, of potential hazards and faults, led to progressively extending the scope of protective measures to the field of internal and external hazards which had hitherto not been explored in depth. Reflection and study at the outset had been mainly concentrated on the reactor core in operation. This chapter shall deal with hazards generated by the installation itself, and the next, with external hazards. So the subject here is the protection of safety related systems and systems important for radioactivity containment against hazards originating in circuits or systems of the unit considered or of other units on the site. The purpose of this protection in the case of light water reactors is to maintain the three safety functions: • effecting and maintaining safe shutdown • residual power removal • radioactive product containment. Study of these phenomena has been carried forth gradually, and has at times been linked to observed accidents or incidents. It never followed the sequences adopted for design basis accidents, with the corresponding division into categories of increasing seriousness. The possible consequences of an identified hazard had always to be limited enough to be considered acceptable. The hazards considered may be mechanical, involving missile ejection, or due to fire or flood within the installation. The basic idea is to use appropriate design to prevent the creation or development of hazards, rather than letting hazardous situations occur and

122


then limiting any resulting damage. However, application of the concept of defense in depth requires each aspect to be studied in turn. Furthermore, when it proves impossible to study the consequences of a hazard on one part of the target, prudence dictates that the entire building housing it be considered. The analysis, of course, takes into account redundancies and geographical distances between equipment and systems.

9.1. Missiles from inside the containment The analysis of hazards from missiles which are liable to be released within the reactor building is essentially deterministic in nature. All items or parts of items of equipment which may be thrown or flung through space following a fault, for example under the effect of liquid pressure within them, or by the transformation of their elastic energy to kinetic energy, are considered potential missiles. Heavy items which may fall during handling are also considered. Piping elements are not considered potential missiles; conditions and consequences of piping breaks are subject to a special analysis. An anti-missile barrier placed above the vessel head, protects the control rod drive mechanisms and stops most of the missiles they may release. The following parts within the containment are considered to be potential missiles: • the air bleed plugs located at the top of the control rod drive mechanisms • the control rods and associated drive mechanisms • the mechanisms of certain valves • temperature probes • pressurizer heaters. Missile trajectory is studied and verification made that an appropriate barrier could interrupt it before any sensitive equipment was hit. Ejection of the air bleed plug of a control rod drive mechanism is studied in the same way; however, this also causes a reactivity accident which is studied under category 4 as regards its consequences on the core and the primary system. Reactor coolant pump flywheels are not considered by Electricite de France to be potential missiles, because the following precautions are taken: • flywheel design and materials make the risk of a fast break during normal operation extremely low • the speed which would cause ductile failure of the flywheel under increased stress is greater than the maximum speed reached during accidents.

9 - Internal hazards

123

However, at the request of safety organizations, periodic in-service inspection has been established to spot any incipient cracking in zones of irregular shapes, such as inside key slots, for example.

9.2. The results of piping breaks System general installation is designed to prevent a random incident or event from spreading or leading to an accident whose consequences could be greater than those due to the initial incident. Piping breaks or cracks are studied in order to determine what steps must be taken in construction to limit consequences, with two ends: • protecting the equipment of systems needed to bring the reactor to a safe state and limit the radiological consequences of an event • confining the scope of the initial accident, that is, preventing it from spreading from one leg to another, for example, or from one system to another safety-related system. Apart from the loss of the function of the system in question, which is considered in system design studies, the following results of a break or crack are taken into account: • the effect of possibly radioactive fluid flow: jet, flood, exposure and contamination • modification of local atmospheric conditions: pressure, temperature, humidity • dynamic effects of the broken pipe: whip (forming of a plastic swivel joint at the first obstacle encountered by the pipe) and effects on operability of the active elements supported by the pipe. The following measures are taken when installing systems in order to limit the results of a break on neighboring components: • geographical separation (distance) • or physical separation (concrete shells or walls) • or installation of antiwhip devices (frames, stops, fixed points, etc.). It is generally assumed in studies that: • piping containing or carrying high-energy fluid, i.e. at an operating pressure greater than 20 bar relative, or at an operating temperature greater than 100 °C, may break and whip • piping containing or carrying low or medium-energy fluid, i.e. at an operating pressure less than 20 bar relative, and at a temperature less than 100 °C, may crack, with no whip possible • pipe whip of a pipe containing or carrying high-energy fluid can break a pipe of the same type of lesser nominal diameter or crack a thinner pipe of equal or greater nominal diameter.

124


These principles were used in the drawing stage of equipment design and installation. But in-depth in situ verifications have been carried out on a 900 MWe unit and a 1300 MWe unit after construction. The few remaining problems identified by these inspections were of course corrected on all units.

9.3. Turbogenerator bursting In the Fessenheim and Bugey plants and the sites of the first standardized series, Tricastin, Gravelines, Dampierre and Le Blayais, the turbogenerator set is tangential to the nuclear island. The hazard presented to the reactor building, or other buildings containing safety-related equipment, by missiles from the bursting of the largest wheels of the turbine LP cylinder was identified at the beginning of construction of the two Fessenheim units. This hazard, not to be confused with that of a few turbine blades breaking, which is much more frequent but only affects the casing of the turbogenerator itself, was determined, on the basis of American studies of plants throughout the world, to be 10-4 per year per turbine. An accident of this type can produce missiles of varying size. For 900 MWe turbogenerators, the most forceful and hence the most dangerous such missile has been estimated to have a weight of 3.6 metric tons, beginning its trajectory at a speed of 92 m/s, giving it an energy of around 27.5 megajoules. This sort of missile would obviously be released perpendicularly, or almost, to the rotation axis and therefore could conceivably hit sensitive parts of the installation. This was in fact what happened following two turbogenerator bursting accidents in the French conventional thermal plants of Porcheville and Gennevilliers. At the Fessenheim units, walls capable of absorbing this energy were installed between the turbine hall and the rooms to be protected. These walls were then directly integrated in the design of other installations with tangential turbogenerators. Taking advantage of other modifications of the turbine hall, Electricite de France adopted radial positioning of the turbine halls for the second standardized series contract of 900 MWe plants (Cruas, Saint Laurent des Eaux, Chinon). This arrangement eliminates the hazard of the nuclear island being hit by a missile from the turbine of the same unit or its twin. Assessment of the 1300 MWe units of the Paluel plant - four independent units with radial turbogenerators - raised the problem of vulnerability of site units 3 and 4 to potential missiles from the turbogenerator sets of units 1 and 2, and vice-versa.


125

The safety organizations have examined the precautions taken by the operators to minimize risks of turbogenerator bursting by destructive overspeed failure by ductile break, or brittle fracture. These precautions involve prevention of overspeed through the use of appropriate devices, and manufacture and in-service inspection methods making it possible to identify and monitor the progress of faults before they become critical. These preventive measures, while recognized to be useful, were not considered sufficient to obviate the need for application of real ejection statistics to this equipment; these statistics were gathered from 70 000 turbine-years throughout the world and confirm a burst probability of 10-4 per year per turbine. According to these statistics, 70% of breaks occur at nominal speed and 30% at overspeed. Given the plant layout considered, these figures lead to a probability of 4.5 10-6 per unit per year of unacceptable radioactivity release due to one of the four turbogenerator sets bursting. This is significantly higher than the upper limit of 10-7 proposed by the Americans for this type of hazard and already used in France at the time (1977) for certain external hazards. The safety organizations investigated the level of pessimism of this evaluation. The following points were noted without any quantification being possible: • the statistics take all kinds of break into account, regardless of missile size and energy • missiles whose energy is less than or equal to that of one quarter-turbine released at nominal speed will be stopped by the walls of the building with no special protection being used • the most probable trajectory of the most energetic missiles is practically perpendicular to the rotation axis and therefore should not threaten safety-related buildings. These elements led to the following conclusions: • that it is possible to install four 1300 MWe units close together and parallel with no need for additional protection • that different plot plans are preferable whenever site characteristics permit. The first solution is used for cliff sites such as Paluel, Flamanville and Penly. Two other types of layout are used for flat sites: "fan" configuration for Cattenom and Golfech, and "head to head" configuration for Belleville and Chooz (Fig. 9.1.). These solutions are both satisfactory. Among the sites mentioned, only Paluel and Cattenom comprise four units. These principles were subsequently codified in a basic safety rule (RFS I.2.b).

126


Fig. 9.1. Layout of turbogenerator sets.

9.4. Protection against load dropping Mention is made in Chapter 4 of the inclusion in design basis operating conditions of rupture of a fuel element which had been dropped during handling. Handling incidents can also give rise to other hazards related to the consequences of loads being dropped on other equipment or structures. The main risk is connected with removal from the site of spent fuel, since this involves the use of extremely heavy shipping casks (1100 kN). However, there are many other sources of such risks, notably inside the reactor buildings. In most industrial installations, provisions are made to protect staff and equipment against falling loads. In a nuclear power plant, this aspect has also to be dealt with, but it is not the subject of our present discussion. We have rather to consider the risks of dispersal of radioactive products or of severe exposure which could result from handling incidents or accidents. If requirements in this respect are to be consistent with those imposed for other sources of radioactivity dispersal, specified reliability levels for hoisting equipment and complementary design precautions have to be far more stringent than those called for in a "conventional" security context.


127

9.4.1. Hazards related to spent fuel shipping casks Spent fuel transport containers themselves are required to comply with international regulations specifying that they must withstand particularly severe conditions without loss of integrity: • dropping from a height of 9 m onto a rigid structure • perforation test: dropping from a height of 1 m onto a standard punch • totally enclosing 30 minute fire test (flame temperature: 800 °C) • water immersion test: depth of 15 m for 8 hours.

Fig. 9.2. Shipping cask handling in a 900 MWe unit.

The risk of leakage of the contents of the container is consequently not a safety issue for the installation. Moreover, French power plant design restricts the areas where such handling operations may take place. These containers do not enter the reactor building. They are routed by mechanical devices and automatic control systems through the fuel building where the spent fuel storage zone is a prohibited overhead handling area (Fig. 9.2.) The crane used must be designed to withstand a safe shutdown earthquake and satisfy high reliability standards. In compliance with defense in depth requirements, its collapse must nevertheless be postulated and the

128


parts of the installation concerned must be so designed that plant safety would be unaffected by this incident. The identified risk is loss of spent fuel pool integrity entailing loss of the water it contains and hence dewatering of the fuel, its overheating and the possible release of radioactive products in the fuel building. A high radioactivity level both in the building and on and around the site would certainly result from direct exposure.

Fig. 9.3. P4 and N4 unit cask loading system.

The container is assumed to be dropped in the loading pit, vertically and slant-wise and structural provisions are made to prevent the impact on the pit from affecting the spent fuel pool. For Fessenheim, which is the oldest plant, initial design provisions were inadequate and the loading pit had to be fitted with snubbers. For the most recent plants, P'4 and N4, this risk is eliminated by the loading arrangements in the pit, where the transport container stays at ground level (Fig. 9.3.). This solution involves, on the other hand, a water outlet at the bottom of the loading pit, the safety of which had to be examined accordingly.


129

9.4.2. Other handling risks We should like to underline once more the specific risks associated with the handling of filters and resins and those which could be incurred by routine handling operations routed over safety-related piping or equipment. It is by careful attention to these aspects of safety that risks can be identified and satisfactorily dealt with.

9.5. Fire protection In this field too, traditional industrial fire protection methods were used in nuclear power plants for a long time. The potential safety problems of fire in nuclear plants and the need for a specific approach were made clear in 1975 with the very serious incident at the Browns-Ferry plant in the United States. A description of this incident is called for. The fire which broke out at the Spanish plant of Vandellos in December 1989 is discussed further on, since it gave rise to extensive internal flooding. At the Browns-Ferry (Alabama) site at the time of the accident, there were two 1100 MWe boiling water reactors (BWR) in service and a third under construction. A common control room served the two operating reactors. The fire broke out in the cable sorting room, located beneath the control room, at the point where cables passed through a wall to enter the reactor building of unit 1, which was kept in slight negative pressure. The original plug of the cable penetration had been removed to install additional connections. The work had been finished and the personnel was plugging the hole, through which 10 grouped cable runs passes together, using a candle flame to locate leaks in the provisional plug. The highly flammable material caught fire, which spread to the reactor building unbeknown to the personnel. The situation was only discovered when control and instrumentation cables of both units had been seriously damaged, causing them to short-circuit. Several systems in unit 1 were inoperable. The operating personnel were nevertheless able to stop the reactor, placing and keeping it in safe shutdown. There was no release, nor was release ever possible. This incident naturally led to a rapid examination of French plants, general reflection and gradually establishment of quasi-regulatory specifications on this subject. Current methods and principles, which cannot be considered definitive, demonstrate the need for interface between specialists in several techniques: fire protection, of course, safety analysis and radiation protection. The "Design and Construction Rules for PWR Nuclear Power Plants - Fire Protection Rules", RCC.I, defines fire protection as all measures taken to

130


prevent the risk and limit the consequences of fire. These measures have three goals: • to ensure the protection of people • to limit damage to equipment which could cause long-term unavailability • to maintain all nuclear safety functions. The first two goals are traditional fire protection goals for any installation. The methods used to reach these goals are based on the traditional approach in three fields: prevention, detection and fire-fighting. Solutions are based on deep thinking on what is known as the "fire triangle" (Fig. 9.4.), all three sides of which are necessary for a fire to occur:

Fig. 9.4. The fire triangle.

The best solution is to suppress at least one side of the triangle hence ensuring that a fire cannot occur. This entails: • reducing the quantities of combustible materials • eliminating or reducing hydrogen • limiting hot spots and energy sources such as electric sparks, welding, various heating operations. The third goal, "to maintain all nuclear safety functions" is specific to nuclear power plants. It requires the protection of all equipment whose failure could endanger the three basic safety functions. The "nuclear safety" aspect of fire protection is handled in France in the same way as all common mode hazards, based on the three following principles: • redundancy • independence • qualification.


131

The redundancy and independence of safety-related equipment trains result from the application of the singe failure criterion. These principles are therefore already taken into account in installation design. Fire resistance qualification of specific protections such as partitions, doors, ventilation and smoke removal ducts, as well as any other fire protection facilities, remains to be considered. The three basic safety functions are taken into account by a safety analysis which considers all traditional fire protection parameters (heat load, characteristics of combustible material, potential causal conditions, etc.) as well as "nuclear safety" parameters (separation of redundant equipment trains, limitation of contamination, accessibility, etc.). This analysis is generally called a "vulnerability study". The vulnerability study defines "fire safety areas" which are used to confine fires to very specific limits.

Remark on the division into fire areas Strictly speaking, from a safety point of view, two fire areas are sufficient for an entire installation, if the installation is well designed and installed. However, this would hinder fire-fighting, the difficulty of which would increase with the size of the area, not to mention the losses in equipment this could entail. To ensure a rational relationship between fire-fighting means and fire area size, the latter are defined with available fire-fighting systems in mind.

Convergence points and fire common modes Regardless of all the care that goes into the separation of redundant equipment trains and into the vulnerability study and the resulting definition of fire areas, there are inevitably certain convergence points, such as the control room, or piping sections with several different sensors, etc. These are called fire common modes. Fire common modes must be identified and subjected to a functional analysis to determine which are safety-related; the safety function of these modes must then be protected against fire. Easier said than done. First of all, operating conditions during which fire protection must be ensured have to be defined. Required safety systems must then be defined for each of these operating conditions. They are not necessarily the same for normal operation, shutdown, or long-term postaccident conditions. Then it will be decided which redundant equipment must be taken into account, including the support systems they require (compressed air or nitrogen, for example).

132


Once this equipment is determined, fire common modes will be identified, including those involving cableways, as equipment may fail due to a fault in electrical supply or control and instrumentation signals. A series of fire common mode sheets is then created, listing additional fire protection methods which have been adopted. In addition, the fire-fighting means selected must not themselves create other hazards, such as: • internal flooding • electrocution, short-circuit • asphyxiation either in normal use or inadvertent operation. Radiological characteristics of the installation must be considered when defining fire-fighting means and defining access points. In areas in the power plant where a fire outbreak seems unlikely but where its consequences would be severe, safety priority may warrant special precautions as to detection and intervention arrangements. This may of course upset established practice in this matter. Other aspects of fire protection in nuclear installations are dealt with in Chapter 30.

9.6. Internal flooding Nuclear safety hazards due to significant flooding, like those due to fire, were not foreseen at first. Traditional methods were used to protect against floods, with electrical cabinets, pumps and equipment often installed raised on small base slabs. Rooms with fluid pipes may have been fitted with drains, sumps and sump pumps, and certain floor openings surrounded by low walls and blanked with plaster. A spectacular incident in October 1980 involving the 2nd unit of the Indian Point, New York, power plant, a Westinghouse 875 MWe pressurized water reactor, attracted attention to the problem of flooding. A once-through cooling water circuit from the nearby Hudson River leaked large quantities of raw water within the containment. The reactor pit in this plant is, by far, the lowest point in the containment, and the reactor vessel bottom head is itself lower than the lowest level of the rest of the installation (Fig. 9.4.). Several faults in the containment and reactor pit sump exhaust pumps and the inattention and skepticism of operators as to sump level indicators let the leak go on and the water level rise. Four hundred cubic meters of water were allowed to accumulate.


133

The operators didn't react until one of the neutron flux measurement chambers gave an obviously abnormal signal, as part of the equipment was submerged. The plant unit was in power operation while the heat-insulated reactor vessel bottom head was submerged in water! This is obviously not a normal situation.

Fig. 9.5. Cross-sectional view of the Indian Point unit.

French plants are designed and organized very differently from the Indian Point plant. An identical accident is therefore not possible - which does not mean that flood hazards should not be evaluated.

134


Of course, separation of redundant equipment trains, if the equipment is in geographically separate rooms, considerably diminishes flood hazards. On the other hand, if separation is only designed to protect against missiles, pipe whip and fire, a water leak in these rooms greater than the discharge capacity of sump pumps may cause flooding which will reach equipment of both trains. Several such incidents have occurred in French plants, causing only equipment inoperability. An example is given in Section 26.1.2. After each incident, corrective measures based on the incident were applied to all plants of the same series. It has also been observed that water from large leaks in non-safety-related rooms can reach safety-related equipment by unexpected paths, such as the ventilation ducts located at lower floors. Appropriate corrective measures have been taken. However, an exhaustive study remains to be made. It should cover these two aspects: leaks in rooms with equipment to be protected, and all possible routes which water may take, including ventilation ducts and cableways. The fire which broke out at the Vandellos power plant in Spain in December 1989 is a good illustration of the possible consequences of a fire and its association with internal flooding problems. The fire was started by a turbogenerator set, hence in the non-nuclear part of the installation. It spread towards the instrumentation and control cables of the residual heat removal pumps. As the plant design was far from recent and no safety reassessment had been performed, cables assigned to normally redundant functions were routed side by side, with no separation. Both trains were consequently destroyed, leaving manual control as the only possibility. Apart from the water input from the fire-fighters, the fire itself had damaged a flexible coupling on the condenser cooling water piping. A very large quantity of water poured through the plant, partially submerging the residual heat removal pumps, which were also inefficiently separated. Owing to the good response of the operator, fuel degradation was prevented and thereby any radioactive release. However, in view of the extent of the damage and the vast refurbishing program which would have been necessary to guarantee a satisfactory safety level, it was decided to decommission the unit.

10

External hazards

We saw that earthquake hazards were taken into account from the beginning of large scale nuclear power plant design and that they often affected the design of safety-related equipment. However, the environment presents other hazards than earthquakes. Hazards may be of natural origin, such as earthquakes, but also wind, storms, floods, volcanic activity, meteorites, etc., or of human origin, such as aircraft crashes, explosions, fire outside the installation or the spreading of toxic gases. These hazards have varying degrees of seriousness. A complete study of the interaction of site and plant should enable determination and evaluation of the hazards the plant presents to its environment. This implies studying local meteorology including wind speed and direction, water tables and hydrogeology in general, and population distribution. These aspects will not be examined in detail here*. As for protection against internal hazards, the purpose of protection of plants against external hazards is to maintain the safety functions: • effecting and maintaining safe shutdown • residual power removal • radioactive product containment. Whenever possible, these hazards are considered probabilistically, for example, aircraft crashes, explosions and, to a degree, floods. Otherwise, deterministic criteria are used. In this chapter, we shall now look in detail at how design basis earthquake characteristics are selected. We shall then consider how to evaluate and take into account the risk of aircraft crashes, external explosions and flood. Other hazards shall be mentioned briefly.

* These aspects are analyzed in detail in the IPSN publication "Approche de la surete des sites nucleaires" by Jean Faure.

136


10.1. Determination of earthquake hazards The basic process, deterministic in character, consists in assuming that earthquakes analogous to known historical earthquakes are liable to occur again in the future with the most penalizing epicenter position postulated with regard to site consequences (in terms of MSK intensity), while remaining in line with geological and seismic data. For this purpose, capable faults and tectonic data around the site are examined, together with the relevant historical seismic data (Fig. 10.1.). The investigation, first focused on the site, must be extended geographically as far as needed, and obviously beyond national frontiers where required.

Fig. 10.1. Geographical and seismic data.

This process enables one or several Maximum Historically Probable Earthquakes (MHPE) to be determined, which are the earthquake(s) considered, on the basis of the previous analysis, liable to produce significant onsite consequences. The national land mass was thoroughly analyzed at the beginning of the eighties for the purpose of drawing up a seismic map of metropolitan France, undertaken jointly by the BRGM (Bureau of Geological and Mining Research), EDF and the CEA. The capable faults and tectonic regions could thus be determined in a systematic manner for the entire country. A compilation of historical earthquake data has been drawn up and is supplemented by the monitoring and compilation of current instrumental earthquake data (Fig. 10.2.). However, these are general data, which have to be completed and further investigated when it is decided to construct a nuclear power plant on a given site. Certain surface earth tremors which have only affected a limited

10 - External hazards

137

area could have been overlooked in the general survey and the effects of more severe earthquakes may vary significantly from one affected location to another.

Fig. 10.2. Historical and instrumental seismic data.

The MHPE is determined as follows: • historical earthquakes in the tectonic region which includes the site area, with the exception of those which can definitely be linked to a specified capable fault, are considered liable to occur beneath the site • historical earthquakes belonging to a neighboring tectonic region and not directly linked to a specified capable fault are considered liable to occur at the point within that region closest to the site • in both cases, historical earthquakes caused by a specific capable fault are considered liable to occur at the point on this fault which is nearest to the site (Fig. 10.3.).

138


For each of these MHPE's, a Safe Shutdown Earthquake (SSE) is specified, which is derived from the MHPE by a simple equation in terms of MSK intensity on the site. Earthquake intensity is the situation of the effects of the earthquake at a given point on the ground surface. For this purpose, the Medvedev Sponheuer - Karnik (MSK) 1964 version of the 12-degree scale derived from the Mercalli scale is used. Intensities are expressed in Roman numerals with no provision for decimals.

Fig. 10.3. Determination of MHPE's.

The MSK scale was designed so that a one-degree increase would correspond to a doubling of the ground motion parameters (Table 10.1.). The MSK scale, estimating surface effects, must not be confused with the RICHTER scale, measuring magnitude; the magnitude provides an estimation of the amount of energy released from the focus. The magnitude of an earthquake is derived from seismograph recordings by a logarithmic relationship.*

* For the 1935 California earthquakes, magnitude was defined as the log of the maximum wave amplitude measured in microns on the given bearings, 100 kilometers from the epicenter, by a standard seismograph (period: 0.8 second, amplification: 2 800). A magnitude of 0 corresponds to a measured amplitude of 1 micrometer.


139

In practice, the magnitudes observed since installation of the seismographs at the beginning of the century range from -\, for slight tremors recorded by highly sensitive seismographs in the vicinity of an epicenter, to around 9, which is the estimated magnitude of the major earthquake which occurred in Lisbon in 1755. However, this figure is not an upper limit and, since earthquake magnitude is derived from instrument recordings by calculation, there is nothing to prevent decimals from being used. There is no direct correspondence between the MSK scale and the RICHTER scale since, for the same focus magnitude, surface effects, i.e. intensity, depend notably on the focus depth, on the focal distance and on the nature of the ground considered. Table 10.1. The MSK Scale.

DEGREES OF THE MSK MACROSEISMIC INTENSITY SCALE I

Not noticeable

II

Scarcely noticeable

III

Slight, only partially observed

IV

Widely observed

V

Awakening

VI

Frightening

VII

Damage to buildings

VIII

Destruction of buildings

IX

General damage to buildings

X

General destruction of buildings

XI

Catastrophe

XII

Landscape changes

The use of SSE's and not MHPE's for the design of nuclear power plants enables a certain safety margin to be established. It has in fact been observed that, in certain areas, recent earthquakes were of an intensity greater than that of the SSE indicated by a survey carried out beforehand. Movement of epicenters under or closer to planned plant sites also tends to improve the bounding case characteristics of seismic activity taken into account. Under these conditions, the probability of an SSE occurring on a given site is of the order of magnitude of 10-4 to 10-5 per year. It would be even more difficult to establish a probability of occurrence value for a more severe earthquake, given our current limited knowledge in this respect.

140


An earthquake intensity does not constitute data which is directly usable for plant design purposes. A frequency spectrum of accelerations, speeds and horizontal and vertical ground movements is made to correspond to each intensity level for the site considered, notably taking into account the depth of the epicenter and equations of state derived from real recorded spectra compilations. As these spectra are extremely complex, it has been decided to use standard spectra derived from Regulatory Guide 1-60 and bounding the characteristic SSE spectra for the site. In the context of the standardization policy adopted for French nuclear units, the spectra used for design are standard and the level is checked to ensure that it adequately bounds the actual SSE spectra for the site considered. For some nuclear units located in the Paris basin, an area of particularly low seismic activity, a lower standard level has been used. Finally, conversely to the previous case, special arrangements have been made for sites with earthquake characteristics in excess of standard conditions. This might involve particularly rigid rocky soils, risk of surface waves inducing acceleration speed and motion spectra with a particularly large number of high frequencies in excess of the standard spectra, or Safe Shutdown Earthquakes higher than degree VIII on the MSK scale. The dynamic behavior of structures can be modified by placing special aseismic bearing pads between the structure and the earth. These are reinforced concrete pads underneath elastomer support pads with a high degree of horizontal flexibility and vertical stiffness. These pads can be of two types: • completely elastic pads such as those that were felt to be sufficient for the Cruas power plant for example • elastic pads equipped with slipping plates which enable more extensive movement to be neutralized and which were used for sites abroad with more demanding seismic characteristics. In both cases, the entire nuclear island must be built on a single raft to avoid the problems raised by linking several independent buildings. We shall see in Chapter 15 that this type of device has some drawbacks in the event of a very severe but highly improbable accident. Three basic safety rules deal with seismic hazards: • RFS I.2.c: Calculation of seismic motions to be considered in safety analysis. • RFS I.3.b: Seismic instrumentation. • RFS V.2.g: Seismic design for civil works.


141

Pseudo-acceleration (g)

Fig. 10.4. Response spectrum (5% damped)(Golfech).

10.2. Protection against aircraft crashes There is a great deal of difference between a flying club aircraft and a Boeing 747. In addition, there is more air traffic over some parts of the countries than over others and the most dangerous moments in flight are take-off and landing. The problem therefore cannot be handled too generally. On the other hand, aviation is highly regulated, and a very large amount of statistical information is available. We were therefore immediately tempted by an approach involving statistical evaluation of hazards, which we shall sum up here in simplified form.

10.2.1. Probability of aircraft crashes Three types of aircraft are considered (Table 10.2.). The first category is commercial aviation, with passenger, freight and postal transport planes. This category includes all aircraft weighing over 5.7 metric tons and accounts for 500 000 flights/year for metropolitan France (a flight is defined as a take-off and landing). The same number of flights cross national airspace without landing in France. The accident-per-flight frequency is about 2 10-6.

142


For military aviation, there are around 600 000 flights per year and the probability of a crash is a little over 10-5 per flight. For general aviation (aircraft weighing less than 5.7 metric tons), there are approximately 3 500 000 flights per year and a crash probability in the vicinity of 10-4 per flight, but a crash in this context is taken in a wider sense to include the relatively limited damage resulting from landing mishaps. Table 10.2. Characteristics of different categories of aviation. Commercial Aviation 1 000 000 flights / year 10-6 crash / flight 80 aerodromes

General Aviation 3 500 000 flights / year « 10-4 crash / flight 400 aerodromes

Military Aviation 600 000 flights / year 10-5 crash / flight 40 aerodromes

These values provide a basis for estimation of the mean annual probability of an aircraft crash occurring in France for an airliner, several military aircraft and several hundred light aircraft. In all three cases, crash probability may be divided into three parts: high at landing, medium during flight, small at take-off. By building plants away from approach and take-off zones, the probability is thus reduced by a factor of three. The average hazard over metropolitan France (about 500 000 km2) can therefore be expressed as a crash probability per square meter per year of: • several 10-12 per m2 per year for commercial aviation • around 10-11 per m2 for military aviation • several 10-10 per m2 for general aviation. Given that the sensitive parts of a nuclear power plant, those containing equipment needed to ensure safety functions, have a surface area of less than 20 000 m2 per unit, the annual probability of a crash on these parts is a little over 10-8 for commercial aviation, around 10-7 for military aviation and several 10-6 for general aviation. These are, in general, rather pessimistic evaluations. They take into account neither the fact that flight over plants can be legally forbidden, nor the possibility to avoid certain impact points in many accident scenarios. Using these crash probability figures, associated risks can be assessed by assuming that in the absence of special protective measures, all equipment in a building involved in a crash would be destroyed, which is also a pessimistic standpoint.


143

The basic safety rule on hazards related to aircraft crashes (RFS 1.2.a) provides the following guidelines: • the logarithmic order of magnitude of the maximum permissible probability of unacceptable radioactive release occurring at the site boundary is 10-6 per year and per plant unit for each safety function • however, in order to take into account the fact that an accident probability must be compounded by others with similar consequences, for each family of hazards, an admissible probability threshold is set at 10-7 per year and per plant unit for each safety function. In this context, commercial aviation can consequently be disregarded. Military aviation must be examined on a case by case basis. However, specific protective measures must be instituted for general aviation.

10.2.2. Protection against general aviation aircraft crashes Given the characteristics of the aircraft used and the effects of a crash on reinforced concrete structures, two types of missile are considered by EDF: • a 1 500 kg single engine propeller plane, whose 250 kg engine is considered a hard, perforating missile: the CESSNA 210, representing 80% of general aviation traffic • a twin-engine commuter plane with rear-mounted jet engines, weighing 5 700 kg and considered a soft missile causing general shaking of the building hit: the LEARJET 23, representing 20% of general aviation traffic. The impact speed considered is 100 m/s, equal to 360 km/h, which is the take-off and landing speed (Fig. 10.5.). The most important safety-related buildings, including of course the reactor building, are designed to withstand corresponding crashes without damage. Some of these buildings are only protected against perforating impact, which is the most probable. Design assumptions for structures are very strict. Depending on the standard reactor series involved, the steel reinforcements of concrete must remain elastic or undergo only very slight plastic deformation, below 0.8%. In both cases, there is a considerable margin before actual collapse of the building. Internal equipment would only be endangered by the creation of secondary missiles occurring due to building collapse. Numerous tests have been carried out to perfect and qualify the computation codes used to determine the characteristics of the reinforced concrete protection walls, in particular the laws governing perforation of reinforced concrete under the impact of a hard missile.

144


Investigation of collapse conditions, defined as steel structure deformation exceeding 10 % shows that, whatever the impact point on a 900 MWe, 1300 MWe or 1400 MWe unit containment building, the latter will withstand the impact of a Mirage 5 weighing over 13 metric tons and moving at a speed of 150 m/s. Force 106 Newtons

Fig. 10.5. Protection against aircraft crashes.

It would perhaps be useful at this point to illustrate what is actually represented by the very low probabilities used as compared with what is observed in everyday life. The diameter of the most sensitive zone in a nuclear unit, the reactor containment, is smaller than or equal to 50 meters. The area of a circle with a 25 km radius is one million times larger. A 10-7 per year probability of impact on a reactor containment therefore corresponds to an aircraft crash probability in this circle of 0.1 per year. Bearing in mind that there are in France about 20 nuclear sites comprising power reactors in operation, the 10-7 per year probability of impact on each reactor of a military aircraft is consistent with statistics showing that one or two military aircraft crash every year within less than 25 km of a French nuclear power plant.


145

We have presented, with a few details, the general method used. A site by site survey of local air traffic characteristics is carried out by EDF and presented in the preliminary safety analysis reports. This ensures that standard design provisions are adequate. The survey is, of course, examined in detail by the safety authorities. Any significant subsequent modification of the aeronautical environment would give rise to re-examination of the matter.

10.3. Industrial hazards The "site description" chapter of safety reports has always included a description of the present and projected industrial environment for several kilometers around the installation. This has not led to special constraints for plant construction. However, during examination of the application for authorization to build the Gravelines plant in 1975, it became apparent that the problem merited in-depth consideration. The Gravelines region includes a great deal of industrial activity, involving, in particular, a hydrocarbon storage area, some of whose tanks were 500 m from one of the reactors. The tanker port allowed docking of large ships at distances from 1250 m to 2000 m. As the plant is coastal, ships could run aground less than 650 m from the nuclear units. Their tanks, assumed empty, could then explode. Furthermore, study of the site and its future development revealed a large scale project of the Dunkirk harbor authorities for the construction of an LNG port which presented a potential further risk of explosion: for example, if two ships collided and at least one contained liquid gas, part of the gas could escape; the resulting cloud could drift, and, with the conjunction of unfavorable conditions, explode over the plant. It was clearly necessary to evaluate the potential consequences of such a situation for the plant and to plan special protective measures. Electricite de France then rapidly prepared a methodology for evaluating hazards due to the industrial environment, specifically centered on explosion hazards and similar in spirit to the methodology used for aircraft crashes. The criterion for taking hazards into account is probabilistic and identical to that for aircraft crashes: 10-7 per year per unit and per safety function. In addition, uncertainties are considered with prudence. This methodology led to the decision to protect safety-related buildings at the Gravelines plant against triangular 200 mbar overpressure waves lasting 300 ms, and against heat due to a nearby fire. The buildings and ventilation air inlets of the standard 900 MWe series of plants were therefore modified and reinforced. Spray rings were installed for facades liable to be exposed to the heat of fire outbreaks involving the contents of the nearest tanks. In addition, mounds of earth were placed between the reactors and the vessels.

146


Incident overpressure (hPa)

Reduced distance Fig. 10.6. Effects of explosions versus reduced distance (m/k1/3).

Conditions changed, the LNG port was not built and the project seems to have been abandoned, but the prudent approach adopted is the only way to avoid subsequent blocked situations due to incompatibility between a nuclear installation and the development of its industrial environment. The method of hazard analysis, on the other hand, was kept, perfected and systematically applied during preliminary examination of following reactors. A 50 mbar overpressure wave is taken into account for design of standard nuclear units, and it is checked that this is sufficient, taking into account stationary storage facilities as well as trains, trucks, barges and other ships, or pipelines. For information, here are some examples of overpressure: • 100 kg of TNT causes an overpressure wave of 50 mbar at 100 m • 100 metric tons of TNT causes the same overpressure at 1000 m • 1 kg of hydrocarbon is equivalent to 5 to 10 kg of TNT.


147

A 50 mbar overpressure wave causes virtually total destruction of windows and some damage to houses. Statistics lead to the following approximate probability figures for explosion of transported explosives: • several 10-9 per km per train • several 10-8 per km per barge • several 10-7 per km per road vehicle. Finally, at startup of 900 MWe plants, the behavior of openings and buildings under overpressure waves was verified. These checks showed that other design constraints of structures and equipment ensured satisfactory resistance.

10.4. Floods It is paradoxical but true that flooding of a nuclear power plant with submersion of the platform causes serious cooling problems for the reactors of the plant. No detailed damage scenario has been prepared, but one can imagine that in the absence of all precautions, submersion or mechanical destruction could destroy all external or internal electrical supplies needed to drive the cooling pumps or any other system, even turbine-operated, used for longterm cooling. Nuclear plants must therefore be protected against plausible external floods by setting platform levels sufficiently high. This level varies as a function of the type of site. In at least one case, it has varied over time. For sites with 900 MWe units, the following rule was applied (Fig. 10.7.): • for river sites, the highest of the following levels is taken: - the thousand-year flood - the conjunction of the highest known flood, or the hundred-year flood if it is greater, and the effect of failure of the largest dam located upstream • for coastal sites, a value is used which corresponds to the calculated maximum tide (coefficient 120) plus the thousand-year coastal flood • for estuary sites, the highest of the following levels is used: - the thousand-year river flood plus the coefficient 120 tide - the hundred-year flood plus the worst-case dam break upstream plus the average tide (coefficient 70) - the thousand-year coastal flood plus the coefficient 120 tide.

148


Fig. 10.7. Protection against floods.

In all cases, installations are protected from external floods by setting platforms bearing safety-related equipment at a level not less than that defined by the methods above, and by blanking water access routes located below the platform level. The probabilistic reference values of events or event combinations were applied to the rest of the installation and the probabilistic significance of the different levels was studied. For coastal sites, a coefficient 120 tide, which is a relatively brief and rare occurrence - approximately 2 hours every 17 years - is added to the thousand-year coastal flood value which, in principle, is not correlated and also doesn't last long. Were each of these events to last a full year, the cumulative probability would be around 10-4. Their short duration should mean that several decades are gained.


149

In cases where the level is equal to the addition of the hundred-year flood, which usually only lasts a few days per century, and the breaking of a dam, the annual probability of which is estimated at 10-4 - 10-5, the resulting probability level is not very different. The same is not true for sites which use the thousand-year flood to determine design. By definition, the probability of such a situation is 10-3 per year, which is clearly excessive for a phenomenon liable to have significant consequences. However, specialists believe that it is foolish to try to determine scientifically a flood level of clearly lower probability, in the absence of a reliable relevant scientific law. The deluge is not a "probabilizable" event. Therefore, the following procedure was established by those responsible for plant safety: • special precautions are taken to determine the thousand-year flood. Insofar as possible, uncertainties in the determination of flood volume, and corresponding levels, will be defined pessimistically. In particular, the thousand-year flood volume taken into account is not the average calculated value but the upper limit of the 70% confidence interval • this latter value is increased by 15%. Since there is no recognized extrapolation method for the law linking frequency and flood level, the gain achieved is not quantifiable. Safety organizations have therefore requested that means be determined to handle higher floods. This approach is formally presented in a basic safety rule (RFS 1.3.e). Since there is an emergency warning system, it is assumed that the reactor will be placed in safe shutdown before platforms are submerged. Electricite de France has designed various means of shutting off inlets to safety-related buildings These systems will also serve as additional protection for the oldest plants on the Loire, whose platform level was determined on the basis of the thousand-year flood, as the Loire has no large dams. A procedure using protected equipment only specifies all actions necessary to prevent any fuel deterioration or radioactivity release. This is known as procedure H5, to be discussed in the next chapter.

10.5. Protection against other external hazards The risk of volcanic activity in France is very low. No nuclear installation is envisaged at Puy de Dome or in its vicinity. Therefore, no special precau-

150


tions against volcanic hazards have been taken in construction of installations. For snow and wind, civil engineers use "Snow and Wind" rules, which are not nuclear-specific. The loads considered are large but, as the statistics they use are quite recent, they do not take into account probabilities as low as those usually used to design nuclear power plants. The "Snow and Wind" rules suggest however that additional safety margins should be taken by designers where this is warranted by what has to be protected. In fact, for buildings and structures containing equipment whose destruction could cause an incident or an accident, loads are usually lower than those considered for aircraft crashes or explosions, although this does not apply to the stacks or the turbine building roof. The cold spells of January 1985 and 1987 revealed certain insufficiencies in protection of French power plants against external cold. The prolonged periods of extreme cold that occurred in those years are neither very frequent nor very unusual. Such periods occur several times in a century. However, in several units located on different sites, small piping with insufficient heat lagging froze, which caused the loss of data needed for plant operation or even for proper operation of a safeguard sequence needed in case of a primary break. These incidents are discussed in Chapter 26. Special equipment layout rules are specified at the design and construction stage for the N4 standardized series of reactors, with a view to better providing against hazards related to extreme cold.

11

Complementary operating conditions

We have just seen how failures due to internal and external hazards, not studied when the PWR system was first selected, were gradually introduced into the preliminary and basic design work for these plants. We have also seen the introduction of probabilistic references to judge the acceptability of provisions made with respect to certain hazards, such as turbine missiles, aircraft crashes and explosions. These two elements were added to initial design without affecting the most sensitive and the most structured part: the study of internal accidents, using the formal method described in detail in Chapters 3 to 8.

11.1. Origins Since 1973, American safety organizations had been discussing the possibility and possible consequences of a failure of the emergency shutdown system associated with a transient (anticipated transient without scram, or ATWS). Emergency shutdown is, in any case, a redundant system, therefore answering to the single-failure criterion. The French safety authorities extended the implications as of 1975, requiring EDF to study the probability and consequences of a complete failure of safety-related systems, in constant or frequent use. The systems involved are those ensuring power supply, those ensuring heat sink availability and that of associated equipment, and those ensuring core cooling, via steam generators. In general, these functions are ensured by several redundant systems. A "safe" power supply system can consist of two relatively independent external mains, the possibility to switch to house load, two redundant diesel generators, one of the sources sufficing alone. During reactor operation, core cooling is ensured by the steam generator normal feedwater system. This system is redundant. Should this system fail or the turbine become inoperable, the reactor is shut down, and steam generators are supplied by means of the Auxiliary Feedwater System (AFW), which itself is redundant. The single failure criterion is thus consistently respected.

152


Preliminary investigations on the subject were called "beyond design basis" studies, an expression reserved for studies of very serious accidents whose probability is low. They in fact related above all to operating conditions "left beyond the scope of conventional design." To appreciate the advantage and importance of these new studies, a basic reference was needed. The safety organisms then suggested that the probabilistic references used for external hazards be used.

11.2. The position of the safety authorities In 1977 and 1978, the SCSIN defined, in two letters to Electricite de France, an overall probabilistic goal and practical applications in terms of studies to be undertaken. The main points of these two letters were as follows: • design of units including a pressurized water reactor should be such that the overall probability of the unit causing unacceptable consequences does not exceed 10-6 per year • the probabilistic approach should be used for as many events as possible • the use of a probabilistic approach does not imply demonstration of observance of the overall goal nor direct use of these methods in unit design. However, it can improve the definition of the deterministic criteria used • given the overall goal of 10-6, a value of 10-7 is used as the annual probability of occurrence of unacceptable consequences for each event family for which a probabilistic approach can be used • on the other hand, event families whose estimated frequency is clearly lower than 10-7 per year per unit shall not be taken into account • "realistic" design assumptions and methods may be used to study event families whose consideration in unit design is a result of this complementary approach • the case of simultaneous failure of redundant trains of safety-related systems should be studied in this framework. These principles call for some comments: • the overall goal is set in terms of "unacceptable consequences", which are not defined by law or regulation. These consequences must therefore be determined politically and be subject to modification. Practically speaking, each time a probabilistic approach is used for an event family, a prudent well-defined goal is set in terms of unacceptable consequences: - for aircraft crashes, loss of integrity of buildings sheltering safety-related equipment shall systematically lead to "unacceptable consequences"

11 - Complementary operating conditions

153

- for the total failure of redundant systems, the "unacceptable consequence" shall be considered to be the beginning of core uncovering, with no possibility of rewatering • the probability of 10-6 per year of unacceptable consequences is an "objective" maximum value. The applicant is not required to prove that this goal is reached* • the value of 10-7 per year is not an obligatory threshold value for an event family since there can be compensation with other families with lower probability • additional measures which may prove necessary might include procedures using systems already existing in conventional deterministic design or additional systems. One may be inclined to compare the consequences of the event families analyzed by this method with fourth category operating conditions, just as one is inclined to compare the 10-7 value with the frequency interval lower limit estimated for these conditions. However, this is an area requiring circumspection, for the operating condition table concerns initiating events, compounded by penalizing conditions such as the single failure criterion and loss of offsite power. The probability of this load combination occurring is a priori far lower than that attached to the initiating event alone. In this new approach, the probability is estimated by combining the probabilities associated with each failure involved in the scenario considered.

11.3. Complementary operating conditions The process is applied in the following manner: • the probability of the family of events considered is assessed • if the estimated probability is equal to or greater than 10-7 per year, the consequences are assessed in the context of prevailing plant conditions • if the probability - consequences pair for a family of events is in the unacceptable area, measures to improve the situation must be defined. This can be done by sufficiently reducing the probability or the consequences, or both. Increased redundancy in safety-related systems comes immediately to mind, but we have seen that the gain in failure probability diminishes rapidly when the number of trains increases, due to failures liable to affect all trains simultaneously and for the same reasons (common mode failures). However, better use of existing equipment can lead to improvements. * In this connection, refer to Chapter 19 for the results of probabilistic safety assessments as published in 1990

154


We shall now discuss some examples of how these problems have been dealt with.

11.3.1. Anticipated transient without scram (ATWS) As we have seen, American safety organizations raised in 1973 the problem of the failure of the emergency shutdown system (scram), which involves the drop of all the reactor shutdown rod cluster control (RCC) assemblies, during the frequent transients which trigger a scram. The RCC assemblies drop by gravity when their holding mechanisms are de-energized. These devices are de-energized by two series-mounted trip breakers, supplied by two independent channels. It would nonetheless appear that there is a probability of between 10-5 and 10-4 of failure of emergency shutdown for each request. Common mode failures have been observed in the United States on emergency shutdown relays and breakers. Since this is a relatively high probability, the results of a failure of emergency shutdown have been examined for all cases studied of second-category incidents calling for emergency shutdown. The most serious problems are the level of overpressure in the primary cooling system and the continued sufficient cooling of fuel rods. These studies show that if failure of emergency shutdown is the only disturbance caused by the transient, no safety limits are endangered. On the other hand, detailed study of the structure of the logic of the protection system controlling emergency shutdown revealed (in 1978) that, for certain fault localizations in the logic, there is also failure of the trip command for the turbine or the startup command for steam generator auxiliary feedwater system, which commands are generated by the same systems as emergency shutdown. In the first case, stress levels on the primary cooling system are close to the maximum acceptable limits. In the second case, these stresses may eventually exceed permissible limits, when the first transient is the loss of normal water supply to steam generators. It was therefore decided to diversify the control logics of emergency shutdown and of steam generator auxiliary feedwater startup and turbine trip, and even to diversify the sensors generating these signals as of the 1300 MWe plants, which had not yet been built at the time. Damaging cumulative faults can now only come from accidental coincidences whose overall probability is sufficiently low. The ATWS problem is therefore considered to have been solved by installation modifications. It should be noted, however, that in all cases of automatic actuation of protection or safety systems, operation teams are asked to confirm these


155

commands manually, hence using systems and equipment entirely independent of those used for the initial commands.

11.3.2. Total loss of steam generator feedwater supply During reactor operation, water supply to steam generators is ensured by the Feedwater Flow Control System, which recycles condensed steam after passage through the turbine. This system, which is indispensable for electricity production, is not safety-related. It is not unusual for this system to shut down completely. This is a second-category transient. Furthermore, the original design of 900 and 1300 MWe plants provides for each emergency shutdown of the reactor to stop this system and activate steam generator auxiliary feedwater supply provided by a safety-related system. The steam generator auxiliary feedwater system is driven by two motordriven pumps and one turbine-driven pump in the 900 MWe units, two motordriven pumps and two turbine-driven pumps in the 1300 and 1400 MWe units. The probability of total failure of both systems is of several 10-5 per year, which justifies study of the consequences. Normal steam generator water supply regulation was modified to reduce the frequency of use of the auxiliary feedwater system, but the overall gain was still not sufficient.

11.3.2.1. "Natural" accident scenario As is generally the case in the present paper, the scenario below corresponds to an accumulation of penalizing assumptions. The most unfavorable initial condition is also the most frequent: the reactor is operating at nominal power, and the loss of normal water supply to the steam generators causes emergency shutdown of the reactor and gives the auxiliary feedwater system startup command after 16 seconds. It is postulated that the auxiliary system fails to start. As long as the steam generators contain secondary water, they remove almost all the residual power of the core. But this level drops and the generators dry out after fifteen minutes. As soon as there is no more secondary water in the steam generators, water in the primary cooling system heats up rapidly and expands. As the primary cooling system pressure rises, the pressurizer fills up. The pressurizer relief valves open, but the pressure rise in the primary cooling circuit does not stop right away.

156


This pressure stabilizes around 165 bar with the relief valves open. Water from the primary cooling system gradually drains into the containment and core meltdown is inevitable, because no signal started up safety injection, which is normally tripped by low pressure in the primary cooling system.

11.3.2.2. Operator intervention In order to prevent core meltdown, its residual power must be removed; for this, the pressurizer relief valves must be opened without fail, but the water which has leaked from the primary cooling system must be replaced by voluntary safety injection startup. Finally, for safety injection to be effective, it must be started before pressure in the primary cooling system is greater than the discharge pressure of the safety injection. In this case, the core is cooled by water from a once-through system, coming from the safety injection and pouring into the containment (known as "feed and bleed" cooling of the primary system). This involves a sort of chase between the increase in primary pressure and the voluntary opening of the greatest possible number of relief vents, along with safety injection. Operators must therefore act very quickly. If they intervene within fifteen minutes, the core is saved and there is no clad failure. If they intervene within forty-five minutes, the core is generally preserved but there are an increasing number of clad failures. If they intervene after forty-five minutes, their action will have no effect and core meltdown is inevitable. There are ways to identify this accident. They include in particular various secondary cooling water level indicators in the steam generators. These devices have been improved. But deliberately creating a primary break, thereby contaminating the reactor building, is not an easy decision for an operating team to take. This is confirmed by observation of the behavior of operators faced with this type of situation during simulator training. The detailed study of this accident led to an operating procedure enabling core meltdown to be avoided. Some technical measures have been taken to reduce the probability of this accident and to help operator diagnosis.


157

11.3.3. Total loss of power There are many ways to supply the power needed for safety functions in French nuclear power plants (Fig. 11.1.): • two relatively independent external supplies from the national grid • house load operation, wherein the unit is separated from external power supplies and only operates to supply its auxiliaries • two internal supplies, each comprising a diesel-powered generator set.

Fig. 11.1. 900 MWe plant power supplies.

Any one of these sources can supply all power needed for safety purposes. This power is distributed to equipment which needs it by means of two electrical switchboards, each with its own line. Each diesel generator is allocated to one of the switchboards.

158


Total failure of power supply to safety-related equipment may be caused by simultaneous failure of either all power supplies or both electrical switchboards. The total probability of this is of a few 10-5 per year, due in almost equal proportions to failure of supplies or of switchboards. It is therefore necessary to study the consequences.

11.3.3.1. "Natural" accident scenario The loss of both power supply lines causes: • control rods to drop • all motor-driven pumps to stop • all motorized valves to become immobilized, some in safe configurations • "loss" of compressed air, at least after depressurization of the buffer tanks on certain circuits • depletion of batteries and, after an hour, "loss" of all indications and control in the control room. The fact that the reactor stops due to the control rods dropping is a good thing. Shutdown of reactor coolant pumps fitted with adapted flywheels is provided for in case of emergency shutdown and ensures transition of the coolant to natural circulation. Removal of residual power can be ensured by means of steam generators supplied by the turbine-driven auxiliary feedwater pump(s), with steam discharged to the atmosphere. On the other hand, the hydrodynamic seals of reactor coolant pumps will rapidly suffer the consequences of shutdown of chemical and volume control system pumps, which inject water at very high pressure into these seals, and shutdown of the component cooling system, which supplies cold water to the thermal barrier which helps protect them. The result is a significant risk that these seals will become damaged and a primary break occur. But the safety injection system is not operative, except for the accumulator tanks, nor is containment spraying. In a few hours, therefore, a very serious accident could occur.

11.3.3.2. Corrective measures It was decided to make certain modifications to installations and equipment (Fig. 11.2.), and the corresponding operating procedures were added (H3):


159

• use of the primary system motor-driven test pump*, which has a low flowrate, to regain, after two minutes, injection to the reactor coolant pump seals. This pump is supplied by a small emergency turbogenerator (LLS), installed on each 1300 MWe and 1400 MWe unit and driven by steam from the steam generators (each pair of 900 MWe units is equipped with a test pump and an LLS); • maintenance of a minimum of control and instrumentation functions, allowing control of the pressure and temperature of primary and secondary cooling systems, control of primary system refill and speed control of the turbine-driven pump(s) for auxiliary supply of the steam generator and the atmospheric steam relief valves. The small turbogenerator also supplies the current needed. If water from the primary cooling system is not being discharged, the pressurizer fills up due to the water injection to the reactor coolant pump seals. The necessary space is created by using the steam generators to cool the primary coolant, thereby causing it to contract (at the beginning of this scenario at rated power, primary cooling water, at average temperature 286 °C, has a relative density of approximately 0.7; it should therefore be possible to gain around 100 m3). The first studies show that it would be possible to keep the fuel in a satisfactory condition for 20 hours under these conditions It proved possible to extend this period even more by optimizing procedures and re-supplying the steam generator auxiliary feedwater tank. It should be pointed out that this procedure and the associated equipment make it possible to completely avoid damage to the fuel and significant radioactive release. These periods are now sufficient to re-establish power supply in the following ways: • external power supply by - a unit in house load operation on the same site - a neighboring site - a nearby hydraulic generator set • startup of the site gas turbine or emergency diesel generator provided to supplement the power supply possibilities of each site to improve availability • connection of the backed-up electrical switchboards to the diesel generator of a neighboring unit. • bypassing the inoperable electrical switchboards by means of the connection harnesses used during routine testing.

* The test pump is used to pressurize the primary system for the regulatory startup and periodic tests via the reactor coolant pump seal injection lines.

160


Fig. 11.2. Remedying total loss of power situations.

All units in service are now equipped with these systems and the problems of reliability of the additional equipment are gradually being solved.

11.3.4. List of complementary procedures We have just seen in detail three accident situations where probabilistic studies led to the definition of additional provisions. These are not the only ones. We shall only discuss the remaining ones quickly, after giving the list of those accompanied by operating procedures: • HI: Loss of the heat sink or systems ensuring heat transfer to it. • H2: Total loss of water supply to steam generators. • H3: Total loss of power. • H4: Loss of the safety injection system or the containment spray system, during the long-term period following a LOGA type accident. • H5: Protection of certain river sites against floods higher than the thousand-year flood.


161

Total loss of the heat sink Available site water reserves, and the procedures used to re-supply the steam generator auxiliary feedwater tank, ensure sufficient time to restore the heat sink, or actuate the systems ensuring heat transfer to it, when the primary cooling system is pressurized. The procedures indicate what to do in various situations, whether the reactor be power operating or shut down.

Total loss of the safety injection system or the containment spray system The accident which occurred at the Three Mile Island reactor confirmed the need and also the difficulty of keeping active for months systems rendered inaccessible for maintenance or repair by the radioactivity of the fluid they contain. Probabilistic checks confirmed that the probability of pumping system failure over a period of several months could not be overlooked. The systems concerned each have two pumps, one of which is quickly sufficient. These four pumps have similar characteristics. The installation of connections between the two systems ensure mutual back-up. These connections must, of course, be fitted in advance on systems not yet contaminated. In extension of procedure H4, procedure U3 concerns total failure of all pumps. It mainly consists in prefitted connections accessible after a LOCA, enabling use of a pumping system and, if required, a heat exchanger, which are not routine plant equipment but can be brought to the site in case of emergency. These devices, together with associated radiation protection provisions, are designed to enable intervention, for example, two weeks after the occurrence of a major primary break. The problem of protection of river sites has already been discussed in Section 10.4. Like the I procedures (for Incident) and A procedures (for Accident), derived from the event-oriented deterministic approach, the goal of the H procedures is to prevent or limit damage to fuel. It is important to bear in mind that, given the manner in which the scenarios and corresponding probabilities are determined, the first three H procedures cover events which are far more likely to occur than major primary or secondary system breaks for example, even if attention were drawn to them at a later date.

162


The H procedures, by organizing in advance optimal use of all equipment provided in the deterministic context or of relatively little additional equipment, make it possible to prevent clad failures in the situations concerned, thereby supporting the first and third levels of defense in depth. Unfortunately, the letter H used for the designation of these procedures refers to the French expression "hors dimensionnement", meaning "beyond design basis". These terms are reminders of the minor cultural revolution that consisted in using probabilistic methods to select and handle relatively probable operating conditions which are not among the usual deterministic operating conditions. These two expressions are still sometimes used to refer to "complementary" conditions, giving the impression that the latter are less probable than those corresponding to A procedures, which is not the case. This difficulty will disappear once the state-oriented approach presented in Chapter 14 has replaced the event-based procedures.

12

Probabilistic assessment of an accident sequence

As a supplement to the previous chapter, we shall now consider a total loss of power scenario and show the actual steps involved in the probabilistic assessment of a new accident sequence. The scenario selected is that described in Section 11.3.3, where it was presented from a deterministic standpoint focused on the risk of reactor coolant pump seal leakage, which was the new element. We shall now systematically postulate the failure of the various components and systems successively involved and examine the consequences of these failures with the associated time lapses. This survey was carried out at the beginning of the eighties and was used to validate the complementary provisions adopted at that time. The descriptions and numerical values used concern 900 MWe PWR units. We shall then show how these studies were reviewed in the light of our new knowledge. The probabilistic analysis methods and principles involved are discussed in more detail in Chapter 19.

12.1. Effects of failures and initial assumptions Total failure of the power supply is defined here as a simultaneous loss of power on both 6.6 kV switchboards supplying safety-related equipment. A priori, it causes rod drop but it is considered that non-compliance of more than two rods would quickly result in core meltdown, owing to the loss of normal cooling systems (reactor coolant pumps) and of the safety injection system, which are no longer energized. The steam generator auxiliary feedwater supply, using the turbine-driven pumps, suffices to remove the residual power, with atmospheric dump-

164


ing of the secondary steam produced. On the other hand, failure of this cooling mode would result in core meltdown after 1 hour if the reactor had been shut down for less than 10 hours. The batteries supplying the control and instrumentation system have a reserve time of 1 hour. Since control of the installation has become impossible, it is considered that core meltdown will take place 1 hour later. The failure of the chemical and volume control system renders unavailable the injection to the reactor coolant pump seals. The failure of the intermediate cooling system causes shutdown of the cold water supply to the pump thermal barriers. The gradual loss of the reactor coolant pump seals and the loss of primary fluid thereby incurred would lead to core meltdown in 3 hours. The provision of an emergency turbogenerator set and its correct operation enable re-energization of the batteries and resumption of the injection to the reactor coolant pump seals by means of the pressure test pump, thereby eliminating these failure paths. Malfunction of this turbogenerator, on the other hand, would bring us back to the previous situation, where failure of the control and instrumentation system would be the first cause of core meltdown, 1 hour before the same consequences would be incurred by the reactor coolant pump seal leakage. The probability of total power loss decreases with the duration of the event. It is feasible to consider that offsite power could be recovered before core meltdown had taken place, in which case the latter would be prevented. However, no allowances are made for the recovery of failed internal equipment since high speed repair work would be extremely difficult to carry out. Many uncertainties subsist regarding physical phenomena, notably the behavior of the reactor coolant pump seals or of the installation deprived of control and instrumentation. Assumptions consequently had to be made, based on the recommendations of experts in the field, pending complementary studies or tests which would allow a more accurate appraisal of what could happen in these circumstances.

12.2. Chronological list of the elements forming the scenario Considering only the first three hours of the accident and using a one hour time unit, we obtain the following list of events: • at 0 hour: - total loss of 6.6 kV power for any length of time Ei - reactor trip AU

12 - Probabilistic assessment of an accident sequence

• from 0 to 1 hour: - failure of auxiliary feedwater system turbine-driven pump - failure of emergency turbogenerator LLS - failure of test pump - recovery of a power source: • from 1 to 2 hours: - failure of auxiliary feedwater system turbine-driven pump - failure of emergency turbogenerator LLS - failure of test pump - recovery of a power source • from 2 to 3 hours: - failure of auxiliary feedwater system turbine-driven pump - failure of emergency turbogenerator LLS - failure of test pump - recovery of a power source

165

ASG 1 LLS 1 PT 1 Rl ASG 2 LLS 2 PT 2 R2 ASG 3 LLS 3 PT 3 R3

12.3. Required data The data base required to estimate the values corresponding to the failure probabilities or the possibilities of recovery can be directly grounded on observed reliability data for the equipment concerned or result from a calculation using failure trees, or even Markov charts in cases where recovery of a complex system is being considered. The values presented in this section are those used in the initial survey. For the equipment concerned, they derive from general data rather than operating feedback, which had only recently been organized at that time. The probability of 6.6 kV source failure depends on the time period considered: Period exceeding

Annual probability

0 hour 1 hour 2 hours 3 hours 10 hours 100 hours

5.63 10-5 3.78 10-5 2.93 10-5 2.40 10-5 8.32 10-6 6.04 10-7

Refusal of more than two rods to drop: 1.3 10-5.

166


Failure of the auxiliary feedwater system turbine-driven pump: • at startup * = 4.0 10-3 per demand • during operation = 5.9 10-4 per hour Failure of the emergency turbogenerator LLS: • at startup = 1.3 10-3 per demand • during operation = 2.2 10-4 per hour Failure of the test pump: • at startup = 5.2 10-3 per demand • during operation = 2.0 10-4 per hour The event failure probability can then be determined:

12.4. Assessment results The formula giving the annual core meltdown probability is as follows:

It is to be noted that the (1 - Pi) terms are very close to 1. For a manual calculation, they can be disregarded. Considering the probability of the initiator, total loss of power and failure to recover a power source, the annual probability of core meltdown is due to the following system or equipment failures, listed in the order of the formula, assuming each time that the previous action has been successful: • emergency shutdown 7.3 10-10 • auxiliary feedwater system turbine-driven pump 1.73 10-7 • emergency turbogenerator 4.39 10-8 • test pump 1.29 10-7 • failure of the auxiliary feedwater system between 1 and 2 hours 1.41 10-8 • These parameters are defined in Section 19.3.3

12 - Probabilistic assessment of an accident sequence -7 This gives a core meltdown probability of 3.61 10-7 (Fig. 12.1.).

Fig. 12.1. Fault tree. Total loss of power.

Fig. 12.2. Fault tree without an emergency turbogenerator.

167

168


The absence of an emergency turbogenerator simplifies the formula, since the probability of failure of this equipment to operate (P LLS ) is equal to 1. The third term is increased and the last two are equal to zero. The annual probability of core meltdown will then be 2.95 10-5 (Fig. 12.2.). This means that the emergency turbogenerator in the sequence considered represents an improvement by a factor of 80. It is on these grounds that it was decided to equip all 900 MWe units with such a system.

12.5. Revision of scenarios and their probabilities In the framework of the probabilistic safety assessments, the first results of which were published in 1990 and which will be presented in Chapter 19, the total power loss studies were reassessed. The new elements which occurred in the mean time were as follows: • more exhaustive research into failure initiators • handling of reactor shutdown states and technical operating specifications • use of failure rates observed on equipment • better insight into the physical phenomenon pertaining to the reactor coolant pump seals, more accurate assessment of the consequences of control and instrumentation system failure • use of data processing media compatible with more complex requirements. Three families of initiators were systematically processed. These include : • total failure of all power sources (main power line, house load feed, auxiliary line, both diesel generators) • simultaneous failure of both 6.6 kV switchboards (LHA and LHB) • failure of train A (LHA) switchboard compounded by failure of train B diesel generator set. The annual probability of total loss of power, with the unit power operating, is then 1.03 10-4, which is twice the previous value. Power source failure is not always instantaneous. When it occurs gradually, the plant unit may have been placed in hot shutdown. The residual power has then to be removed, but this will have considerably decreased during the few hours which have elapsed, as is shown in Table 3.2. In these circumstances, if the auxiliary feedwater system turbine-driven pump fails to operate, core meltdown will only occur after between 5 and 10 hours.

72 - Probabilistic assessment of an accident sequence

169

On the other hand, certain shutdown conditions, where the primary system is not water-filled, are highly sensitive, since thermal inertia is extremely low and the courses of action open are very limited. In the light of reliability data derived from French plant operating feedback up to the end of 1987, attention was drawn to the number of failures observed on the auxiliary feedwater system turbine-driven pumps and to the difficulties encountered in adapting the emergency turbogenerator sets to the 900 MWe units. The reliability values then adopted were : • failure of the auxiliary feedwater system turbine-driven pump: - at startup = 1.02 10-2 per demand - during operation = 3.2 10-3 per hour • failure of the LLS turbogenerator: - at startup = 1.2 10-2 per demand - during operation = 3.2 10-3 per hour These values are between 2.5 and 16 times higher than the previous ones, since the LLS turbogenerator real performances were as yet not very satisfactory at that time. On the other hand, complementary studies undertaken on two phenomena which had not hitherto been fully investigated resulted in more favorable conclusions. The effect of failure of the control and instrumentation system was reassessed, taking into account existing procedures and operator training. It is no longer considered that a failure of this nature on its own could give rise to core meltdown. The corresponding sequence was eliminated. Reactor coolant pump seal behavior has been the subject of both theoretical and experimental studies. Tests revealed no leaks in excess of 5 t/h per pump. Calculations evidenced that, if there were no damage other than seal rupture, the primary system maximum leak rate would be 60 t/h. On this basis, we adopted a probability of 0.5 for a leak rate of 5 t/h, a probability of 0.2 for a leak rate of 60 t/h and a probability of 0.3 for an intermediate rate of 30 t/h. Of course, this distribution has to be handled with caution. The time periods then available before core meltdown takes place will be 7 hours for the largest leak, 12 hours for the intermediate leak rate and 48 hours if the leak is only 5 t/h per pump. Under these conditions, the calculated annual probability of core meltdown being able to occur in a power operating unit is 3.16 10-7, 92% of which relates to failure of the auxiliary feedwater system turbine-driven pump. But the total annual probability of core meltdown due to total loss of power is 7.66 10-7, considering all reactor states.

170


If we consider only the sequence initiated by loss of all power sources, the benefit of the LLS system is far less significant and main efforts have to be focused on improvement of the single auxiliary feedwater system turbine-driven pump equipping the 900 MWe units. This has been done and will be further discussed in Chapter 23. The 1300 MWe units, which are equipped with two of these pumps, are obviously less sensitive to their failures. Conclusions are less clear cut if we consider the simultaneous failure of two switchboards. The probability of recovering these switchboards within two or three hours is slight, so that the impact of LLS system failure on the overall probability of core meltdown calculated for this sequence becomes more significant. This example confirms that decisions regarding supplementary provisions, which always involve lengthy implementation, have to be made rapidly, even if it has subsequently to be shown that other adjustments are also necessary. The time lapse between identification of a complex problem and its complete solution is from 5 to 10 years. The overall probabilistic safety studies will be presented after the chapters on analysis of the Three Mile Island accident and its impact on safety thinking, since otherwise certain provisions and procedures used in these studies would be difficult to understand. Both the calculations presented give calculated core meltdown annual probability values well in excess of 10-7. But these results were nevertheless considered acceptable, which only goes to show that the 10-7 value must not be considered as an acceptability criterion, in the strict meaning of the term. We shall also see that this sequence contributes relatively little to the overall result given by the probabilistic safety study for the 900 MWe units. The improvements made are consequently adequate.

13

The accident at Three Mile Island

The accident which took place on March 28, 1979, at unit 2 of the American nuclear power plant at Three Mile Island received a great deal of attention throughout the world. In the world of nuclear technology, it resulted in considerable analysis, remarkable international exchanges and an overall reexamination of approaches to nuclear safety in theory and practice. Before going on to the lessons learned from the accident, let us discuss what happened.

13.1. The accident The Three Mile Island nuclear power plant is located on the Susquehanna River in Pennsylvania, USA, 16 km from the state capital, Harrisburg, with a population of 90 000. It has two 900 MWe units with pressurized water reactors designed by Babcock and Wilcox. The second unit of the site started commercial operation on December 30, 1978. The Babcock and Wilcox design, differs from the Westinghouse design used in France in that it has different steam generators. Babcock and Wilcox steam generators are of the once-through type, as compared with the Westinghouse U-tube type. These steam generators, of which there were two at the Three Mile Island plant, are much longer, which modifies the relative layout of surrounding equipment but also makes the transition to natural convection cooling conditions more difficult on the primary side. Furthermore, they only contain a small amount of secondary cooling water, making the installation rather sensitive during certain kinds of transient (Fig. 13.1). The accident starts at 4:00 a.m. on Wednesday March 28 with an unexceptional operating incident: loss of normal water supply to the steam generators. Due to the low thermal inertia of the steam generators, the increase in temperature, hence in pressure, in the primary cooling system due to this

172


transient, systematically leads to opening of the pressurizer relief valve, thus limiting the pressure spike. This is not a satisfactory design feature. The secondary transient trips the turbine and gives the command for the steam generator auxiliary feedwater pumps to start. The primary transient causes emergency shutdown, which gradually lowers pressure in the primary cooling system. After 12 seconds the relief valve receives normally the command to close.

Fig. 13. 1. Main layout of Three Mile Island NSSS

13 - The accident at Three Mile Island

173

This first phase went through normally on March 28, 1979. All automatic controls worked perfectly, as they did throughout the accident. At this point two equipment failures occurred: • the relief valve, having received the command to close, remains jammed open. The primary cooling system continues to discharge into the pressurizer relief tank, located in the containment, at a flowrate of 60 metric tons per hour (there are approximately 200 metric tons of primary coolant). • the steam generator auxiliary feedwater system pumps start up normally after 30 seconds, but the water cannot reach the steam generators because the connecting valves between the pumps and the steam generators are closed instead of open, due to a maintenance error. The generators dry out in 2 to 3 minutes, stopping all cooling of the primary system. Although the position indicator for these valves located in the control room signal this fault, eight minutes pass before the operators identify the fault and give the command manually to open the valves. Twenty-five minutes pass before the situation of the secondary cooling system stabilizes, after numerous operations, no doubt commanding all the attention of the operating team. During this time, discharge through the pressurizer relief valve continues. After two minutes, pressure in the primary cooling system has decreased to approximately 110 bar. The safety injection system starts up automatically and sends cold water into the primary system. The operators check the indicator of the relief valve and see "valve closed", which in fact is not true. This is the crucial point of the accident: the indicator transmits the command received by the valve, and not its actual position, to the control room. Finally, the operator concentrates on the water level in the pressurizer. In all primary system transient situations, the operator must respect a regulatory operating instruction: "Do not lose the pressurizer steam bubble". When the water level rises to the top of the pressurizer, the operator no longer has the steam blanket needed to regulate pressure; the primary system is entirely filled with liquid phase water and all transients result in sharp pressure variations which stress the reactor coolant pressure boundary. But the water level in the pressurizer, after lowering at first when the valve was opened, then started to rise rapidly, between the first and approximately the sixth minute. This rise is perfectly normal when there is an opening in the upper part of the pressurizer, but the operators in this plant ignored this fact and had not been trained for this type of situation. In any case, faced with this rapid rise in the pressurizer water level, the operators, believing the relief valve to be closed, are afraid to inject too much water into the system, and therefore stop safety injection manually after less than five minutes.

174


The operators' mental image of the situation was false, but the actions they decided to perform were obviously based on this image. As of this moment, the water draining from the primary system is not replaced. There is a break in the primary coolant system and the safety injection system is shut down completely. The primary system continues to drain. After 6 minutes, boiling starts. The primary coolant circulating pumps continue to work, circulating a mixture of water and steam comprising more and more steam; however, they manage a certain amount of cooling thanks to the steam generators supplied by the secondary system. The rest of the energy is removed through the primary system break. After fifteen minutes, the pressurizer relief tank rupture disk gives way. The escaping primary coolant now goes directly into the containment. The pressurizer is filled with a mixture of water and steam. Its level indication is meaningless. The proportion of steam in the primary coolant increases. The primary pumps have more and more trouble, and start to cavitate and vibrate. These vibrations become excessive. The operators stop one pump after 1 hour 13 minutes, and the other 27 minutes later, hoping that natural circulation will set up in the primary system. In fact, water and steam separate, with steam accumulating in the top and water in the bottom. There is no longer any circulation of primary fluid and therefore no heat exchange takes place between the reactor core giving off residual heat of a few tens of MW and the steam generators. The heat from the core continues to bring the cooling water to the boil. No more water is being supplied, and the level in the core drops: the core is uncovered. Cooling of the fuel becomes less effective; cladding temperature rapidly increases to 850 °C, then past 1300 °C. At these temperatures, zirconium reacts chemically with steam to form zirconium oxide and hydrogen. This reaction produces heat, increasing temperatures yet more. Fuel cladding melting point is reached, and there is significant release of fuel fission products to the primary coolant and from there to the containment. After 2 hours 14 minutes, a radioactivity alarm goes off in the containment. The operators are forced to realize the gravity of the situation. Realizing that they may well have transferred radioactivity through the relief valve, which had a high leak rate before the accident, they close the line isolating valve and thereby stop discharge. This also stops all heat removal. The core continues to heat, and primary system pressure increases. The operators start up one of the primary pumps, which sends water cooled in the steam generator onto the extremely hot fuel, which disperses those parts of the fuel above the water level within the reactor vessel.


175

After 3 hours 12 minutes, vaporization of water on the fuel has caused primary system pressure to rise to a dangerous point. The operators re-open the relief line isolating valve, drainage starts up again, letting out coolant which is even more radioactive. More radioactivity alarms go off, some of which are outside the reactor building. The water which is spilling into the containment is taken up by automatic sump pumps, which send the contaminated water to storage tanks located in an auxiliary building which is not hermetic. These tanks then overflow and create a source of radioactive steam which can escape outside the plant (Fig. 13.2.).

Fig. 13.2. Radioactive material release paths.

A state of emergency is finally declared. The containment is isolated, stopping transfer from the sump to the auxiliary building. It is now three hours and twenty minutes since the accident began. The operators start the safety injection system again at a low flowrate, causing a new shock between the cold water and the hot fuel, then at nominal flowrate. The core cools, four hours after the first event. It will take another twelve hours to discharge from the primary cooling system most of the hydrogen and incondensable fission gases which prevent it from being filled. This is done by alternately opening and closing the pressurizer relief line and starting up safety injection and primary pumps. A localized explosion of about 320 kg of hydrogen in the containment, after 9 hours 50 minutes, induces a 2 bar pressure spike in the reactor building, without causing any particular damage.

176


It is 8:00 p.m. on Wednesday, March 28, 1979. The accident itself is over. However, it will take several days more to calm fears of a possible hydrogen explosion in the reactor vessel.

Fig. 13.3. Core final status.

The damage to the fuel elements far exceeds that provided for in the worst possible design basis accident, which is the loss of primary coolant through a large double-ended guillotine break. Six years later, in 1985, when it was possible to pass a television camera between the lower internal core structures and the vessel, it was found that 45% of the fuel had melted, along with elements of the cladding and the structures totalling 62 metric tons and forming what is called corium. About 20 metric tons of this corium, formed from the upper part of the fuel, had forced its way through an outer ring fuel assembly and the reactor core external baffles to reach the vessel bottom head itself, but fortunately did not melt through it.


177

In spite of this catastrophic fuel situation and the significant transfer of radioactivity to the containment, the immediate radiological consequences in the surrounding area were minimal. Indeed, the containment fulfilled its role almost perfectly. Only the sump transfer pumps were responsible for radioactive release for a limited period. This release, estimated at 13 million curies of xenon and about 10 curies of iodine (i.e. 5 105 and 0.4 TBq), had only very limited consequences. It is estimated that an individual downwind at the edge of the site throughout the accident would have received a dose of less than 1 mSv, equivalent to the annual dose of natural radiation. The operating personnel received a slightly higher, but still quite limited dose during the accident, and had to wear masks for a few hours Three technicians received doses between 30 and 40 mSv during primary coolant sample-taking operations. The collective dose received by the plant workers from the onset of the accident to the end of fuel removal in 1989 is estimated at 60 man-Sv. There were no injuries or deaths.

13.2. Causes of the accident The data needed to analyze the causes and consequences of this accident were widely circulated. All interested parties were able to make their own evaluation, in the United States and elsewhere. Many meetings and document exchanges demonstrated that assessments agreed in every detail. Despite this, the extent of the reactor core damage was collectively underestimated for 6 years. One's first reaction is to emphasize the error in judgement of the operators, who failed to understand the nature of the accident and therefore took a certain number of actions which were, at the very least, ill-adapted. This gets us nowhere. The important question is why the operators did not understand and the answers are rich in information.

13.2.1. Identification of valve position The operators looked quickly at the relief position indicator and saw "valve closed". However, this was an indication of the command given and not of actual position. Indeed, it is easier to create a signal from an electrical closure command than to equip a valve to which access is difficult, with position sensors which are hard to adjust and maintain. Nothing drew attention to this essential fact.

178


Other ways of knowing the real position of the relief valve were available to the operators: a temperature indicator on the relief line downstream of the valve, and the water level in the pressurizer relief tank. The operators noted the temperature indications on the relief line. They were abnormally high, but they did not take them into account because they knew that the valve had been leaking at a rather high rate for some time, and because of this the line was always hot. The initial deteriorated condition of the installation therefore deprived them of a means of verification. The water level in the pressurizer relief tank was not indicated in the control room, but in an intermediate room. This level was apparently never checked, as its systematic verification was not required by any operating procedure.

13.2.2. Understanding the behavior of the pressurizer We saw that the operators were disturbed by the fact that the water-steam interface rose and stayed at a very high level in the pressurizer, whereas the primary pressure was decreasing. It should be pointed out that primary pressure and pressurizer level decrease simultaneously in all cases of primary break except one. This is because the steam bubble in the top of the pressurizer drives the water back towards the break. The exceptional case is that where the leak is located at or above the steam bubble level. When this happens, the discharge of steam through the opening causes at least an apparent rise in the pressurizer water level, while primary pressure decreases. This is what happened at Three Mile Island. However, the operators had not been instructed about this special case. Accident situation operating procedures did not foresee it. The operating team was therefore unable to rely on a document giving a methodical way to identify the situation. It found itself alone in an unknown situation. Nevertheless, as was later discussed, it was not exceptional in this kind of reactor for this oft-used relief valve to jam in open position. Furthermore, the same scenario had occurred 18 months earlier in an identical reactor, at Davis Besse. The operators only identified the blocked valve situation after 20 minutes. Because the residual power of the fuel was low, the transient had no effect. Assuming that "no consequences = no importance", no one, neither operators nor analysts, had discussed the incident. No training or procedure had resulted from it. This was a precursor to a serious accident, but was not recognized as such.


179

13.2.3. Shutdown of safety injection Observing that the pressurizer water level was rising, the operators shut down the safety injection. This was not an exceptional action to take. Automatic startup of this system in conditions where it is unnecessary or even a hindrance is not rare in water reactors in general, and particularly not in this type. But the decision to shut down safety injection should only be made after methodical checks have been carried out, defined in specific procedures based on systematic studies. These documents did not exist. The operators also stopped the safety injection system accumulator tanks, which should normally have discharged on their own when the primary system pressure dropped below 45 bar. This is another proof of their complete lack of understanding of the phenomena they were witnessing.

13.2.4. Man-Machine interface We have already given some idea of the quality of information available in the control room. In fact, the problem was much more widespread. Core temperature indicators whose range wasn't wide enough went to their limit and held there. The operators thought they were broken. The operation computer, saturated with data, blocked and was inoperable for 2 hours. Finally, the control room itself was described as looking like a Christmas tree or a fairground. Very many alarms were lit or flashing. The various prealarm, alarm and alert sound signals were operating. At first, the reactor was operating at nominal power. Its emergency shutdown, plus the difficulties of the secondary system, caused status changes in many systems and parameters, all of which set off an alarm. There was no prioritization enabling initial alarm-provoking conditions to be distinguished from their normal consequences. This situation was of no help to the operators.

13.2.5. Isolation of the containment In the design of the Three Mile Island installation, safety injection did not cause automatic isolation of the containment, that is, closing of valves on all piping systems going in or out of the containment and not indispensable for proper operation of safety sequences. Isolation of the containment is intended to stop all exchange between the inside and the outside, to limit any radioactive release. The sump pump was thus able to transfer water increasingly loaded with radioactive products into the nuclear auxiliary building for several hours.

180


The isolation command was given manually, rather too late, only when this transfer had triggered radiation alarms in the building. This indicates a design error.

13.2.6. Confinement of radioactivity in the nuclear auxiliary building Water from the sumps entered the nuclear auxiliary building, and because the pipes and storage tanks used were not all hermetic, hot contaminated water spilled into the building and vaporized, releasing the iodine and xenon which it contained. This steam and gas was taken up by the building general ventilation system, through iodine filters of questionable efficiency, and released. If the systems had been hermetic and the iodine filters better monitored, this release would not have happened. Once more, the installation was not in satisfactory condition.

13.2.7. Steam generator auxiliary feedwater system It is important to remember the other example of unsatisfactory installation condition, the incorrect positioning of two essential valves of this system. In this case, it was the quality of maintenance operations which was unsatisfactory.

13.3. Lessons learned from the accident The shock of this accident was considerable, and many lessons were learned. We shall mention many and look at some in detail, after discussing the three most important. Accidents more severe than that considered as the maximum credible accident, the loss of primary coolant through a double-ended guillotine break, are possible. They can occur through multiple minor faults and human error. However, this does not call overall installation design into question. The concept of defense in depth, which demands studies of serious accidents, requires that tough containment structures be provided. This containment easily protected the surrounding population and even plant personnel at Three Mile Island. Man is an essential element of safety.


181

These ideas underlie the themes which we shall develop in the next chapters: • how can core meltdown be avoided in an unknown scenario? • how can preparations be made to handle a crisis situation? This question concerns both plant operators and public authorities. • how can the containment, the last barrier, be protected? • how can severe accident precursors be identified in time and the necessary corrective measures taken? Acknowledgement of the human element has given rise to technical decisions supplementing organizational provisions regarding responsibility sharing and due recognition of the contributions of each and all concerned.

Operating conditions must be improved. This should be done by very thorough training and systematic refreshing of operators, with much use of simulators. The standardization of the French nuclear power program makes it possible to have simulators which are directly representative of the different plants. This training must cover normal operating conditions as well as incidents and accidents. In this way operators are trained under real conditions. It was decided that a "nuclear safety and radiation protection engineer", would be continuously present on each site. He does not intervene directly under normal operating or conventional accident conditions; by monitoring from the safety panel, about which more will be said later, he ensures "functional redundancy" in disturbed situations. The operating team changes introduced in 1993 keep roughly the same distribution of functions as regards safety. The safety engineer, on the other hand, is no longer responsible for radiation protection. The inadequacy of available procedures was flagrant during the Three Mile Island accident. In most countries, and especially in France, operating instructions and procedures were re-examined and rewritten. This was a revision of form and content. The procedures were thoroughly tested on simulators.

The control room must be improved. The observations made at the Three Mile Island plant have an essential role in the design of future control rooms, but the most important points have also been corrected on operating plants or those being constructed. Information presentation was improved, including in particular the elimination of command rather than state indications. Certain measurement

182


or indication ranges were widened. New indicators were added, such as the primary coolant boiling monitor (showing the difference between the actual temperature of the primary coolant and the boiling point at primary system pressure). Alarms have been prioritized. The most essential information is now shown on the safety panel. Other lessons learned from this accident have given rise to detailed studies and site implementation, especially in the following two areas: - design, while not itself called into question, may be improved in certain areas: - the confinement role of auxiliary buildings and associated equipment - the management and control of large quantities of highly contaminated water and gas after an accident - the quality and reliability of valves and fittings. Remember that, while safety valves are always designed to open, the nuclear field is about the only one that requires them to close again - the qualification of equipment for the accident conditions we have already discussed. - safety evaluation must not involve only conventional operating condition studies. Analysis methods must be developed taking into account, for example, multiple failures and human errors. As we have seen, this approach was initiated in France several years ago, with the definition of complementary operating conditions. But the Three Mile Island accident made it possible to settle the debate on backfitting on 900 MWe series plants for which authorization had already been obtained and certain of which were already operating.

14

The state-oriented approach

Among the lessons learned from the Three Mile Island accident, we have drawn attention to the efforts devoted to the rewriting and general improvement of incident and accident procedures. This involved a considerable amount of work but afforded significant safety benefits. However, all problems, related to the very principles of the current procedures, have not yet been solved.

14.1. Limits of the event-related approach The incident (I) and accident (A) operating procedures are based on a single identified initiator. The initiator of complementary procedures (H) is an accumulation of simultaneous identified failures, because it involves, each time, all the elements of a redundant system, and only them. The goal assigned to these procedures is to limit, and if possible, prevent, damage to the fuel, which is the main source of disseminable radioactive products, and restore lasting, stable conditions. It is interesting to compare the Three Mile Island accident with the initiators adopted for the I, A and H procedures, i.e. the accumulation of a third-category accident (the pressurizer relief valve remaining open), total but temporary loss of steam generator feedwater, and complete loss of safety injection due to operator misunderstanding. It is clear that reality can be extremely complex. Therefore, the event-related procedures can never cover all possible combinations of events corresponding to cumulative equipment and/or human faults, simultaneous or staggered in time, such as, for example, the mistaken original diagnosis, the poor application of a procedure, the addition of several accidents, the total loss of a safeguard system, etc. Furthermore, the temptation to increase the number of event sequences studied in advance would lead to increasing the number of operating procedures,

184


making diagnosis and therefore choice of the correct procedure practically impossible. The event-oriented approach finally leads to another difficulty: the impossibility to revise the diagnosis if developments are otherwise than foreseen in the initial diagnosis. To get out of this deadlock, Electricite de France and Framatome have suggested approaching the selection of corrective measures in any incident or accident situation in another way, using the state-oriented approach. Whereas accident sequences can be multiplied infinitely, possible system cooling and containment states can be counted, from various normal operating conditions to the most severely degraded situations. If it is possible for each abnormal state to determine the operator actions needed to bring the installation to a more satisfactory situation, the operating team would be able to carry out these actions without necessarily identifying the sequence of previous events.

14.2. Development of the state-oriented approach The first step consists in showing that there is a direct relationship between observable states and the actions required by the operator to improve the situation. This implies: • identifying all possible cooling states of the nuclear steam supply system, their stability ranges and their transitions, as completely as possible • characterizing these states by measurable physical parameters • identifying the best corrective and/or reparative operator actions for each state • making a summary of the preceding points wherein only subgroups of states requiring different actions are separated • identifying the physical measurements and data processing in the control room which are necessary to make state diagnoses and follow up the effectiveness of actions taken. The operation of the nuclear steam supply system is therefore analyzed from basic evaluations of the mass, energy and impetus of each of its major elements. We can then determine: • the energy routing: production in the fuel - removal by primary coolant transport/transfer out of the primary system • the accumulation or restitution of energy in the primary and secondary systems • the variation of primary and secondary water mass balance.

14 - The state-oriented approach

185

Different configurations, covering all possibilities, are selected for each of these characteristics, and identified by measurable parameters (pressure level, temperature and temperature variation, void fraction, radioactivity of steam generators on the secondary side, etc.). The possible combinations of these configurations are grouped and show that: • the mass of primary coolant and removal of heat from the primary system define the behavior of the nuclear steam supply system, in particular the circulation of primary coolant and the removal of heat from the fuel • removal of heat from the primary system depends on the state of the secondary system and on the presence of incondensable gas in the system, identified by the difference in temperature of water from the primary and water from the secondary system, known as "primary-secondary pinching" • the state of the secondary system itself depends on the state of each of the steam generators, indicated by the secondary coolant mass, the steam pressure and the level of radioactivity of the secondary coolant. Each overall state thus defined requires specific safety actions on the various systems, depending on their availability (safety injection, charging and letdown system, pressurizer relief and containment spraying, emergency water supply to the steam generators, discharge of steam in the secondary system, isolation of secondary water and steam lines, etc.). These actions should be judiciously selected so as to stabilize, and if possible improve the overall situation with a view to gradually obtaining less and less deteriorated conditions. To take into account the state of available instrumentation - no primary system void fraction measurement, no reactor vessel water level indicators in 900 MWe units - certain states were grouped without calling into question the general approach.

14.3. First application of the state-oriented approach The first application of the state-oriented approach is the definition of emergency procedure Ul. Procedure Ul is intended to ensure the best possible conditions for nuclear steam supply system cooling and core safeguard, in situations where I, A or H procedures relative to well-identified accident sequences prove ill-adapted or ineffective. The goal of the Ul procedure is to prevent, limit or delay core damage and its radiological consequences, according to the gravity of the situation and the extent of remaining facilities.

186


Depending on core outlet temperatures and system and equipment availability, this procedure makes it possible to determine the best actions for use of: • steam generators • safety injection • pressurizer relief valves • primary pumps to stop, diminish or delay dangerous developments, thereby allowing time to re-establish operability of failed systems. The decision to abandon an event-oriented procedure being used is made, after emergency shutdown, in the following cases (described in simplified terms): • the core outlet temperature is greater than 350 °C • the margin to primary coolant boiling point is less than 10 °C and the safety injection system is inoperable • all steam generators are inoperable • the pressure-temperature relationship of the primary coolant is developing unfavorably • the containment spray system is inoperable and pressure, temperature or radioactivity in the containment is abnormal. Rather than introducing these criteria into each event-oriented procedure, it seemed more advantageous to proceed as follows: • according to an independent, redundant logic system external to existing procedures, which remain unchanged and may develop independently later if needed • calling on the safety engineer, who constitutes human redundancy to the operator • based on the analysis of nuclear steam supply system cooling states, along with analysis of the operability of the safety systems used • using available instrumentation. This is therefore a special Continuous After-Incident Monitoring (SPI) procedure which has been established (Fig. 14.1.). It is applied cyclically by the Safety Engineer as soon as emergency shutdown is tripped or the margin to primary coolant boiling point is less than 20 °C, and until a normal situation is re-established. This surveillance concerns the following parameters: • the operability of each steam generator, that is, its capacity to remove residual power without the discharged steam being contaminated • the mass of primary cooling water and the core outlet temperature • the capacity of the secondary cooling system to cool and depressurize the primary system • the effective startup of the safeguard systems requested (the steam generator auxiliary feedwater supply, the high or medium head safety injection, the low head safety injection, the containment spraying, etc.)


187

• the pressure, temperature and radioactivity within the containment • the criticality of the core (nuclear flux, position of control rods, boron concentration, etc.).

no SAT

Check of

Safety injection Steam generators Primary coolant pumps

10 °C

oui

Primary mass

Core outlet T 350 °C

no Ul

inventory

yes

Heat

At least 1 SG operative

Safety injection operative

no

Ultimate procedure

no

Recognized ultimate emergency situation

yes

discharge

Stateoriented

Primary coolant no P/T development compatible yes

Containment

building

Normal containment pressure, temperature and radioactivity

no

Check of containment spray system

yes yes

Spraying available

no

Fig. 14.1 Continuous after-incident monitoring procedure.

It enables the Safety Engineer, if need be, to request that operators abandon the procedure under way to apply the Ul procedure. The Safety Engineer then resumes his outside surveillance tactics, using the SPU procedure, which is a new cyclic procedure for monitoring NSSS developments in a recognized ultimate emergency situation.

188


The SPI procedure usually makes it possible to confirm, with a slight delay, the major actions already requested by the procedure applied by the operators. In certain cumulative failure cases, it makes it possible to ask operators to take complementary limited actions such as isolating the steam generator, without abandoning the procedure under way. The SPI-U1-SPU provisions therefore constitute a very powerful addition to the I, A and H procedures. It is a further core meltdown prevention procedure, reinforcing the complementary procedures as an element of the fourth level of defense in depth.

14.4. Generalization of the state-oriented approach Studies organized on the state-oriented approach and its precise and measured implementation during frequent incidents culminated in 1990 in a new set of procedures of this type for the startup of the first Penly and Golfech nuclear units. They cover all thermal hydraulic accidents where the reactor is connected to the residual heat removal system. These rules are devised to progressively encompass all primary system incident and accident situations, from emergency shutdown to the most degraded situations, secondary system operating conditions, containment monitoring and the availability of certain systems. With this system, the intellectual and qualitative hiatus between the incident procedures and procedure Ul is consequently suppressed. Similarly, continuity is now assured between third level defense in depth procedures and the fourth level core meltdown prevention procedures, thereby enhancing their efficiency. Full coverage is further afforded by additional event-oriented rules. Responsibility-sharing between the operating team and the Safety Engineer is similar to that defined by the conventional operating documents previously adopted. Comprehensive application of the state-oriented approach was decided for the new N4 standardized reactor series. It is being gradually extended to the different 1300 MWe units, where all reactor vessels are equipped for water level metering. This obviously implied notably retraining of operators, in the light of feedback from the first units where a comprehensive state-oriented approach had been introduced. Finally, this approach will only be applied to the 900 MWe units towards 1997 or 1998 when the reactor vessel water level meters, which are indispensable for these new procedures, have been installed.


189

14.5. Safety panels We have seen that the control rooms of all operating nuclear units have been modified for increased clarity and precision of information. Presentation of controls and actuators has also been improved to avoid confusion. Amendments of this type have of course been applied even more widely to standardized series units at the design or construction stages. In addition, control rooms have been equipped with a system recapitulating essential data under accident conditions and providing a number of operating aids. This system is the safety panel, specific to each plant unit. The safety panel comprises three parts: • the "state indicator lights" show the state of safety or safeguard action requests: emergency shutdown, safety injection, containment spraying, containment isolation, etc. • the "core cooling monitor" determines the sub-saturation margin from the primary system pressure and a number of temperature measurements made in the reactor vessel. This margin is the difference between the maximum primary coolant water temperature measured and the boiling temperature of this water at the pressure measured. The sub-saturation margin, often designated ATsat, and the maximum measured temperature of the primary coolant are displayed on the panel • multiple-function data processing equipment acquires, processes and presents data for diagnosis and operating aid purposes. It thus provides for: • chronological identification of faults which gave rise to safety or safeguard actions and corresponding action reports • presentation on mimic screens of the position of safety devices and any deviation from reference states • aid to identification of the causes of a safety injection • operation aid for safety injection • computer-generated graphics summarizing plant parameter changes within their authorized range versus time, with a thirty-minute storage capacity • application aid for the Ul state-oriented approach procedure and the surveillance procedures applicable after an incident (SPI) and during implementation of the Ul procedure (SPU). Two display screens and a dialog console are available to the operators at the control console. A screen and console, located within the control room but outside the operations area, enables the Safety Engineer to follow development of the state of the installation without interfering with the normal operating team. A third set of equipment is located in the crisis equipment room where

190


engineers would gather during a serious accident. This would help them to assess the situation without having to disturb the operators with too many questions. This is just one of the organizational elements in the event of a severe accident which we shall discuss in Chapter 17. All this should add up to an effective answer to many of the problems faced by the operators at the Three Mile Island plant and by the managers and specialists called in after a few hours. This, in any case, is what the numerous tests on simulators, with teams acting under operating conditions, would tend to indicate.

15

Preparation for the management of severe accidents

Environmental release due to the Three Mile Island accident was very slight owing to the satisfactory behavior of the reactor containment. However, both those directly responsible for the plant and the local and federal authorities were unsure for several days how the situation was going to develop and were considering evacuating populations. Finally, it was decided to evacuate only pregnant women, which in fact proved to have been unnecessary. This event made it evident that means had to be provided for the systematic management of such situations should they reoccur despite improved preventive measures. This implied two prerequisites. First, vindicate increased reliance on reactor containment behavior, even under conditions well outside the design basis spectrum. Secondly, provide tools forecasting possible ways in which the situation could develop, indicating corresponding release breakdowns and the paths to the environment under the specific conditions of the accident considered. All authorities concerned would then be able to make timely and well adapted decisions for the protection of populations and the environment. These aspects will be investigated in this and the next two chapters. Before assessing containment behavior, we have to consider the successive physical phenomena liable to occur in a pressurized water power reactor during what is known as a "severe accident", i.e. an accident the potential consequences of which exceed those of design basis accidents. Before such conditions could be reached, the fuel would presumably have had to be significantly degraded by more or less complete core meltdown.

15.1. Core and vessel degradation Chapter 6, which dealt with loss of coolant accidents, describes an accident scenario liable to cause a degree of fuel clad degradation. This accident sequence involves implementation of at least one safety injection and containment spraying channel, in conformity with the design basis postulates.

192


We now have to consider the sequence of phenomena which would occur under different conditions corresponding to the total failure to respond of these two safeguard systems and of other core meltdown prevention procedures.

15.1.1. Core dewatering There are two categories of primary system drainage situations: • primary system breaks, causing core dewatering at a relatively low pressure, a few tens of bars at most • failure of secondary system cooling procedures, resulting in water and steam dumping through the pressurizer relief valves, inducing core dewatering at high pressure, in the vicinity of the normal operating pressure. Depending on the initial condition, the size of the break, the accident sequence, the safeguard system failure level, dewatering may take from less than a minute to several hours or even days. For example, a 5 cm diameter hole on a main primary system pipe would result in fuel uncovering in 30 minutes if no safety injection were available.

15.1.2. Fuel degradation As the water level recedes, the temperature of the uncovered part of the core rises due to the residual power. The zircaloy clads, which are at a temperature of 350 °C or less under normal operating conditions, start deforming at between 700 and 900 °C. If the pressure in the vessel is low, they swell and burst. If this pressure is high, they collapse onto the fuel pellets, facilitating the formation of a eutectic UO2-Zr which melts at around 1200 to 1400 °C In both these cases, the volatile fission products which have accumulated in the clad-pellet gap are released into the primary system. The zirconium in the clads oxidizes upon contact with the steam. The kinetics of this phenomenon increase rapidly with temperature and double every 50 °C. But it must be borne in mind that: • this is an exothermic phenomenon, producing locally power exceeding the residual power, which means that the phenomenon is also divergent • the reaction releases hydrogen* to the primary system and then to the containment. This will considerably reduce the cooling capacity of the • The oxidizing of 1 kilogram of zircaloy produces about half a cubic meter of hydrogen at normal pressure and temperature. Considering the quantities of zirconium

15 - Preparation for the management of severe accidents

193

steam generators and generate a risk of hydrogen combustion within the containment • the clads are embrittled, which accelerates their destruction in the event of a thermal shock. When the fuel pellet temperature increases, the fission product release kinetics increase, as shown in Figure 5.1. At between about 1300 and 1500 °C, the control rod constituents, silver, indium and cadmium melt and vaporize. At around 1800 °C, the oxidized part of the clads will melt and begin to flow. It is not until a temperature of 2700 to 2800 °C is reached that, unless a eutectic is formed with the zirconium, the uranium oxide itself melts, thereby inducing loss of core geometry by local, and then general, collapse. This will give rise to formation of the first corium, which is a molten mass of fuel and structural materials, held in their molten condition by the residual heat of the fission products. Practically all of the most volatile fission products have at this point escaped from the fuel.

15.1.3. Vessel degradation The collapse of the core components induces the sudden vaporization of any water remaining at the bottom of the vessel, more or less closely followed, depending on the primary system pressure, by perforation of the vessel bottom head. This can take a few tens of minutes or several hours. If the primary system is pressurized, the corium may be dispersed on leaving the vessel. This could facilitate a further sudden interaction with any water at the bottom of the vessel. However; in all cases, it is postulated for accident management studies that all the corium collects in the bottom of the vessel.

15.1.4. Basemat erosion The basemat concrete then decomposes under the thermal effects of the residual power released in the corium, increased in the initial phase by heat due to the oxidation of metals, such as the vessel steel or the remaining zirconium.

present in each type of installation, this corresponds to the production of about 1 kilogram of hydrogen per MWe.

194


The free water, bound water and carbon dioxide gas contained in the concrete will be released and penetrate the corium, where they will contribute to the oxidation of any remaining metal materials and the production of hydrogen and carbon monoxide, both of which are combustible. The calcium and silica oxides will be gradually integrated into the corium. As soon as the oxidation reaction is over, the corium will gradually cool. The temperature of the oxide phase containing the main non-volatile radioactive products will stabilize for a long period at between 1300 and 1500 °C when a near-equilibrium is reached between the residual power and the thermal losses at the corium surface and the corium-concrete interface. If a denser metal phase remains, it will contain few radioactive products. It will cool faster and solidify within a few hours, thereby slowing down the progression of the corium. So the fast basemat erosion phase would last about an hour and would correspond to concrete degradation to a depth of about 1 meter (Table 15.1.). The rate of erosion would then decrease to a few centimeters per hour, strongly influenced by the specific properties of concrete. The erosion stops when the corium-concrete interface temperature falls below the concrete decomposition temperature, which is about 1100 °C. However, basemat melt-through is circumspectly considered unavoidable. The corium would then stop after penetrating a few meters into the subsoil. As residual power decreases and its volume increases, it then cools by thermal conduction and solidifies. Table 15.1. Basemat erosion kinetics. Erosion depth

2m

3m

4m

5m

Minimum time Maximum time

0.8 d 1.4 d

1.5 d 2.9 d

2.5 d 4.5 d

3.8 d 6.2 d

Complementary studies have been undertaken to investigate basemat fast cracking hazards related to the thermal shock caused by contact with the corium.

15.2. The Rasmussen report At the request of the American safety authorities, Professor Norman C. Rasmussen of the Massachusetts Institute of Technology (MIT), conducted from 1972 to 1975 a scientific investigation into hazards created by the use of nuclear power reactors.


195

This overall survey based on earlier studies was organized round the systematic analysis of accident scenarios aimed at defining a relationship between probabilities and numbers of dead. The Rasmussen report, published in 1975 under the references WASH 1400 and NUREG 75-014, is still the basis of all PWR severe accident studies. It is also the first example of a probabilistic safety study giving figures for the probable impact on the population. The French safety authorities took an immediate interest in this survey, less from the standpoint of the probabilities and consequences for populations, which involve considerable uncertainties, than with regard to the phenomenology of reactor core degradation and the behavior of a reactor containment. The Three Mile Island accident obviously further stimulated discussions on these subjects and caused the various nuclear participants in France to move on from theoretical assessments to the implementation of practical measures. This accident was in fact a remarkable demonstration of the extreme importance for the protection of the general public and the environment of an efficient, durable containment. The Chernobyl accident, an unfortunate example of core degradation with uncontained radioactive release, only serves to reinforce this conviction. The Rasmussen containment failure mode classification is still used and comprises six main modes: • mode a: steam explosion in the vessel or reactor pit, inducing loss of containment integrity in the short term • mode P: initial or fast-induced lack of integrity • mode y: hydrogen explosion • mode 8: slow overpressurization • mode e: basemat melt-through by the corium. Mode V, which bypasses the containment using outgoing pipes, is dealt with separately, since it does not directly concern the behavior of the containment building. The families of scenarios described culminating in these containment degradations correspond, except mode (3, to accidents involving in the more or less long term, the formation of corium, providing the molten fuel is not dispersed, and rupture of the reactor vessel. It should be borne in mind that with the fuel enrichment proportions adopted for nuclear power plants equipped with light water reactors, a chain reaction cannot take place without an appropriately disposed moderator. On the other hand, a very small number of fuel elements, having maintained their geometry and submerged in pure water, can constitute a critical configuration.

196


Whatever the size and geometry of the compact corium, reverting to criticality should not be possible. However, investigations are still proceeding into possible unforeseen geometries and specific mixtures. The Rasmussen report describes a large number of special sequences, grouped in families, all related to the technology of the American reactor which provided the basis for studies and know-how at that time. Their systematic presentation in this document would require entering into details unrelated to present purposes. None of them are associated with reactivity accidents characterized by high speed kinetics. Thorough analysis of the Rasmussen report from the standpoint of French nuclear units started in 1975. It was, from the outset, mainly focussed on the definition of means of limiting the consequences of severe accidents. It was organized around two complementary topics: • simplified characteristics of types of release • analysis of failure modes and provisions to deal with them. Deeper insight together with the probabilistic safety studies which will be presented in subsequent chapters enable initial trends to be brought into line with more realistic views and solutions, which will gradually be taken into account.

15.3. "Source terms" The IPSN sought to characterize specific types of release called "source terms". A source term is a specific type of release characteristic of a reactor family and representative of a type of accident, i.e. in general, a mode of containment failure following complete core meltdown. It is taken into consideration to define appropriate corrective actions for the protection of populations under these extreme emergency conditions. There are three source terms, listed below in decreasing order of seriousness: • source term SI corresponds to early containment failure a few hours after onset of the accident • source term S2 corresponds to direct release to the atmosphere following loss of containment integrity one or several days after accident initiation • source term S3 corresponds to indirect, delayed release to the atmosphere, through paths enabling a certain amount of fission products to be retained. These studies were underway at the time of the Three Mile Island accident. Provisional values which would have been smoothed became set val-


197

ues, which explains the inappropriate precision of certain figures (Table 15.2.). As in the Rasmussen survey, assessments were aimed at reality. The purpose here was not to provide a safety demonstration based on penalizing assumptions, but to optimize plants where basic design has been definitely adopted or to define organizational procedures for the protection of the general public. However, each source term covers, by definition, a certain number of possible scenarios. The values retained in this context are presented as percentages of the initial activity of the radioactive products present in the reactor core: Table 15.2 Percentage of radioactive products released to the atmosphere. Source term Noble gases Mineral iodine Organic iodine Cesium Tellurium Strontium Ruthenium Lanthanides and Actinides

SI

S2

S3

80 60 0.7 40 8 5 2 0.3

75 2.7

75 0.3

0.55 5.5 5.5 0.6 0.5

0.08

0.55 0.35 0.35 0.04 0.03 0.005

Modes a, (3 and y without prevention and mitigation provisions could lead to SI type release. Mode b could lead to S2 type release. Mode e, loss of containment integrity by basemat melt-through, could lead to S3 type release. Uncertainties remain as to iodine and aerosol behavior, despite the continued implementation of large scale experimental research programs. The gradual improvement of our knowledge in these areas could ultimately modify the source terms presently defined. It would also lead to design optimization for future reactors where the defense in depth provisions would enhance prevention of substantial radioactive release.

198


15.4. Severe accident management studies in France In tandem with the definition of source terms, the French study programs included examination of each of the Rasmussen degradation modes to determine their relevance to French plants and define ways of lessening the probability or consequences by reinforcing the final containment barrier. For there may be simple means of preserving or restoring containment integrity, but these could only be used under particularly difficult conditions if their implementation had been thoroughly prepared beforehand. The different failure modes were then considered under conditions postulated in the light of the Rasmussen report and discussions on the French standardized power plants. The following scenario was thus postulated, for instance: with primary system cooling no longer assured, the system drains, the core melts and penetrates through the bottom of the vessel in about 2 hours. The basemat is eroded by the corium produced, which finally melts through it. The kinetics of this accident are relatively slow. This scenario could correspond to that of a large primary break compounded by total loss of safety injection and containment spray capability. Incidents or anomalies observed in France show that simultaneous failure of the pumps actuating these two systems is by no means simply a farfetched supposition. Several incidents and nonconformances are possible precursors. This is the case for the sump filter anomaly observed on the 1300 MWe units, for the incompatibility between different lubricants or the necessity to sample for quality control a significant quantity of the safety injection pump seal oil. These anomalies will be considered in detail in Chapter 26. They were detected in the course of inspection or maintenance operations - confirming the importance and efficiency of the latter - and were of course corrected. Such anomalies on their own could not cause a primary system break. However, the probability of occurrence of the type of scenario described would not seem high enough to call into question the design basis of the plants concerned. But, on grounds of defense in depth, we nevertheless do our utmost to improve the possibilities offered for the practical control of such situations, based on realistic scenarios. The Rasmussen containment degradation modes are being re-examined on this basis with a view to determining their plausibility and defining possible improvements in the framework of a given design basis. These studies are based on knowledge which is as yet compartmental. This justifies the organization and pursuance of experimental work in diffi-


199

cult fields. Although results are still pending, decisions nevertheless have to be made. The options retained in this context are consequently not sanctioned by the same quality level and degree of certainty as were obtained for the plant design basis situations. This is one of the basic characteristics of severe accident management studies. It will obviously evolve as new data becomes available. In 1981, EDF was requested to define ultimate emergency procedures designed to prevent or minimize the radiological consequences of severe accidents. Provisions in this respect have been progressively proposed by the national utility and their principles accepted by the safety authorities. All French plants have now been equipped accordingly. However, greater insight into these questions and continued research could result in further modifications.

15.4.1. Loss of containment integrity due to a steam explosion The Rasmussen mode a scenario is as follows: a large primary system break occurs and neither the safety injection nor the containment spray systems are operable. After 1 to 2 hours, the core melts and drops either into the bottom of the vessel or through the vessel into the reactor pit. In both cases, if the corium is sufficiently dispersed and if there is water in the bottom of the vessel or of the reactor pit, a steam explosion could occur upon contact with the water, releasing sufficient energy to project missiles which could impair containment integrity. Mode a thus implies considerable dispersion of the fuel for the heat transfer area between the hot fuel and the water to be large enough to cause a steam explosion and also requires a sufficient quantity of water. On the basis of the scenarios described, this occurrence seems highly unlikely, but in the present state of the art, this cannot be demonstrated. Studies are still proceeding, but experts assembled by the OECD considered loss of containment integrity due to this phenomenon to be sufficiently unlikely and this mode was not retained in the French study programs. It was not until the Chernobyl accident and the reopening of criticality accident study programs that this mode came back to the forefront, in the context of entirely different scenarios. The kinetics of the phenomenon are, in any case, too sudden for accident management procedures to be of any assistance. We shall come back in Chapter 16 to these studies, which have mainly given rise to preventive measures.

200


15.4.2. Containment isolation faults Containment integrity is continuously monitored by comparing the containment gas injection rate (leaks from compressed gas systems or valve motion controlled by these gases) with internal pressure changes. Routine tests on the containment penetration isolation valves confirm that they are operating correctly. Pressurization of the containment at startup and every ten years enables its leak rate to be compared with the specified values. These provisions should suffice to preclude any serious isolation faults prior to the accident. Leaks can however occur if the automatic isolation of the various penetrations under accident conditions fails to operate correctly or if the air locks are defective. This loss of containment integrity mode, mode b, is extremely important, since it can lead to radioactive release to the environment very early on in the accident. The short time interval involved is not sufficient for radioactive decay and deposition in the containment to play a role, nor for the public authorities to take steps for the short term protection of populations in the immediate vicinity of the plant. In order to deal with such situations, EDF developed procedure U2: "procedure in the event of a containment isolation fault". The purpose of this procedure is to monitor containment integrity under accident conditions, as soon as a certain level of radioactivity is detected in the containment, even in the case of minor accidents, and to identify and localize any defects, providing, if possible, remedial action. This procedure supplements the continuous monitoring of the containment leak rate under normal operating conditions. U2 comprises a set of actions defining: • containment surveillance conditions, by measuring radioactivity released from the stack, present in the sumps or in peripheral facilities and their ventilation ductwork, and by verification of the condition of isolation valves • the types of action to be taken, such as confirmation of isolation commands, the localization of leaks and the determination of how to eliminate them, the containment of a room or, at a later stage, the reinjection of liquid wastes into the reactor building. With all these different precautions, it should be possible to restrict short term release to values defined for design basis accidents.

15.4.3. Hydrogen production and combustion In the description of LOCA accidents in Chapter 6, we mentioned the risk of a water-zirconium reaction, producing both energy and hydrogen.


201

In the context of 4th category accidents, it is stipulated that clad temperature shall not exceed 1204 °C and that the reaction shall not concern more than 1% of the zirconium involved. In the circumstances considered, since core meltdown is postulated together with formation of corium, it must be assumed that much of the zirconium in the core will have reacted with water and released hydrogen, according to mechanisms described at the beginning of this chapter. As long as this hydrogen remains in the primary system, it cannot burn because there is no free oxygen. This is no longer the case if it reaches the containment atmosphere. However, for there to be an explosion, there has to be an appropriate blend of hydrogen, air and steam (see SHAPIRO chart, Fig. 15.1.). Combustion also requires a detonator. Metal corrosion in the containment, radiolysis* of sump water and corium-concrete interaction are also sources of hydrogen, but the quantities produced by the first two phenomena are slight. Corium-concrete interaction, on the other hand, can produce in 48 hours a quantity of hydrogen equivalent to that resulting from a zirconium reaction. Mode Y corresponds to loss of containment integrity due to a hydrogen and carbon monoxide explosion in the reactor containment. In fact, we have to differentiate between two types of fast combustion: deflagration and detonation, the conditions and consequences of which are very different.

15.4.3.1. Deflagration A deflagration is a form of combustion which, once initiated, is propagated through the mixture by gas conduction heating and diffusion of free radicals in the unburnt gas area. Propagation occurs at a speed of several meters per second. It can be triggered with relatively low proportions of hydrogen (the SHAPIRO chart gives a threshold of about 4% in dry air). The initiating energy level required is slight, less than 1 millijoule. A hot spot of about 500 °C can trigger spontaneous ignition if there is no steam. On the other hand, beyond a steam concentration of 50 to 60%, there is no risk of deflagration. The mean containment concentrations reached under accident conditions having induced major zirconium-steam reactions are amply sufficient for hydrogen deflagration providing there is no steam inertization. Such deflagrations occur with extreme rapidity, doubtless before there has been any significant contribution from the reaction between the corium and the

* Radiation-induced decomposition of water into free hydrogen and oxygen.

202


basemat, which means that the two modes of hydrogen production would be disconnected.

Fig. 15.1. Shapiro chart. Ignitibility limits for the H 2 - H2O - air mixture.

The immediate or delayed operation of the containment spray system, which will lead to condensation of the steam in the containment, would have a significant effect on the triggering of a deflagration. If we postulate the combustion of all the hydrogen produced by oxidation of all zirconium present in the vessel in a single deflagration, the maximum instantaneous pressure reached in the containment would not suffice to fissure the liner in a 900 MWe unit, at least in parts without discontinuities, which means that satisfactory overall leaktightness would be preserved. Such an incident could, on the other hand, cause at least transient through-wall cracking in the 1300 MWe unit inner containments (the concrete is prestressed), although sufficient margins would be preserved with respect to structural failure. Table 15.3. presents pressures calculated under adiabatic conditions, but also taking into account heat exchanges with the structures, which is more realistic.

203


The effects of concrete thermal stressing are under investigation. It is indispensable to ensure in all cases that isolation valves and electric cable penetrations remain unimpaired. Table 15.3. H2 production and containment characteristics. CPO

CP1-2

P4

P'4

N4

Free volume (m3)

46 000

50 400

81 500

70440

73000

Zircaloy mass (kg)

19 820

21 600

27920

27920

29660

9 766

10 651

13765

13765

14623

19.1%

19.3%

15.8%

17.8%

18.2%

4.7 bar*

5 bar

4.8 bar

5.2 bar

5.3 bar

7.5 bar

8.1 bar

8.3 bar

13 bar

10.4 bar

11. 8 bar

11. 8 bar

10.7 bar

8.95 bar

9.75 bar

9.75 bar

9.2 bar

7.6 bar

8.3 bar

8.3 bar

Standardized plant series

H2 produced by 100% oxidation (TPN m3) Mean H2 concentration in a dry atmosphere Design basis pressure Through-wall cracking limit Collapse limit Maximum deflagration pressure under adiabatic conditions Maximum deflagration pressure with heat exchanges

< 9.2 bar

It should be borne in mind that this table is based on two postulates: reaction of all vessel zirconium with the water and combustion of the hydrogen produced in a single deflagration. In the majority of cases, the hydrogen would progressively exit the core as soon as produced, entrained by the escaping primary fluid. There could then be several successive deflagrations, none of which could cause an overpressure which would damage the containment.

* The pressures are indicated in absolute values.

204


It is interesting to note in this connection that the possibility is being considered of equipping containments with various systems including ignition systems, which would result in semi-continuous hydrogen combustion. Pressure peaks obtained would then be much lower. An appropriately sized catalytic recombination system could also be envisaged for removal of free hydrogen before concentrations compatible with deflagration could be reached. However, they would be inadequate in cases of fast hydrogen release. Weighing up the advantages and drawbacks of such systems has not yet yielded sufficiently conclusive results for a decision to be made for current French plants which comprise large containments.

15.4.3.2. Detonation A detonation is a form of combustion occurring at the interface between supersonic shock waves and the unburnt gas compression wave, producing a chemical reaction. A detonation implies far higher hydrogen concentrations than a deflagration. The SHAPIRO chart defines the detonation range as between 18 and 55% of hydrogen in dry air. Recent experiments show that the threshold would be lower for very large volumes. The required initiating energy level is, on the other hand, very high, 5 kj for a 30% H2 concentration, but 250 kj for a 20% concentration and about 50 MJ when it is only 15% (Fig. 15.2.). The presence of steam raises both the concentration threshold and the initiating energy requirements. But it is logical to assume that a considerable proportion of the primary system water will be in the containment following core meltdown. At least part of the 300 or 400 m3 of water would certainly be there, in the form of steam, especially if the containment spray system is inoperable. If this system had been working, there would have been a deflagration. A case where this were otherwise would correspond to a loss of core cooling resulting from major primary coolant leakage outside the containment. But in this case, it would seem probable that the hydrogen would be entrained to the atmosphere, as would the volatile fission products. It is in the 900 MWe reactor containments that the theoretical possible hydrogen concentrations are highest. They are located towards the lower detonation limit of the Shapiro chart. They would be diminished by the presence of steam. However, the initiating energy levels required for plausible concentrations are sufficiently high for a generalized detonation in the containment to be excluded.


205

Hydrogen percentage in volume Fig. 15.2. Energy required to initiate a detonation in an unconfined atmosphere. In the course of experiments, flame acceleration mechanisms have been observed in pipes featuring discontinuities, able to induce transition from deflagration to detonation, but these results are difficult to extrapolate to the dimensions of a containment. Studies are proceeding to determine the characteristic dimension beyond which the phenomenon disappears and also the consequences of a detonation in a bunkerized area. All things considered, the probability of loss of containment integrity due to hydrogen combustion seems slight. At the present time, no accident provisions are made in this respect. There is consequently no special procedure for these circumstances. However, complementary investigations are still proceeding, notably concerning the conditions under which the various gases mix, the risks of stratification and local hydrogen concentrations and also the degree to which containment strength is affected by the differences in rebar densities.

206


15.4.4. Slow pressure buildups in the containment Mode 5 corresponds to a mean term containment failure caused by atmosphere overheating due to the inefficient removal of fission product energy and the gradual release of very large quantities of gas during basemat erosion of the corium. These gases could also be accompanied by steam from the water used to try and impede the corium advance by cooling it. In these circumstances, the containment pressure could rise steadily, reaching the design basis limit after about 24 hours and then continuing relentlessly beyond. It was decided to deal with the possibility of irremediable loss of containment integrity by overpressure by providing a containment pressure control device, consisting of a filtered venting system designed for use when required: • to restrict containment pressure to the design basis value • to reduce by a factor of at least 10 the aerosols contained in the gases released • to route the filtered gases to the stack which is equipped to monitor their radioactivity and facilitate their atmospheric dispersion. The solution adopted consists in using a containment penetration initially intended for depressurization purposes during acceptance pressure tests and the subsequent routine leak tests. A set of valves, a pressure-reducing device and a sand bed filter package, 42 m2 in face area and 80 cm deep, are fitted between this penetration and the stack. Investigations into sand bed filter efficiency and optimization of the system were undertaken by the IPSN in the R&D department located at the Cadarache study center. These investigations confirmed that the required degree of efficiency could be obtained and even exceeded (FUCHIA tests). However, a detailed analysis of the system once installed showed that use of the filter raised problems of radiological protection on the site and of filter cooling. In addition, the possibility of a hydrogen deflagration before the gases entered the filter had to be prevented. Various complementary measures were defined accordingly. More recently, it was decided to install a prefiltration package inside the containment. This should solve the remaining problems satisfactorily. The U5 procedure "containment depressurization" would only be implemented under severe accident conditions after close consultation with the EDF central services and the public authorities.


207

15.4.5. Early release paths through the basemat The vessel failure postulated in severe accident studies results in the corium falling through to the bottom of the reactor pit. We described at the beginning of this chapter various physical events related to erosion by thermal phenomena. Mode £ corresponds to basemat "rupture" after its complete meltthrough by the corium. This would require between one and several days, depending on the basemat characteristics (4.20 m for the standardized 900 MWe units and 3 m for the 1300 and 1400 MWe units). This period would allow the decay of short-lived radioactive products and the deposition of many others on the containment walls or in the sump. If the corium fell through the basemat, it would soon stop in the soil beneath, but the groundwater could eventually be polluted by leaching processes*. Solutions include drilling a system of shafts round the affected unit, equipped with pumps to prevent the transfer of contaminated water to bleeding points, rivers or the sea. Any water at the bottom of the containment, injected to try and cool the corium, would be heavily laden with radioactive products and could pour out into the soil through the hole in the basemat, as could the containment gases forced out by the internal pressure. It could prove more difficult to confine these contaminations. The atmospheric release would nevertheless be bounded by source term S3. This description makes no mention of the basemat channels which could be more rapidly affected by the corium, providing outlets for the pressurized gases in the containment. All light water reactor buildings comprise dynamic testing systems, designed to monitor basemat deformation with time, especially during containment pressurization for periodic strength and tightness tests. These devices are located 1 m below the basemat surface in the 1300 MWe units and 1.70 m below in the 900 MWe units (Fig. 15.3.). The 1300 MWe units are equipped in addition with a basemat draining system, located 2 m below the surface. There are also certain special cases, such as nuclear units built on snubbers. Compensatory measures were consequently defined and are the subject of procedure U4: "handling early release paths through the basemats".

* Washing of free surfaces leading to extraction of soluble products.

208


Sealing systems, plugging beneath the reactor pit and permanent obstructions have been installed. No further action is required of the operators on this particular point, so that procedure U4 in fact no longer exists. They are aimed at benefitting fully from radioactive decay and ground filtration in the event of basemat perforation and extending the time available to make the necessary off site provisions.

Fig. 15.3. Rasmussen containment failure modes.

15.4.6. Identification and analysis of other scenarios We have discussed the impact of the Rasmussen report as an initiator of severe accident studies in France and in most of the countries using nuclear power. However, the investigations are not restricted to analysis of the containment failure modes described in the report. We have already mentioned the risks of direct release to the atmosphere due to mishandled steam generator tube break sequences. The possibility of other direct release paths, bypassing the containment, is being carefully examined with a view to defining complementary preventive measures and protective actions if and when required. Mode V corresponds to such cases, postulating significant direct leaks in peripheral buildings, due to defective tightness of the safety injection sys-


209

tern check valves. Another containment bypass has been identified on French plants. It is related to the fact that the Reactor Cavity and Spent Fuel Pit Cooling and Treatment system, which is outside the containment and not pressure-resistant, is connected to the Residual Heat Removal system, which is designed to withstand 40 bar pressures. Structural provisions, together with special surveillance and procedures combine to make this risk sufficiently improbable. Finally, in the next chapter, we shall look at special cases of beyond design basis criticality accidents.

15.5. Radiological consequences of source term S3 and intervention provisions On the basis of the accident studies presented above and providing the ultimate emergency procedures are implemented, "maximum plausible release" values are bounded by source term S3. The radiological consequences corresponding to this source term have been assessed and population protection measures examined in the light of these consequences.

15.5.1. Assessment of radiological consequences Since we are no longer in a design basis context, the assessment was not based on the Le Quinio charts presented in Chapter 5, but on a more recent set of charts derived from the Doury charts, designed to deal with more realistic and more varied situations. These charts take into account atmospheric stability, wind speed and rain. They will be presented in greater detail in Chapter 17. To calculate them, it was considered that source term S3 could be represented by a scenario involving a sand filter which would enable containment depressurization within 24 hours, with release beginning 24 hours after onset of the accident. During the first 24 hours, a containment leak rate of 0.3% per day of the mass contained is postulated, with half of this leakage escaping directly to the atmosphere, the other half being recovered and filtered with a 100 factor efficiency.

210


Whole body dose equivalent due to external exposure (Sv)

Fig. 15.4. Radiological consequences due to source term S3.

Three types of weather conditions were considered: • 1: normal diffusion, wind of 5 m/s, no rain (ND5d) • 2: normal diffusion, wind of 5 m/s, rain at 1 mm/h (ND5r) • 3: low diffusion, wind of 2 m/s, no rain (LD2). The graphs show results obtained for: • whole body dose equivalents due to the plume compounded by ground deposits • thyroid dose equivalents due to iodine. These results have now to be compared with the possibilities of implementation of protective measures for the general public. For this, we shall consider the recommendations formulated by the International Commission on Radiological Protection before assessing the possibilities of intervention by civil security teams in areas around the sites.

15.5.2. ICRP recommendations for accident situations The International Commission for Radiological Protection proposed in its publication 63, released in 1993, a procedure ensuring population protection under accident conditions (Table 15.4.).


211

Thyroid dose equivalent (Sv

Fig. 15.5. Radiological consequences due to source term S3.

The procedure defines intervention levels mainly concerning evacuation and confinement indoors, accompanied by the distribution of stable iodine, but is so devised as to be open to constant improvement, as mentioned in Chapter 1. Evacuation, confinement indoors or the administration of stable iodine can obviously involve drawbacks with respect to the physical or psychological well-being of the populations concerned or those assigned with implementing these measures. Such drawbacks have also to be carefully weighed up. The same caution applies when considering restrictions on the consumption of certain foodstuffs. The yardstick for intervention is the dose prevented by the implementation of the protective action. The indications in the above table are accompanied by cautious considerations making full allowance for optimization. So the indications on the two graphs representing the radiological consequences associated with source term S3 are to be considered with prudence.

15.5.3. Scope of civil security interventions Since the beginning of the eighties, the public authorities have also been working on the definition of realistic possibilities of implementation of pro-

212


tective measures for populations in the vicinity of nuclear sites. They have estimated that, given the characteristics of the French sites, they could implement the following provisions within 12 to 24 hours after the onset of an accident: • evacuating the population in a 5 km radius round the site • sheltering (confinement indoors) of the population in a 5-10 km radius round the site. Complementary measures would, of course, be envisaged for the longer term. It is clear from comparison that this degree of intervention would provide satisfactory protection in the event of release not exceeding source term S3. Table 15.4. ICRP publication 63 recommendations. Intervention level of averted dose in mSv Type of intervention

Almost always justified

Sheltering 50 Administration of stable 500 (equivalent dose to • j\t-j\ iodine thyroid) .. (< , 1.. week) , -, Evacuation TAM, i u A A Whole body dose Equivalent dose to skin r

Relocation Restrictions on a single foodstuff

cnn 500 5000 1000

10 (in 1 year)

Range of optimized values

, Not, more . „ than a factor of 10 , lower . ... than , the justified value

5-15 mSv per month for prolonged exposure 1000 to 10,000 Bq/kg ((3 y emitters) 10 to 100 Bq/kg (a emitters)

The onsite severe accident procedures are consequently consistent with the population protection provisions, with respect to recommendations currently in force. It should also be noted that, since the Chernobyl accident, greater attention is paid to the social and economic disturbances created by longer term problems, such as those resulting from food chain contamination. The foodstuff marketing limits defined by the CEC following this accident are extremely penalizing, but have no actual health physics signification. With release corresponding to source term S3, these limits would have to be applied at considerable distances from the damaged plant for more or less long periods of time. This is a preoccupation which will lead to "maximum plausible release" figures being more stringently limited for future reactors.


213

15.6. List of ultimate emergency procedures As in the case of the complementary procedures, the identification initials and numbering of these ultimate emergency procedures were decided in the heat of the moment on the basis of the numerous studies undertaken in the aftermath of the Three Mile Island accident, before the results obtained had been logically interrelated. Here too, the transition to a generalized state-oriented approach will remove these minor inconsistencies. Procedure Ul was presented in Chapter 14. It is unmistakably aimed at preventing core meltdown, even if it also provides for the subsequent management of such situations. It thus precedes the other procedures, which postulate its failure. Although its identification initial classifies it in the ultimate emergency series, procedure U3: "use of mobile facilities to back up safety injection and containment spraying", already presented in Chapter 11, does not correspond to containment protection after core meltdown. On the contrary, it is designed to prevent or limit this occurrence. As an extension to procedure H4, which provides for mutual backup of the permanently installed pumps used for the low head safety injection and containment spray systems, procedure U3 is used in the event of total loss of these pumps. Basically, it consists of pre-installed connection devices, accessible after an accident, which would enable the use of pumping facilities and a heat exchanger if necessary which are not permanently installed in the units. The capacity of the equipment provided for and the radiological protection afforded would enable intervention 15 days after a large primary break, for example, although it is hoped that this period could be shortened without having to consider the possibility of restoring containment spraying in the short term. The existence of the H4-U3 facilities consequently does not affect the phenomena we have just described, since they are aimed at core meltdown prevention. There remain the following two procedures: • U2: procedure in the event of a containment isolation fault • U5: containment depressurization.

15.7. Summary of procedures Table 15.5. summarizes the correspondence between the various categories of operating conditions and the procedures and provisions to contend with them.

214


It should be borne in mind that, in parallel with the operator procedures, the safety engineer follows surveillance procedure SP1 and, in a Ul context, surveillance procedure SPU. Table 15.5. Procedure application ranges.

Order of magnitude of frequencies or probabilities

Design basis operating range Estimated frequencies of initiating events

Complementary operating range Realistic probabilities

Ultimate procedure application range

Permanent or frequent 10- 2 tol

io-4 to icr2 io-6 to icr4

Elements of nuclear safety

Nuclear Safety

Nuclear Safety

Elements of nuclear physics

Elements of Nuclear Physics

Risk and Safety Analysis of Nuclear Systems

Radiation Safety in Nuclear Medicine, 2nd Edition

Nuclear Safety: A Human Factors Perspective

Nuclear Power - Operation, Safety and Environment

Safety Culture in Nuclear Power Operations

Effective Corrective Actions to Enhance Operational Safety of Nuclear Installations

Fundamental Aspects of Nuclear Reactor Fuel Elements (Tid 26711 P1)

Nuclear

Safety

Probabilistic Safety Assessment in the Chemical and Nuclear Industries

Probabilistic safety assessment in the chemical and nuclear industries

Nuclear

Safety of irradiated foods

Dilemmas of Nuclear Strategy

Foundations of Nuclear Physics

A Place Of Safety

A Place of Safety

Evaluation of Fire Safety

Handbook of Laboratory Safety

Evaluation of Fire Safety

A Place of Safety

a Place Of Safety

The Safety of Secrets

Nuclear Competence Building (Nuclear Development)

Elements of combinatory logic

Elements of nuclear safety

Nuclear Safety

Nuclear Safety

Elements of nuclear physics

Elements of Nuclear Physics

Risk and Safety Analysis of Nuclear Systems

Radiation Safety in Nuclear Medicine, 2nd Edition

Nuclear Safety: A Human Factors Perspective

Nuclear Power - Operation, Safety and Environment

Safety Culture in Nuclear Power Operations

Effective Corrective Actions to Enhance Operational Safety of Nuclear Installations

Fundamental Aspects of Nuclear Reactor Fuel Elements (Tid 26711 P1)

Nuclear

Safety

Probabilistic Safety Assessment in the Chemical and Nuclear Industries

Probabilistic safety assessment in the chemical and nuclear industries

Nuclear

Safety of irradiated foods

Dilemmas of Nuclear Strategy

Foundations of Nuclear Physics

A Place Of Safety

A Place of Safety

Evaluation of Fire Safety

Handbook of Laboratory Safety

Evaluation of Fire Safety

A Place of Safety

a Place Of Safety

The Safety of Secrets

Nuclear Competence Building (Nuclear Development)

Elements of combinatory logic

Recommend Documents