INPRO Criterion Robustness of Design Position of the EPR TM reactor Part 3. Franck Lignini Reactor & Services / Safety & Licensing

Transcription

1 INPRO Criterion Robustness of Design Position of the EPR TM reactor Part 3 Franck Lignini Reactor & Services / Safety & Licensing 0

2 E.P?.?.?.? Robustness against External Hazards 1

3 External Hazards Safety objectives against external hazards are: Prevention of unacceptable radiological releases Plant operation to the safe shutdown conditions shall be possible The following external hazards are considered at design stage: Earthquake, Airplane crash Explosion pressure wave Site flooding Extreme weather conditions Extreme winds Rain, snow, ice formation Drought Hazards associated with the industrial or natural environment and with transport routes (missiles, offsite fire, movement of toxic or corrosive gases) Lightning and Electromagnetic interferences 2

4 Design Basis Earthquake 0.25 g at 33 Hz 3

5 Explosion Pressure Wave The standard Explosion Pressure Wave (EPW) is applied in the design of the following buildings: Reactor Building (inner containment and outer containment) Fuel Building Safeguard Buildings including the main steam / feedwater valve compartments. Nuclear Auxiliary Building Radioactive Waste Processing Building Diesel Buildings Service Water Pump Buildings (site specific) Connecting ducts to and from service water pump buildings (site specific) The safety objectives are: To avoid abnormal radiological releases To bring the reactor to a safe shutdown state if it is in power operation Single failure and preventive maintenance are not assumed The stability in case of explosion pressure wave is ensured 4

6 Airplane Crash Protection 5

7 Airplane Crash Protection Design Bases (1/2) The approach for protection against aircraft crash is deterministic. Protection is achieved by designing safety-classified buildings for aircraft crash loads and by geographical separation of safety-classified systems. Load cases are associated with different types of planes Light aircraft weighting less than 5.7 tons, Military Aircraft Commercial aircraft Stability of buildings Vibration or shock caused on safety related equipment Perforation of the structures 6 Scabbing of the structures

8 Airplane Crash Protection Design Bases (2/2) Protection of the plant is assured by the existence of a physical barrier called the airplane crash (APC) shell and by the geographical separation of redundant systems Buildings protected by design The Reactor Building, Fuel Building, Safeguard buildings 2 and 3 are protected by design The protection requirement is provided by the APC shell, consisting of a bunker designed to withstand aircraft crash load scenarios. It is made of reinforced concrete and covers the Reactor Building, the divisions 2 and 3 of the Safeguard Buildings and the Fuel Building A LOCA inside the Reactor Building must not be induced (and a fortiori no severe accident) so containment isolation is not required 7 Buildings protected by geographical separation The safeguard buildings 1 and 4 and the diesel buildings and the service water pump buildings are protected against the design extension aircraft crash by geographical separation. At least one redundancy stays available after the aggression The safeguard buildings 1 and 4, and the diesel buildings are protected by the reactor building located in between The loss of all diesel generators due to fire induced fumes can be ruled out due to the 2 by 2 arrangement on opposite sites of the Reactor Building and the associated distance of the air intakes

9 Protection against Airplane Crash Provision are made for an impacting large passenger or military aircraft A thick shell of highly reinforced concrete protects the inner walls and the inner structures from the direct impact and resulting vibrations Reactor building Reinforced Concrete Shield Building Outside Annulus 1,8 m BASEMAT Prestressed Concrete Containment Building Steel Liner Inside Fuel building Two of the safeguards buildings 8

10 AIRPLANE SAFEGUARD division 1 SAFEGUARD division 2 EFWS ESWS CCWS SIS MSL MFW EFWS ESWS CCWS SIS Control Room IRWST CORE CATCHER Airplane Crash EFWS ESWS CCWS SIS MSL MFW SAFEGUARD division 3 EFWS ESWS CCWS SIS SAFEGUARD division 4 EBS Fuel Pool FPCS Airplane Crash protected 9

11 Robustness of the EPR TM reactor to a Fukushima like event 10

12 EU Stress tests Self assessments National Reports Peer Reviews June 1 st Launch Sept. 15 National status Reports Oct. 31 Final Operators Reports Common approach of all European Nuclear Safety Authorities Specifications prepared by WENRA and adopted by ENSREG 3 steps : operators, national authorities, European peer reviews 14 countries, 143 reactors, exceptional mobilization Transparent process Dec. 9 Status Report to the Council Dec. 31 Final national Reports April 25 ENSREG Report June 2012 Report to the Council 2013 : National action plans follow-up by ENSREG WENRA Western European Nuclear Regulators Association ENSREG European Nuclear Safety Regulators Group + Commission The implementation of the ENSREG recommendations joins in the continuity of the dynamics of safety in Europe 11

13 Performance of a complementary assessment: ENSREG Specifications Based on deterministic approach, irrespective of the probability of the loss of line of defense, Consider a sequential loss of the lines of defense and a long duration of events, Take into account the entire affected plant (reactor, fuel storage), The objective is to identify weak points and cliff-edge effects, for each of the following extreme situations Extreme situations to be considered: Extreme earthquake, flooding (consequential or linked event should be considered (fire, load drop for earthquake, bad weather conditions for flooding )), Total loss of power sources, total loss of ultimate heat sink, combination of both, Severe accident, notably in case of the two previous situations Identification of: Weak points, cliff-edge effects. A particular attention should be paid to confinement failure risk, Provisions to cope with them, notably to improve the grace period before cliffedge effects These provisions should be considered as hardened equipments 12

14 Robustness of the EPR TM reactor to a Fukushima like event The resistance of the EPR TM reactor to a Fukushima like event was assessed by analyzing the consequences of the external hazards beyond those taken into account in the design basis As no guidance existed to define which beyond-design basis external events are to be considered and what criteria shall be met, the Fukushima load cases were taken as input data in this assessment: Earthquake: ~ 0.5 to 0.6 g peak ground acceleration at site Tsunami / flooding: wave height of 4 m above the platform level The analysis shows (see the next slides) that the EPR TM reactor would withstand such an event and that a Fukushima scenario would result in a combination of : A Loss of Offsite Power (LOOP) And a Loss of Ultimate Heat Sink (LUHS) 13

15 Resistance to a beyond design earthquake The 9.0 magnitude earthquake resulted in a ~ 0.5 to 0.6 g Peak Ground Acceleration (PGA) at the Fukushima site The EPR TM reactor is designed to resist to a 0.25 g PGA earthquake at site Seismic Margin Assessments (EPR UK) have been performed and have shown the capability to withstand a 0.6 g PGA earthquake All the safety systems needed to mitigate the earthquake consequences remain capable to bring the plant to safe conditions thanks to the design margins A g PGA earthquake at site would result in a total loss of offsite power (LOOP) automatic start-up 4 Emergency Diesel Generators (EDG) loss of the main feedwater automatic start-up of the Emergency Feedwater System which would feed the SGs The decay heat would be safely removed 14

16 Resistance to a beyond design flooding (1/2) At Fukushima, the earthquake triggered a ~14 meter high tsunami which flooded the plant (up to 3-4 m water on the platform) The analysis of the impact of such a tsunami at an EPR site shows that The Safeguard Buildings, the Diesel Buildings, the Pumping Station would resist to a 4 m flooding of the site, including the dynamic effect of the wave The leak-tightness is ensured since these buildings and their doors are designed to resist to external hazards (earthquake, External Pressure Wave, ) and they comply with Physical Plant Protection requirements which provide design margins The safety systems needed to remove the decay heat remain available : EDGs, SBO-DGs, I&C and batteries, Emergency Feedwater System, However, a 3-4 m platform flooding could result In the loss of the cooling chain (possibility of debris clogging the water intake) Loss of the Ultimate Heat Sink (LUHS) The diverse cooling chain might not be affected (site dependent) 15

17 Resistance to a beyond design flooding (2/2) EDG building water-tight doors at platform level 16

18 Mitigation of LOOP + LUHS For the Reactor cooling : Decay heat removed by the SGs (EFWS pumps, SBO-DGs) 15 some < 2 hours 24 hours ~ 2 days 7 days Decay heat removed by SGs EDGs EDGs start supposed to be lost SBOs starts up SBO fuel tank refilling by on-site mobile means EFW tank refill by the refilling system EFW tank refill by off-site mobile means SBO fuel tanks refilling by off-site mobile means Dedicated water reserve EFWS tank EFWS tank Dedicated demineralized water reserve available on site to ensure a 7 days autonomy Offsite water reserves Offsite fuel and oil reserves Diesel Buildings EDG tanks SBO tanks EFWS tank EFWS tank No steaming in the containment For the Fuel Pool cooling: the 3 rd FPCS/SRU train is used for SFP cooling 17

19 Mitigation of LOOP + LUHS A large plant autonomy is thus ensured: Phase 1 Short Term : 24 h without offsite means support nor on-site mobile means and no actions outside protected buildings Phase 2 Mid Term : 7 days with onsite fixed and mobile means support (for water reserve, fuel oil and lube oil inventory) Phase 3 Long Term : unlimited with offsite support thanks to the connections for mobile means: Connections for water tank refilling Connections for fuel and lube oil tank refilling Connections for mobile power sources (to take over SBO operation) EPR: more than 7 days autonomy 18

20 ASN Complementary Safety Assessments conclusions The initial design basis features of the EPR was proved to be resistant to extreme events thanks to: Deterministic means to reduce probability of core melt events and to mitigate severe accidents in all plant states Availability of multiple lines of defense Design of the EPR buildings against severe hazards and malevolent acts providing a high degree of resistance to beyond-design basis hazards such as those that occurred in Fukushima ASN Complementary Safety Assessments conclusions highlight the EPR TM specific safety features and design to manage severe accidents: The safety objectives and the strengthened design of this type of reactor already offer improved protection against severe accidents compared to any existing operating nuclear power plant Its design in particular takes account of and incorporates measures to deal with the possibility of accidents with a core melt and combinations of hazards Furthermore, all the systems necessary for the management of accidental situations, even severe, are designed to remain operational for an earthquake or a flood as defined in the baseline safety requirements 19

21 20 From reviewing the publicly available information (e.g. regulatory bodies who have licensed the EPR TM reactor or which are about to deliver Design Certification) an INPRO assessor may conclude that the criterion CR1.1.1 on robustness of Design is met. Some examples to support this conclusion were discussed above for each evaluation parameter EP Margins of Design EP Simplicity of Design EP Quality of Manufacture and Construction EP Quality of Materials EP Redundancy of Systems Even if UR1.1 Robustness relates to level 1 of DiD, Robustness against External Hazards was treated as well in this presentation, since it not obviously identified in the INPRO assessment methodology Conclusion on CR Robustness of Design

22 Thank you for your attention 21