ANTICIPATED ANALYSIS OF FLAMANVILLE 3 EPR OPERATING LICENSE - STATUS AND INSIGHTS FROM LEVEL 1 PSA REVIEW Gabriel Georgescu, Patricia Dupuy and Francois Corenwinder Institute for Radiological Protection and Nuclear Safety (IRSN) Fontenay aux Roses, France PSA2015, April 26-30 2015, Sun Valley, ID, USA Presented by Gabriel Georgescu
Summary Introduction EPR design IRSN review of updated FA3 Level 1 PSA Use of PSA during EPR design Conclusion 2/19
Introduction The first generation III reactor in France (EPR) is under the final phase of construction at Flamanville (EPR-FA3) The creation authorization was granted by the French Nuclear Safety Authority (ASN) in April 2007 The plant operator (EDF) recently send to the Safety Authority the request for operating license of this new reactor Taking into account the difficulties to assess a new evolutionary design in a rather short term, most of the safety related subjects were already analyzed by IRSN, in the frame anticipated examination of the operating license request 3/19
Introduction For the EPR reactor, PSA has been developed and used from the beginning of the design Developed by AREVA and then by EDF Reviewed by IRSN IRSN develops also in-house EPR PSA tool for safety assessment and review of EDF EPR PSA For early design assessment, several design improvements where based also on the PSA insights (examples given in the following slides) Later on, the PSA was extensively used as a complement of deterministic methods, for many other purposes (summary presented in the following slides) 4/19
EPR Design Tight double containment Diversified ultimate heat sink Built-in severe accident features External anti-aircraft crash shield Four 100% main safety system trains, physically separated Four safety electrical trains including two series of diversified Diesel generators High quality human-machine interface, based on up to date technology 5/19
IRSN review of updated FA3 Level 1 PSA IRSN analyzed, in the frame of anticipated instruction of the application for operating license of FA3 plant, the EDF PSA studies for reactor and fuel pool Recently IRSN analyzed an updated Level 1 PSA for the reactor: Internal events Internal hazards: fire, explosion, flooding External hazards: seismic and climatic events Specific studies related to practical eliminated sequences: boron dilutions V-LOCA The studies representativeness for future PSA uses was also analyzed The results and conclusions were presented by IRSN during a dedicated meeting of French Standing Group of experts for Reactors safety (SGR) in 2014 6/19
IRSN review of updated FA3 Level 1 PSA EPR PSA comparison exercise (between Finland, USA, UK and France) performed in the frame of OECD/NEA Multinational Design Evaluation Program (MDEP) was also a valuable source of information for IRSN analysis The IRSN review of EDF EPR PSA relies additionally on the PSA developed independently by IRSN for EPR reactor General conclusion -> EDF PSA results showed that the safety objectives of EPR-FA3 reactor can be fulfilled the core damage frequency as quantified by the internal events PSA is about 5 10-7 /r.y. Technical Guidelines objective: 10-5 /r.y. for all type of initiating events 7/19
IRSN review of updated FA3 Level 1 PSA main insights Coherence with the final design The design information is still partial (ex: the information regarding the cable routings for the fire PSA) Some of the deterministic studies (design, hazards, thermo-hydraulic...) were not finalized when the PSAs were developed Mainly impacting the hazards PSA since conservative approaches and assumptions were used, the global conclusions may not change Plant design evolutions were implemented after the PSAs development Some of them being identified by the PSAs and by the subsequent analysis of IRSN sensitivity studies were provided by EDF (mainly for I&C, ventilation systems and electrical distribution systems) 8/19
IRSN review of updated FA3 Level 1 PSA main insights Availability of accidental procedures The detailed accident procedures were not available while developing the PSAs -> HRA performed based on assumptions the impact of this aspect on the PSA results could be important however as the approach used is conservative (method based on Swain screening model), the current HRA is acceptable this approach has to be complemented by a verification of the presence of the given operator strategies in the accident procedures or accident guidelines Reliability data Taken generally from existing plants operating experience and from other generic sources for new or revolutionary components, reliability studies are performed or expert opinion is used the approach is acceptable in principle the data will have to be updated based on operating experience 9/19
IRSN review of updated FA3 Level 1 PSA main insights I&C modelling I&C is modelled in PSA by using fault trees (COMPACT model) at the level of macro-components the failure probabilities of the macro-components are function of redundancy and safety classification Actuator Sensor Specific I&C Shared I&C The model is acceptable as it is simple and can take into account the dependencies between the I&C elements however IRSN considers that more functional analyses are necessary in order to verify the validity of the model accuracy of what is modelled impact of what is not modelled For some IRSN questions sensitivity studies were provided by EDF 10/19
IRSN review of updated FA3 Level 1 PSA main insights Internal hazards PSAs (internal fire PSA, internal flooding PSA and internal explosion PSA) Objective of EDF studies: to demonstrate the fulfilment of the EPR-FA3 safety objectives to highlight the design areas where further analyses and potential improvements could be investigated. The studies were developed using conservative and simplified approaches The results pointed out that the safety objectives for the EPR-FA3 reactor can be fulfilled Globally, comparing with the operating reactors, the internal hazards PSA results show that the EPR design is more robust four safety trains, geographically separated buildings However, as the corresponding deterministic studies are not all finalized, the studies have to be reviewed in order to ensure the coherence with the latest plant design and associated knowledge 11/19
IRSN review of updated FA3 Level 1 PSA main insights External hazards assessment Seismic margin analysis, developed based on SMA-PSA based method Extreme wind quantitative analysis including the long term impact on the reactor and spent fuel pool Qualitative or semi-quantitative studies for other external hazards flooding frazil ice air low temperature The studies provided by EDF are not yet enough precise to conclude, from a probabilistic point of view, that all conceivable measures have been taken to ensure that the risk induced by external hazards is sufficiently low The efforts to develop external hazards PSA shall be strengthened 12/19
Use of PSA during EPR design During the design of the EPR reactor, the PSA was used both by EDF and IRSN, as a complement of other traditional deterministic methods, for several purposes, like: Definition of Risk Reduction Categories (RRC-A) Systems design assessment Verification of practical elimination of particular situations that could lead to large or early releases Safety classification Evaluation of independency of the levels of the defense-in-depth 13/19
Definition of Risk Reduction Categories (RRC-A) The identification of RRC-A conditions is performed by using a combined deterministic/probabilistic method -> PSA is used to: Adjust the preliminary list of RRC-A conditions: identify the design features and operator which are not strictly necessary to respect the criteria of the deterministic Plant Conditions Categories studies, but which are necessary to reduce the core damage frequency. Check the appropriateness of the features (amount of risk reduction) Examples of RRC-A features o Station Blackout Diesels o Diversified ultimate heat sink o Feed and Bleed procedure o Fast cooldown in case of LOCA without HPSI o Third spent fuel pool cooling train 14/19
Systems design assessment The PSA was used, as a complement of the deterministic analysis for the EPR systems to : assess the system reliability assess the system importance for the safety identify the safety important contributors: component failure modes, CCF, human errors, dependencies (functional, hazards ) check the sufficiency of the level of redundancy and diversification compare different design options Examples of design improvements (PSA informed) o Diversified SBO Diesels o Diversified LPSI pumps cooling o Third Spent fuel pool cooling train o Ventilation enhancements o I&C enhancements 15/19
Verification of practical elimination of particular situations that could lead to large or early releases EPR Technical guidelines: Accident situations with core melt which would lead to large early releases have to be practically eliminated : if they cannot be considered as physically impossible, design provisions have to be taken to design them out. core melt under high pressure and direct containment heating fast reactivity accidents (boron dilution) containment steam explosions core melt accidents with containment bypass hydrogen detonation fuel melt in the spent fuel pool The containment bypass study allows concluding that the frequency of core melt sequences with containment bypass is residual (about 10-8 /r.y.). The heterogeneous dilutions study results showed that the practical elimination of these sequences may be achieved (about 10-8 /r.y.). However, for both studies, complements are needed in order to ensure, in particular, the coherence with the final design 16/19
Safety classification Taking into account the safety functions they have to fulfill, a safety classification is defined for the systems and the components to ensure in a systematic way the coherence between the safety importance of the components and the component requirements quality, redundancy, surveillance (operating tests ) The safety classification is mainly based on deterministic approaches PSA provides, as a complement, useful insights to verify or complete this classification considering the importance of the systems/components for the CDF PSA was mainly used for the identification of RRC-A features that should be safety-classified 17/19
Evaluation of independency of the levels of the defense-in-depth The design options of the systems should comply with the principle of independency of the different defense-in-depth levels If a system (or part of it) is required at different levels a particularly deep design analysis should be performed considering the accident sequences in which the system is involved deterministic analysis has been completed by probabilistic verification for the sequences under consideration Example: The low pressure safety injection and the residual heat removal are ensured by the same system at EPR Flamanville an analysis has been performed in order to check that in case of a break on the system, sufficient safety injection means are still available to cope with the accident 18/19
Conclusions For the EPR Reactor, the PSA was developed from the beginning of the design In the frame of the EPR-FA3 project, EDF provided PSA for the reactor and for the spent fuel pool, covering the internal events, as well as the internal and external hazards of significant impact The EPR PSA results, even they still preliminary, show globally the safety improvement of this type of reactor compared with the previous generation 19/19