JSC Atomenergoproekt, Moscow, RF Combined Use of Probabilistic and Deterministic Methods in External events PSA Vladimir Morozov, Head of Safety Analysis Division Gennady Tokmachev, Chief Engineer of Safety Analysis Division, Igor Kalinkin, Head of EE Department in Safety Analysis Division JSC Atomenergoproekt, Moscow, RF

About JSC Atomenergoproekt is an engineering company, General Designer of nuclear power plants. The company developed the designs of the majority of NPPs in Russia, Eastern Europe and CIS countries. JSC Atomenergoproekt is the General Designer of the Bushehr NPP in Iran, Kudankulam NPP in India, Akkuyu NPP in Turkey. Atomenergoproekt is the General Designer and General Contractor of the Novovoronezh-2 NPP 2

About PSA division (bureau) has over 25 year experience in developing PSA for units with WWER power reactors. Operation conditions include power operation and shutdown states. At present time the scope of development include internal level 1, level 2 and external events PSA. 3

Internal events PSA aids design and operation Aid to justification of design basis Initiating events selection and categorization Provide input to categorisation of SSC Aid to optimisation of system configurations Helps to provide justification of conditions for safe operation (STI & AOT) Justification of design basis – It is supplement to deterministic analysis. Assessment may include investigation of variants and exploratory design options, sufficiency in systems’ redundancy and diversity, effectiveness in emergency and accident management measures, as well as development of reliability and availability targets for SSCs to meet safety goals, if set IE selection and categorization - probabilistic methods are used for categorization of initiating events within SAR development in terms of their frequency, one of the inputs to initiating event selection is a list of deterministic TH analyses, Depending on initiating event frequency acceptance criteria are defined in terms of fuel rod damage Input to categorization – Aid optimization Provide input to categorisation of SSC Helps to provide justification of conditions for safe operation (surveillance test intervals and average outage intervals) - Conditions for safe operation (limiting conditions for operation) specified in the technical specifications define equipment operability requirements and allowed outage times. The PSA is used to develop quantitative bases and justify limits on equipment allowed outage times, surveillance test intervals, and testing strategies. 4

Requirements of regulatory documents “It should strive to have PSA estimated value for severe BDBA frequencies less than 10-5 1/year” (NP-001-97- General provisions to ensuring NPP safety) for the whole scope of events “PSA for external events must be developed to obtain NPP accident risk assessment due to external events” (NP-064-05 Analysis of effects of natural and man-induced external events on nuclear energy objects.) Justification of design basis – It is supplement to deterministic analysis. Assessment may include investigation of variants and exploratory design options, sufficiency in systems’ redundancy and diversity, effectiveness in emergency and accident management measures, as well as development of reliability and availability targets for SSCs to meet safety goals, if set IE selection and categorization - probabilistic methods are used for categorization of initiating events within SAR development in terms of their frequency, one of the inputs to initiating event selection is a list of deterministic TH analyses, Depending on initiating event frequency acceptance criteria are defined in terms of fuel rod damage Input to categorization – Aid optimization Provide input to categorisation of SSC Helps to provide justification of conditions for safe operation (surveillance test intervals and average outage intervals) - Conditions for safe operation (limiting conditions for operation) specified in the technical specifications define equipment operability requirements and allowed outage times. The PSA is used to develop quantitative bases and justify limits on equipment allowed outage times, surveillance test intervals, and testing strategies. 5

The scope of external events analysis Extreme natural events Seismic events High winds and tornadoes Extreme air and water temperatures External floodings, fires Extreme precipitation … External man-induced events Air, road, water transportation incidents Industrial facility incidents 6

General procedure for external events analysis Is defined by national safety guide RB-021-01 “Evaluation of reactor severe core damage due to external events” (at present time under revision) It include: Events selection and screening Hazard analysis Plant walkdowns Plant response and fragility analysis (if required) Bounding or detail analysis of accident sequences based on modified level 1 models, core damage estimation. 7

Event selection and screening Development of preliminary generic list of external events Analysis of site characteristics, preliminary screening using RB-021-01 criteria A (distance – event cannot occur close to the site) ,B (inclusion – event is included in definition of another event which already have been analyzed) ,C (time – event is slow developing and plant operating personnel have enough time to prevent its consequences) At preliminary stage only deterministic criteria are used 8

Hazard analysis (seismic) Design base estimation is deterministic aimed to conservative assessment of maximum design earthquake (MRZ – once per 10 000 years) and design earthquake (PZ – once per 1000 years) according to NP-031-01 (Norms for design of seismic resistant NPP) Seismic hazard curves are developed according classical PSHA approach Along with seismic hazard response spectra is also estimated Global seismic hazard program results (http://www.seismo.ethz.ch/static/GSHAP/) and local seismological, tectonic and geological data are used to develop models for analysis 9

Hazard analysis (seismic) Aleatory uncertainties include Attenuation law variabilities Seismic source characteristics (magnitude-length) Source location inside source zone Epistemic uncertainties (require development of logic tree) Source characteristic (active/not, linear or area source, maximum magnitude determination) Selection of attenuation law type Selection of parameters for source magnitude – occurrence rate law Others 10

Example of logic tree for seismic hazard Source mechanism Maximum magnitude estimate Attenuation law Thrust, 0,2 Normal, 0,5 Strike-slip, 0,3 Max, 0,2 Ave, 0,6 Min, 0,2 ... Campbell Bozorgnia, 0,33 Boore&Atkinson, 0,33 Model А, 0,33 11

Hazard curves after logic tree quantification 12

Example of percentile and mean hazard curves 13

Example hazard curve for maximum air temperatures (Gumbel) 14

Uncertainty in hazard curve for minimum air temperatures (Weibull) 15

Plant walkdown and seismic margin evaluation (deterministic procedures) plant walkdowns in according to GIP-WWER procedures (Balakovo unit 1) Seismic margin evaluation using CDFM (conservative definition of failure margins) using EPRI NP-6041 SL1 16

Conditional failure probability (fragility) For seismic PSA – using hybrid approach IAEA TECDOC-1487 Annex 1 Kennedy, R.P., Overview of Methods for Seismic PRA and Margin Assessments Including Recent Innovations, Proceedings of the OECD-NEA Workshop on Seismic Risk, Tokyo, Japan, August 1999 Load – strength model or FORM (first order reliability methods) for others 17

Some results for EE PSA (Balakovo unit1 Novovoronezh-2 unit 1) 18

Thank you for attention ! ATOMENERGOPROEKT Thank you for attention ! 19