2. AREVA NP EUROTRANS WP1.5 Technical Meeting Task 1.5.1 – ETD Safety approach Safety approach for EFIT: Deliverable 1.21 Stockholm, May 22-23 2007 Sophie EHSTER

3. Task 1.5.1 D1.21 Safety approach for EFIT – May 22-23 200733 AREVA NP Contents  D 1.21 progress  Main safety objectives  Consideration of safety objectives in the design  "Dealt with" events  "Excluded" events

4. Task 1.5.1 D1.21 Safety approach for EFIT – May 22-23 200744 AREVA NP D 1.21 Progress  First draft issued in February 2007:  Based on D1.20 (XT-ADS)  w/o internal review in AREVA  Second draft issued in April 2007:  Internal review in AREVA,  Interactions with ANS on EFIT design  Review from W. Mascheck  Third draft issued mid May 2007:  Final comments are welcome by end of May  Final issue in June 2007

5. Task 1.5.1 D1.21 Safety approach for EFIT – May 22-23 200755 AREVA NP Main safety objectives - 1  Application of defense in depth principle: prevention and mitigation of severe core damage are considered  Elimination of the technical necessity of off site emergency response (Generation IV objective)  EFIT is provided with a core loaded with minor actinides:  Potential consequences of severe core damage (i.e. large degradation of the core) are expected larger as the amount of minor actinides in the core increases (e.g., lower fraction of delayed neutrons, lower Doppler effect, lower critical mass).  Impact on prevention and mitigation of severe core damage

6. Task 1.5.1 D1.21 Safety approach for EFIT – May 22-23 200766 AREVA NP Main safety objectives - 2  Definition of the sub-criticality level: core shall remain sub- critical in any event. This concerns severe core damage, for which there is a smaller margin between criticality and prompt criticality (except if consequences are demonstrated acceptable),  Prevention of severe core damage: sequences leading to severe core damage shall be extremely rare. The confidence in the prevention provisions must be very high. This concerns also local melting due to the total blockage of a sub-assembly, for which design provisions have to be implemented in order to avoid the generalised core melting. The demonstration should benefit from XT-ADS operational feedback, in particular concerning corrosion and inspection issues,

7. Task 1.5.1 D1.21 Safety approach for EFIT – May 22-23 200777 AREVA NP Main safety objectives - 3  Severe core damage mitigation: has to be considered. In particular, criticality has to be excluded. This could lead to the limitation of content of minor actinides and/or to a lowering of the sub-criticality level. At the pre-conceptual design phase of EFIT, studies associated with severe core damage should focus on the determination of the main phenomena (e.g., in vessel phenomena as the impact of freezing steel on decay heat removal (paths), fuel debris floating/settling, decay heat source distribution and possible out of vessel phenomena), relevant risks and possible design provisions (core and mitigating systems),  Regarding severe core damage situations which are not mitigated by severe core damage provisions (not possible or without a sufficient confidence level), they must result from a limited number of sequences and their exclusion justified with practices similar as the ones implemented for future nuclear plants such as EPR at least.

8. Task 1.5.1 D1.21 Safety approach for EFIT – May 22-23 200788 AREVA NP Main safety objectives - 4  The demonstration that the objectives related to severe core damage prevention are met can be performed by means of Probabilistic Risk Assessment. The cumulative severe core damage frequency should be lower than 10 -6 per reactor year.  At the early stages of EFIT, the Line Of Defense (LOD) method can be used to provide adequate prevention of severe core damage : at least two "strong" lines of defense plus one "medium" LOD are requested for each sequence  Unique EFIT safety issues have to be considered such as the potential radiological impact on the public due to minor actinides and spallation products and such as the protection of workers with respect to target, accelerator and lead coolant.

9. Task 1.5.1 D1.21 Safety approach for EFIT – May 22-23 200799 AREVA NP Consideration of safety objectives in the design - 1  Safety functions are reviewed in the document and related issues are provided.  Focus on:  Reactivity control function: Core sub-critical in any situation (including core melting) Absorbing system during shutdown conditions Measurement of sub-criticality level in shutdown conditions  Power control function: High reliability of proton beam trip (2a +b), in particular provision of sufficient grace period for manual trip or diverse passive means Adequate instrumentation (in particular, for local fault detection)  Decay heat removal function: High reliability of function is requested: diversity of DRC system Need for reliability study? Risk of freezing Emergency core unloading Severe core damage mitigation

10. Task 1.5.1 D1.21 Safety approach for EFIT – May 22-23 200710 AREVA NP Consideration of safety objectives in the design - 2  Confinement function: Design strategy with regard to radiological releases management is not yet defined - Normal operation - Gas, steam, DRC secondary coolant leakage - Severe core damage - Hazards Spallation target and accelerator confinement system  Core support function: Demonstration of exclusion of large failure: - Development of methodologies considering corrosion and associated technical means: control of oxide layer, detection of corrosion, leakage - ISI with lead (opacity, temperatures, density) Capability of severe core damage provision if prevention is not sufficient

11. Task 1.5.1 D1.21 Safety approach for EFIT – May 22-23 200711 AREVA NP "Dealt with" events - 1  "Dealt with" events:  Their consequences are considered in the design  A list of initiating faults and associated sequences to be studied has been determined  Preliminary qualitative criteria on the barriers have been defined  Water ingress: Steam Generatorleakage : DBC2 Steam Generator tube rupture: DBC3 Rupture of one tube to the rupture of all Steam Generator tubes: DBC3 except if it can be demonstrated that the rupture of neighbouring tubes can be limited (loadings assessment, consideration of a possible corrosion). In this case, the rupture of all tubes is analysed as a DBC4 Steam Generator tube failure in case of thermal transients in the primary circuit: the design objective is to avoid tube failure during DBC2 and DBC3 transients

12. Task 1.5.1 D1.21 Safety approach for EFIT – May 22-23 200712 AREVA NP "Dealt with" events - 2  "Dealt with" events:  Risks associated with water ingress: Mechanical transient due to the depressurisation into the reactor vessel Water/steam interaction with primary coolant and its consequences (e.g. core compaction, structures failure) Reactivity insertion (e.g., voiding effect, moderator effect, core compaction) Draining of the primary coolant outside the reactor vessel Pressurisation of the primary building Overcooling and subsequent freezing due to steam generator overflow

13. Task 1.5.1 D1.21 Safety approach for EFIT – May 22-23 200713 AREVA NP "Dealt with" events - 3  "Dealt with" events:  List of limiting events: Leakage of main and safety vessels Excessive cooling leading to large lead freezing Large internal failure due to corrosion (depending on the consequences and the possible mitigating provisions, might be analysed as a severe core damage) Large reactor vessel failure due to corrosion (depending on the consequences and the possible mitigating provisions, might be analysed as a severe core damage) Total Instantaneous Blockage

14. Task 1.5.1 D1.21 Safety approach for EFIT – May 22-23 200714 AREVA NP "Excluded" events  "Excluded" events: their consequences are not addressed in the design  The exclusion has to be justified:  Physically impossible  “Practical elimination” by adequate design and operating provision  Preliminary list:  Large reactivity insertion due to: Core support failure (including corrosion as initiator) Core compaction capable to approach criticality Voiding capable to approach criticality (e.g., caused by large gas or steam ingress) Large fuel loading error  Primary system damage due to large load drop (e.g. during handling operations)  Large water ingress in the primary circuit (if consequences cannot be mitigated)  DBC combined with complete and timely unlimited loss of decay heat removal function (i.e. Secondary Cooling System, DRC)