Version 1.0, May 2015 SHORT COURSE BASIC PROFESSIONAL TRAINING COURSE Module V Safety classification of structures, systems and components This material was prepared by the IAEA and co-funded by the European Union.

Basic Professional Training Course; Module V Safety classification of structures, systems and components INTRODUCTION TO SAFETY CLASSIFICATION Learning objectives After completing this chapter, the trainee will be able to: 1.Define the purpose of the safety classification. 2.List important general safety requirements for plant design. 3.Explain which items are important to safety. 4.Define terms items important to safety and the safety system. 5.List typical plant specific safety functions. 6.List and explain the purpose of defence-in-depth levels. 2

Basic Professional Training Course; Module V Safety classification of structures, systems and components The purpose of safety classification Design of NPPs - safety classification of structures, systems and components (SSCs) Identification and categorization of the safety functions Identification and classification of the SSC items Establish relationships between safety class and requirements for design and manufacturing commensurate to their safety significance 3

Basic Professional Training Course; Module V Safety classification of structures, systems and components General safety requirements for the plant design To control the reactivity of the reactor The capability to safely shut down the reactor and to maintain it in the safe shutdown condition To remove heat from the core To remove residual heat from the core To remove residual heat from the spent fuel storage To confine radioactive material and control operational discharges To assure that any releases are within prescribed limits To ensure protection of the workers against radiations 4

Basic Professional Training Course; Module V Safety classification of structures, systems and components Safety classification of the plant equipment 5

Basic Professional Training Course; Module V Safety classification of structures, systems and components Definitions Accident conditions Design Basis Accident 6 Deviations from normal operation that are less frequent and more severe than anticipated operational occurrences, and which include design basis accidents and design extension conditions. An accident causing accident conditions for which a facility is designed in accordance with established design criteria and conservative methodology, and for which releases of radioactive material are kept within acceptable limits.

Basic Professional Training Course; Module V Safety classification of structures, systems and components Definitions (cont.) Design extension conditions 7 Postulated accident conditions that are not considered for design basis accidents, but that are considered in the design process of the facility in accordance with best estimate methodology, and for which releases of radioactive material are kept within acceptable limits. Design extension conditions include conditions in events without significant fuel degradation and conditions with core melting. Are being used to define the design basis for safety features and for the design of all other items important to safety that are necessary for preventing such conditions from arising, or, if they do arise, for controlling them and mitigating their consequences.

Basic Professional Training Course; Module V Safety classification of structures, systems and components Definitions (cont.) Item important to safety Safety system 8 An item that is part of a safety group and/or whose malfunction or failure could lead to radiation exposure of the site personnel or public. System required to ensure the safe shutdown of the reactor or the residual heat removal from the core, or to limit the consequences of anticipated operational occurrences and design basis accidents. Safety systems are designed to mitigate the radiological consequences of the Design Basis Accidents within the prescribed limits

Basic Professional Training Course; Module V Safety classification of structures, systems and components Definitions (cont.) 9 Safety Features for DEC Item designed to perform a safety function in design extension conditions

Basic Professional Training Course; Module V Safety classification of structures, systems and components SAFETY CLASSIFICATION Learning objectives After completing this chapter, the trainee will be able to: 1.Explain when and how the safety classification should be performed. 2.List the main steps in the classification process. 3.Define terms function and design provisions. 4.List examples of design provisions. 5.List and briefly explain the three levels of severity. 6.List the categorization of functions. 10

Basic Professional Training Course; Module V Safety classification of structures, systems and components SAFETY CLASSIFICATION Learning objectives After completing this chapter, the trainee will be able to: 7.Describe three safety categories. 8.Explain how the adequacy of the safety classification should be verified. 11

Basic Professional Training Course; Module V Safety classification of structures, systems and components Safety classification 12 An iterative process: To be carried out periodically throughout the design process To be maintained and supplemented as necessary throughout the lifetime of the plant Although only SSCs classification is requested, establishing a categorization of the functions first is strongly recommended In general, the operation of several systems is needed for the accomplishment of a single function Categorization of functions gives more confidence in the correctness and consistency of the classification.

Basic Professional Training Course; Module V Safety classification of structures, systems and components Steps in the classification process 13 SSCs to be classified are all SSCs necessary to accomplish the Fundamental Safety functions as defined in SSR2/1 Req. 4. SSCs candidates for classification cannot be all captured if only systems performing the fundamental safety function for the different plant states are considered.

Basic Professional Training Course; Module V Safety classification of structures, systems and components Pre-requisites to Safety classification Prior starting the safety classification process, following inputs are necessary: − Radiological releases limits established by the Regulatory Body for operational conditions and for the different accident conditions − Plant system description − Plant states definition and categorization − Postulated Initiating Events (PIE) considered in the design with their estimated frequency of occurrence 14

Basic Professional Training Course; Module V Safety classification of structures, systems and components Pre-requisites to Safety classification (cont.) Accident analysis Application of the Defence in depth concept (which systems belong to the different levels of defence) PSA level 1 is not a strict pre-requisite for the safety Classification but needed for verification of its correctness 15

Basic Professional Training Course; Module V Safety classification of structures, systems and components Generic principle for design of NPP Use of deterministic methodologies To make risks (consequences versus frequency) acceptable: − To decrease the probability of an accident to occur − Functions to make the consequences acceptable with regard to its probability − A combination of preventive and mitigation measures 16

Basic Professional Training Course; Module V Safety classification of structures, systems and components Identification and categorization of functions Functions to be categorized are those requested to accomplish the fundamental safety functions in the different plant states Functions are derived from the fundamental Safety functions which are required to be accomplished in all plant states. The deterministic safety analysis provides information of functions to be accomplished to mitigate the consequences of the different PIEs. 17 “Function” includes the primary function and any supporting functions that are expected to be performed to ensure the accomplishment of the primary function.

Basic Professional Training Course; Module V Safety classification of structures, systems and components Generic list of Safety functions to be categorized Fundamental Safety Function Functions to be categorized for the different plant states Control of Reactivity R1 - Maintain core criticality control R2 - Shutdown and maintain core sub-criticality R3 - Prevention of uncontrolled positive reactivity insertion into the core R4 - Maintain sufficient sub-criticality of fuel stored outside the RCS but within the site Heat removal H1 - Maintain sufficient RCS water inventory for core cooling H2 - Remove heat from the core to the reactor coolant H3 - Transfer heat from the reactor coolant to the ultimate heat sink H4 - Maintain heat removal from fuel stored outside the reactor coolant system but within the site Confinement of radioactive material C1 - Maintain integrity of the fuel cladding C2 - Maintain integrity of the Reactor Coolant Pressure Boundary C3 – Limitation of release of radioactive materials from the reactor containment C4 – Limitation of release of radioactive waste and airborne radioactive material EXtra X1 –Protection and prevention against effects of hazard X2 - Protect of workers against radiation risks X3 - Limit the consequence of hazard X4 – Plant operation in accident conditions and monitoring of plant parameters X5 - Monitor radiological releases in normal operation X6 - Limits and conditions for normal operation 18 Can be used as a generic list of functions for pressurized water reactor Can be used for early classification but has to be more developed once the design is more detailed For classification purpose, those functions need to be defined for the different plant states taking into account that one single function is often accomplished by different systems, as generally requested by the Defense in depth concept.

Basic Professional Training Course; Module V Safety classification of structures, systems and components Safety significance is assessed by screening the following factors: − (1) The consequences of failure to perform the function; − (2) The frequency of occurrence of the postulated initiating event for which the function will be called upon; − (3) The significance of the contribution of the function in achieving either a controlled state or a safe state. 19 Identification and categorization of functions Practically, for each PIE, functions necessary to control or mitigate the consequences are identified and categorized. The categorization of functions is performed to reflect the safety significance of every function. 3 levels of severity: high, medium and low

Basic Professional Training Course; Module V Safety classification of structures, systems and components 20 Categorization of functions Dose limits or acceptance criteria are used to define High, medium and low severity of consequences The severity is either assessed by calculation or derived from the accident deterministic safety analysis * Medium or low severity consequences are not expected to occur in the event of non-response of a dedicated function for the mitigation of design extension conditions.

Basic Professional Training Course; Module V Safety classification of structures, systems and components Categorization of functions (cont.) Safety category 1 Safety category 2 Safety category 3 21

Basic Professional Training Course; Module V Safety classification of structures, systems and components Example of categorization - PIE: Core melt accident 22 Fundamental Safety Function Generic functionSub Function categoryMain SSCs Confinement of radioactive material C3 – Limitation of release of radioactive materials from the reactor containment C3.1 - Heat removal from the containment 3Containment cooling system or Containment venting system + associated supporting SSCs C3.2 - Minimizing radiological releases C3.2.1 – Containment spray 3Containment spray system + associated supporting SSCs C3.2.2 – Containment Isolation 3Containment and its isolation system + associated supporting SSCs C Prevention of unfiltered leakage 3Filtered ventilation systems in auxiliary buildings + associated supporting SSCs C3.3 Containment integrity C molten core stability 3Core catcher and corium cooling system + associated supporting SSCs C Combustible gases management 3H2 recombiners + associated supporting SSCs C Prevention of direct containment heating 3Fast Primary Circuit depressurization system Containment venting system + associated supporting SSCs C Containment Depressurization 3Containment venting system + associated supporting SSCs

Basic Professional Training Course; Module V Safety classification of structures, systems and components Classification of Structures, Systems and associated Components 23 Once the safety categorization of the functions is completed, the SSCs performing functions should be assigned to a safety class. Systems are expected to be assigned to a safety corresponding to the safety category defined for the function performed.

Basic Professional Training Course; Module V Safety classification of structures, systems and components Classification of Structures, Systems and associated Components (cont.) 24 In a single system, individuals components may have different safety classes depending on: (a) The safety role performed by the component (b) The consequences of its failure to perform the safety function; (c) The frequency with which the item will be called upon to perform a safety function (d) The time following a postulated initiating event at which, or the period for which, the item will be called upon to perform a safety function. For individual components containing radioactive materials the consequences of their failure are identified with regards to the activity released and to the capability of the system to perform its intended function. Nevertheless class 3 at least is recommended.

Basic Professional Training Course; Module V Safety classification of structures, systems and components Design provisions 25

Basic Professional Training Course; Module V Safety classification of structures, systems and components Design provisions (cont.) Design features that are designed to such a quality that their failure could be practically eliminated: − The shells of reactor pressure vessels or steam generators Features that are designed to reduce the frequency of accident: − Piping of high quality whose failure would result in a design basis accident Passive design features that are designed to protect workers and the public from harmful effects of radiation in normal operation: − Shielding, civil structures and piping Passive design features that are designed to protect components important to safety from being damaged by internal or external hazards: − Concrete walls, anti whipping devices 26

Basic Professional Training Course; Module V Safety classification of structures, systems and components Classification of the design provisions SSC implemented as a design provision can be classified directly by assessing the level of severity of its failure. Safety class 1 − Any SSC whose failure would lead to consequences of ‘high’ severity Safety class 2 − Any SSC whose failure would lead to consequences of ‘medium’ severity Safety class 3 − Any SSC whose failure would lead to consequences of ‘low’ severity 27

Basic Professional Training Course; Module V Safety classification of structures, systems and components Verification of the safety classification Comparison of the classification established according to a the deterministic approach (e.g. application of the IAEA SSG-30) with insights from probabilistic safety assessment Expectation: − Consistency between the deterministic and probabilistic approaches provides confidence that the safety classification is correct − If there are differences further assessment should be carried out in order to understand the reasons for these and a final safety class should be assigned Iterative process to ensure the completeness of the classification 28

Basic Professional Training Course; Module V Safety classification of structures, systems and components Selection of engineering design rules for SSCs Three characteristics of the engineering design rules: − Capability − Dependability − Robustness 29 A complete set of engineering design rules should be specified to ensure that the safety classified SSCs will be designed, manufactured, constructed, installed, commissioned, operated, tested, inspected and maintained to appropriate and well proven quality standards. Engineering requirements give confidence that reliability of every SSC is commensurate to their individual safety significance.

Basic Professional Training Course; Module V Safety classification of structures, systems and components Selection of engineering design rules for SSCs 30 To achieve the expected reliability: − At the system level, design requirements to be applied may include specific requirements, such as single failure criteria, independence of redundancies, diversity and testability. − For individual structures and components, design requirements to be applied may include specific requirements such as environmental and seismic qualification, and manufacturing quality assurance procedures. They are typically expressed by specifying the codes or standards that apply. − Appropriate codes and standards(for pressure retaining equipment: ASME, RCC-M, etc., for I&C IEC or IEEE, etc.) and clear links between safety classes and code acceptance criteria − Regulatory limits and acceptance criteria

Basic Professional Training Course; Module V Safety classification of structures, systems and components IAEA safety standards Specific Safety requirements SSR-2/1; Safety of Nuclear Power Plants – Design Safety Guide SSG-30; Safety Classification of Structures, Systems and Components in Nuclear Power Plants General safety requirements GSR Part 4; Safety for Facilities and Activities Specific safety guide SSG-2; Deterministic Safety Analysis for Nuclear Power Plants 31 The views expressed in this document do not necessarily reflect the views of the European Commission.