Complementarity of deterministic and probabilistic approaches for safety assessment of French EPR design Patricia DUPUY, Gabriel GEORGESCU International Conference on Topical Issues in Nuclear Installation Safety: Safety Demonstration of Advanced Water Cooled Nuclear Power Plants June, 6-9th 2017 - Vienna

French context EPR FA3 French NPPs Safety case Current fleet: 58 GEN II PWRs GEN III EPR under construction at Flamanville Safety case Mainly deterministic bases, supplemented by probabilistic approach Important place of the probabilistic approach in the safety decisions EPR FA3: complementary use of deterministic and probabilistic approaches at each of the preoperational phases since early design A supprimer : and one regulator Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 2

French context “Technical guidelines” for plants generation III in France (endorsed by French Safety Authority in 2004) Significant reduction of the core damage frequency (CDF) compared to current fleet, guidance value: CDF ≤ 10-5/year Significant reduction of the radioactive releases in accidents Severe accident situations that could lead to large early radioactive releases must be “practically eliminated” PSA requested since the early design stage PSA can be carried out in several steps: Simplified assessment at the conceptual stage More detailed studies during the engineering phases A supprimer : and one regulator Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 3

PSAs carried out and reviewed in several steps Simplified level 1 PSA (internal events) Simplified level 1+ PSA (investigating the containment and some severe accident features) Safety options basic design More detailed level 1/1+ PSAs PSA for the spent fuel pool Studies supporting the “practical elimination” Methodologies for level 2 and hazards PSA Application for construction (PSAR) Updated level 1 PSA(internal events) Simplified PSAs for internal fire, flooding and explosion Assessment for long LOOP/LUHS induced by extreme winds - Simplified seismic study Semi-quantitative studies for external hazards Level 2 PSA (internal events) Application for operating license (SAR) Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 4

PSA developments: challenges and insights Some challenges, in particular at the early design stage Lack of design information and data Emergency operating procedures not available, Lack of specific reliability data  Scope /level of details of PSAs adapted to available information  “Iterative process” between deterministic studies and PSAs  PSAs limitations taken into account in the decision making process However many PSA insights for EPR design Assessing the overall risk and the safety level compared to GEN II Supporting the choice of design options Adjusting the set of design extension conditions Contributing to the « practical elimination » justifications Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 5

Reviews performed by IRS[N] IRSN highly involved in the safety assessment of EPR design For both deterministic demonstration and PSA aspects At each of the preoperational phases Close connection between the IRSN teams in charge of DSA and of PSA reviews  Technical exchanges, mutual benefits As for the current fleet, IRSN developed its own EPR level 1 PSA  Valuable knowledge, sensitivity analyses Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 6

Main PSA insights at the design phases of EPR-FA3 Check that the risk complies with the safety probabilistic targets PSA contributed from the early design phase to implement design improvements, in particular to add diversifications E.g.: two additional diversified diesels generators, diversified cooling of two low pressure injection pumps, diversified cooling chain for containment heat removal system, third train on the cooling system of the spent fuel pool... Internal hazards: results of simplified PSA globally confirmed the robustness of EPR design - PSA used to investigate particular rooms and scenarios, a few design evolutions highlighted – PSAs to be updated External hazards: PSAs less mature to highly contribute to the decision process: efforts to develop external hazards PSAs should be strengthened Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 7

Design extension conditions without core melt (RRC-A) RRC-A = Risk reduction category A = multiple failures DEC conditions not covered by DBA Need for particular RRC-A features to reduce the associated risk Deterministic safety analysis Level 1 PSA Identification of RRC-A features RRC-A conditions Safety analysis of RRC-A conditions Methodology To justify the appropriate design of RRC-A features Combination of probabilistic and deterministic approaches Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 8

Design extension conditions without core melt (RRC-A) Identification in PSA1 of « potential RRC-A features » Identification of “functional sequences” (FS) FS = group of sequences crediting a given RRC-A feature Determination of the list of plant RRC-A features If CDF(FS without RRC-A feature) > threshold (10-8/a.r), then RRC-A feature necessary Identification of RRC-A features Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 9

Design extension conditions without core melt (RRC-A) Identification in PSA1 of « potential RRC-A features » Identification of “functional sequences” (FS) FS = group of sequences crediting a given RRC-A feature Determination of the list of plant RRC-A features If CDF(FS without RRC-A feature) > threshold (10-8/a.r), then RRC-A feature necessary Identification of RRC-A features Within the functional sequences, selection of envelope sequences (TH/neutronic criteria) RRC-A conditions Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 10

Design extension conditions without core melt (RRC-A) Identification in PSA1 of « potential RRC-A features » Identification of “functional sequences” (FS) FS = group of sequences crediting a given RRC-A feature Determination of the list of plant RRC-A features If CDF(FS without RRC-A feature) > threshold (10-8/a.r), then RRC-A feature necessary Within the functional sequences, selection of envelope sequences (TH/neutronic criteria) For the envelope sequences: deterministic safety analysis and TH/neutronic calculations Identification of RRC-A features RRC-A conditions Safety analysis of RRC-A conditions Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 11

Design extension conditions without core melt (RRC-A) Deterministic safety analysis Level 1 PSA Identification of RRC-A features RRC-A conditions Safety analysis of RRC-A conditions Insights from the RRC-A methodology Systematic relevant approach to identify RRC-A features necessary to cope with RRC-A conditions and to verify their appropriate design Iterative process however necessary (preliminary PSA not enough detailed) Evolution of the methodology defined by the designer in view of the new EPR model (same objectives but with less dependence on the level 1 PSA achievement) Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 12

Practical elimination Severe accident sequences that could lead to large early radioactive releases must be “practically eliminated” (Technical Guidelines) Situation physically impossible? Situation extremely unlikely to arise, with a high degree of confidence? Situation considered as “practically eliminated” YES NO Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 13

Practical elimination Situation physically impossible? Situation extremely unlikely to arise, with a high degree of confidence? Situation considered as “practically eliminated” Case-by-case analysis Deterministic and probabilistic considerations Probabilistic approach applicable for some types of situations PSA scope, uncertainties and limitations to be considered No probabilistic “cut-off” value Deterministic demonstration always requested Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 14

Practical elimination Situation physically impossible? Situation extremely unlikely to arise, with a high degree of confidence? Situation considered as “practically eliminated” For EPR FA3, PSA1 used for: - Core melt accidents with containment bypass (rupture outside containment) Fast boron dilutions Fuel melting in the pool Insights of PSA1 results and methods for EPR FA3: Deep investigation of all initiating events and sequences Identification of all the features involved in the sequences Design and operational features improvements defined (signals, isolation devices, alarms …) Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 15

In some cases to point out the need for design improvements CONCLUSION Challenges related to the development and use of PSAs for the EPR new built especially at the early design stage  need to adapt to the available information and to be aware of PSA limitations However, PSAs have provided useful insights for EPR FA3 at each of the preoperational phases To confirm the design In some cases to point out the need for design improvements Complementarity of deterministic and probabilistic approaches for EPR-FA3 design – P. DUPUY – June 2017 16