1. TRAMPUS Consultancy Virtual Defense-in-Depth Concept in RPV Integrity Assessment P. Trampus trampusp@trampus.axelero.net 1st Hungarian-Ukrainian Joint Conference on Safety-Reliability and Risk of Engineering Plants and Components Miskolctapolca, Hungary, 11 – 12 April 2006

2. TRAMPUS ConsultancyContent Defense-in-depth concept RPV damage RPV integrity assessment Need for integrity demonstration –Status of our knowledge –Regulatory framework Virtual defense-in-depth concept

3. TRAMPUS Consultancy Defense-in-Depth Concept (classical definition) Defense-in-depth is an element of the reactor safety philosophy It employs successive compensatory measures to prevent/control accidents or mitigate damage if a malfunction or accident occurs at a nuclear facility Defense-in-depth ensures that safety will not be wholly dependent on any single element of design, construction, maintenance, or operation

4. TRAMPUS Consultancy Defense-in-Depth Concept (new definition) Scenario Defense-in-Depth Design Defense-in-Depth Process Defense-in-Depth PSA Risk management program Accident prevention strategies Accident mitigation strategies Barrier-Defense-in-Depth Inherent safety features Engineered safety features Regulatory requirements Management/operation oversight Plant performance monitoring Technical Specifications

5. TRAMPUS Consultancy Mechanical stress Thermal stress Low RPV wall temperature Irradiation damage Impurities Internal pressure RPV wall overcooling Low fracture toughness Crack instability Crack Initiating event Fast neutron fluence High stress intensity factor Potential RPV Failure

6. TRAMPUS Consultancy RPV Integrity Assessment Fitness-for-purpose for the entire service life has to be demonstrated –primary circuit integrity, and –core cooling Circumstances leading to brittle fracture have to be assessed –energy requirement of ductile failure is far greater than that in brittle mode Proper assessment can provide a balance between safety and cost-effectiveness

7. TRAMPUS Consultancy Why to Demonstrate RPV Integrity? RPV failure is not included in design basis RPV has no redundancy Knowledge basis of integrity assessment Regulatory framework Design, manufacturing and operation must provide the safety guarantee

8. TRAMPUS Consultancy Further Research Needed Understanding radiation damage mechanisms (including thermal annealing and re-embrittlement) Lifetime prediction based on accelerated irradiation experiments (flux effect) Ductile-to-brittle transition Use of real fracture toughness data instead of Charpy impact test data NDE reliability

9. TRAMPUS Consultancy Lack of Comprehensive Regulation F RPV < 10 -7 /y (probabilistic) Comprehensive systems (deterministic) –Basis Safety Concept (Germany) –Incredibility of Failure (UK) –ASME (US) Paks NPP case –Regulation of 60s (Russian code system) –No significant development (but impact of Loviisa NPP!) –Concept of the new Hungarian regulation (guidelines) –Service life extension

10. TRAMPUS Consultancy Virtual Defense-in-Depth Pillar –Conceptually distinct safety argument Element –Discrete and significant item within a given safety case pillar Multiple arguments vs. multiple barriers (analogy with defense-in-depth) Any weakness in one pillar compensated by strength of the other one

11. TRAMPUS Consultancy Virtual Defense-in-Depth Pillar 1 Pillar 2 Pillar 3 Pillar 4 Element 1 Element 2 Element 1 Element 2 Element 4 Element 2 Element 3 Element 4 Element 3 Element 1 Element 3 Element 2 Element 3 Element 4 Scheme of Virtual Defense-in-Depth

12. TRAMPUS Consultancy RPV Structural Integrity Interpolation/ Extrapolation of Experience Functional Testing Lifetime Assessment Forewarning of Failure Establishment of QA System Operational Limits Hydrotest Supported by Acoustic Emission Surveillance Program In-service Inspection Independent Experts Surveillance Program Event Analysis Operating Experience Preparation to Unexpected Nondestructive Examinations Fracture Mechanics Virtual Defense-in-Depth Applied to RPV Integrity