NOT PROTECTIVELY MARKED Page No.: i / iii REDACTED PUBLIC VERSION HPC PCSR3 – Sub-chapter 17.2 – Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- 100098 and Optioneering in the Initial EPR Design

NNB GENERATION COMPANY (HPC) LTD

REDACTED PUBLIC VERSION HPC PCSR3: CHAPTER 17 – COMPLIANCE WITH ALARP

SUB-CHAPTER 17.2– DEMONSTRATION OF RELEVANT GOOD PRACTICE AND OPTIONEERING IN THE INITIAL EPR DESIGN

{ PI Removed }

APPROVED

© 2017 Published in the United Kingdom by NNB Generation Company (HPC) Limited, 40 Grosvenor Place, Victoria, London SW1X 7EN. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, including photocopying and recording, without the written permission of the copyright holder NNB Generation Company (HPC) Limited, application for which should be addressed to the publisher. Such written permission must also be obtained before any part of this publication is stored in a retrieval system of any nature. Requests for copies of this document should be referred to NNB Generation Company (HPC) Limited, 40 Grosvenor Place, Victoria, London SW1X 7EN. The electronic copy is the current issue and printing renders this document uncontrolled.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: ii / iii REDACTED PUBLIC VERSION HPC PCSR3 – Sub-chapter 17.2 – Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- 100098 and Optioneering in the Initial EPR Design

APPROVAL SIGN-OFF:

{ PI Removed }

DOCUMENT CONTROL

{ PI Removed }

REVISION HISTORY

{ PI Removed }

Text within this document that is enclosed within brackets {…} is Sensitive Nuclear Information, Sensitive Commercial Information or Personal Information and has been removed.

APPROVED

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: iii / iii REDACTED PUBLIC VERSION HPC PCSR3 – Sub-chapter 17.2 – Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- 100098 and Optioneering in the Initial EPR Design

TABLE OF CONTENTS

1. INTRODUCTION ...... 1 2. INITIAL EPR DESIGN PROCESS ...... 2 2.1. ORGANISATIONS INVOLVED IN INITIAL EPR DESIGN AND LICENSING ...... 2 2.2. MAIN PHASES OF THE INITIAL EPR PROJECT ...... 4 2.3. PRODUCTION OF “TECHNICAL GUIDELINES” ...... 5 2.4. REVIEW AND VALIDATION OF EPR DESIGN OPTIONS ...... 6 2.5. SUMMARY OF R&D WORK UNDERPINNING THE EPR DESIGN .. 10 3. CODES AND STANDARDS USED FOR EPR DESIGN ...... 11 4. INCORPORATION OF EXPERIENCE FEEDBACK INTO THE INITIAL EPR DESIGN ...... 12 5. COMPARISON OF EPR DESIGN WITH NATIONAL AND INTERNATIONAL STANDARDS ...... 13 6. OUTCOME OF OPTIONEERING PROCESS – SAFETY SYSTEMS/STRUCTURES ...... 14 6.1. GENERAL DESIGN PRINCIPLES ...... 14 6.2. RESULTS OF DESIGN OPTIMISATION ...... 15 7. DOSES TO WORKERS IN ACCIDENTS ...... 24 8. OPTIMISATION OF DOSE TO WORKERS AND THE PUBLIC IN NORMAL OPERATION ...... 25 8.1. MINIMISATION OF DOSE TO WORKERS...... 25 8.2. DOSE TO MEMBERS OF THE PUBLIC IN NORMAL OPERATION ...... 27 9. USE OF PSA STUDIES IN THE EPR DESIGN ...... 28 10. CONCLUSIONS ON INITIAL EPR DESIGN REGARDING ALARP .. 29 11. REFEREAPPROVEDNCES ...... 31

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 1 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

SUB-CHAPTER 17.2 - DEMONSTRATION OF RELEVANT GOOD PRACTICE AND OPTIONEERING IN THE INITIAL EPR DESIGN

1. INTRODUCTION

This sub-chapter summarises how the initial EPR design was established with the aim of reducing the risks posed to workers and members of the public.

Firstly, the relevant good practice and standards applied in the initial EPR design process are described, followed by a comparison against national and international standards. Then the design optioneering process carried out in France and Germany between 1987 and 2006 to develop the initial EPR design, and the design review carried out by independent safety experts on behalf of the French and German safety authorities are described.

In addition, this sub-chapter presents the outcome of the design optioneering process in terms of the principal design options that were selected and rejected to achieve a balanced design that minimised risk to workers and the public, whilst achieving practical constructability and a cost- effective design. The rationale for the evolution from the initial design, and the improvements from former designs, are explained together with the reasons why certain features were selected and others rejected.

The Hinkley Point C (HPC) EPR design is derived from this initial EPR design following an As Low As Reasonably Practicable (ALARP) process as outlined in Sub-chapter 17.3.

This sub-chapter is organised as follows:

 Section 2 describes the review of the experience of the EPR designers and a summary of the review and assessment process applied to the design including a summary of the Research and Development (R&D) effort underpinning the EPR design.

 Section 3 describes the review of the design codes used in the initial EPR design and the HPC design (reference is made to Sub-chapter 3.8).

 Section 4 describes how the operational feedback from French and German plants was incorporated in the initial EPR design.

 Section 5 describes the assessment of the EPR design against national and international standards.

 Section 6 describes the optioneering of safety systems and structures protecting against accidentalAPPROVED release of radioactivity.  Sections 7 and 8 describe the optimisation of the initial EPR design to minimise doses to workers and the general public due to plant operation in normal, fault and hazard conditions.

 Section 9 describes the role played by the Probabilistic Safety Assessment (PSA) in achieving an initial EPR design which minimises risk.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 2 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

 Section 10 presents the conclusion that, although formal principles of ALARP were not applied as an integral part of the initial EPR design, the process followed was analogous to the formal UK ALARP approach.

2. INITIAL EPR DESIGN PROCESS

The EPR is a Generation 3+ Pressurised Water Reactor (PWR) design developed by the Nuclear Power International (NPI) - now AREVA NP - a joint subsidiary of Framatome and Siemens, using experience gained by EDF, the German Utilities, Framatome and Siemens in the design, manufacturing, construction, and operation of PWRs (corresponding to over 1,000 reactor-years of operation). The reactor has been designed to meet safety specifications developed by the French Nuclear Regulatory Authority (ASN) as set down in the Technical Guidelines (TG) [Ref. 1]. These guidelines were developed following an extensive optioneering process, carried out in France and Germany between 1987 and 2000, on the design of a Generation 3 PWR suitable for construction in Europe in the 21st century. The outcome of the optioneering exercise was reviewed by independent safety experts from several European Countries and the United States of America (USA), on behalf of the French and German regulatory authorities.

A description of the design development and design review process and the organisations involved is given below.

2.1. ORGANISATIONS INVOLVED IN INITIAL EPR DESIGN AND LICENSING

The three main types of organisations involved in the design and licensing process of the initial EPR design have been the design organisations, the French and German Regulators or safety authorities and the bodies appointed to provide technical support to the safety authorities. A description of these bodies and their roles is given below. The organisational arrangements are shown in Sub-chapter 17.2 - Tables 1 and 2.

2.1.1. Design Organisations

The EPR design organisations consist of reactor vendor and utility companies from France and Germany.

The EPR project began in 1987 when the vendor companies Framatome and Siemens began co-operation to develop and commercialise a common PWR design aimed at the international export market. The aim of the collaboration was to pool the experience of the two companies in order to share the huge effort involved in developing a new reactor design. The companies founded a joint subsidiary company NPI to lead the work. Within a short time French and German electricalAPPROVED utilities had joined the project, which rapidly replaced other reactor development programmes underway in France and Germany. The new reactor design was renamed EPR.

NPI (now AREVA NP) led the organisation for the EPR design from 1990 up to the end of the Basic Design Optimisation Phase (BDOP) in 2000. In 2003, AREVA NP was awarded the supply contract for the Olkiluoto 3 (OL3) EPR in Finland, under a turnkey scheme, and developed the detailed design.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 3 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

When the detailed design phase for Flamanville 3 (FA3) began (after the BDOP), EDF, in its role as Architect Engineer for EPR power stations constructed in France, led the detailed design effort, in co-operation with AREVA NP and SOFINEL (a joint subsidiary of EDF and AREVA NP).

2.1.2. Safety Authorities

In 1989 the French and German Nuclear Safety Authorities (ASN and BMU) created a joint Safety Directorate (DFD) to oversee the EPR project. Co-operation agreements were signed at the same time between the French and German technical support organisations (IRSN and GRS), and between the independent safety advisory groups supporting both regulators (the GPR in France and the RSK in Germany).

At that time, the French and German safety authorities were as follows:

 French Nuclear Installations Safety Directorate. This body is attached to the Ministries for Industry, for Health and for Environment. Its main duty is to conduct or monitor the regulatory procedures as required under the Basic Nuclear Installation Decree (11 December 1963).

 German Federal Ministry for Environment and Reactor Safety (BMU).

2.1.3. Bodies providing Technical Support to National Safety Authorities

During the evaluation and assessment of the EPR design, the ASN was supported by the following organisations:

 The Institute for Nuclear Safety and Radioprotection (IRSN, formerly IPSN). The role of the IRSN, which consists of 1500 professional scientists and engineers, is to provide technical support to the ASN in relation to reactor safety and licensing and to conduct analytical studies, research and other work relating to nuclear safety on behalf of ministerial departments and interested organisations. Results of the IPSN / IRSN studies are submitted to the Standing Group for Nuclear Reactors (GPR) (see below) and / or to the ASN.

 The Central Committee for Pressure Vessels (CCAP, Article 26 of Decree 99-1046 of 13 December 1999 concerning pressure vessels) is a consultative organisation. It comprises members of the various administrations concerned, persons chosen for their particular competence and representatives of the manufacturers and users of pressure vessels and of the relevant technical and professional organisations.

 For particular supervision of the more important pressure vessels in nuclear installations, the CCAP set up a Standing Nuclear Section (SPN), the role of which is to issue recommendations on application of pressure vessel regulations to the main Nuclear Steam APPROVEDSupply Systems (NSSS).  The GPR is an advisory body established by the French Minister of Industry, to support the French regulatory authority. It consists of 30 professional scientists and engineers from France, other European countries, and members of French Safety Authorities and advisory bodies, who are specialists in the fields of safety, construction, commissioning and operation of nuclear reactors.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 4 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

In Germany, BMU was supported by the Gesellschaft für Anlagen und Reaktorsicherheit (GRS) which plays the same role as the IPSN / IRSN in France, and the Reaktor Sicherheitskommission (RSK) which plays the same role as the French GPR.

After the completion of the Basic Design Phase of the EPR in 1998, BMU withdrew from the EPR design evaluation project. However, GRS and IRSN carried on with their joint review work, and experts from Germany were still involved as invited members of the GPR, particularly in the definition of the TG.

2.2. MAIN PHASES OF THE INITIAL EPR PROJECT

The phases of the initial EPR design process are summarised in Sub-chapter 17.2 - Table 3 and described below.

In 1985, the REP 2000 research programme was launched in France to develop an evolutionary design for the next generation of PWRs, taking the N4 plant series (Chooz 1&2, Civaux 1&2) as a starting point, which was launched by EDF, CEA and Framatome. Studies were carried out under REP 2000 on the design of key equipment and phenomena such as the fuel, core, safeguards systems, (Instrumentation and Control (I&C) and Human-Machine Interface (HMI), severe accidents, etc.).

In 1987, Framatome and Siemens began co-operation on a project to develop a next generation PWR aimed at the international market: the “Common Product”. In 1989 after NPI was created, the different existing development programmes (“REP 2000”, “Common Product” and Siemens and German utilities “Plannung Auftrag”) were merged into a wider project (EPR Project) to design and license the next generation of Nuclear Power Plants (NPPs) for construction in France and Germany. The development of this model was based on design, construction and operating experience of the French N4 and German KONVOI plants. Contacts were established with the French and German safety authorities. Both authorities responded positively and the French safety authority specified its initial views on possible improvements that could be introduced in the design of future NPPs [Ref. 2].

In 1993, NPI submitted a conceptual design specification (Conceptual Safety Features Review File or CSFRF) for EPRs to the French and German safety authorities.

In the period 1993 to 1995 the safety authorities, supported by IPSN / GPR and GRS / RSK, carried out a detailed assessment of the EPR design specification, and requested certain enhancements and changes. The outcome was an updated design specification (Main Feature File (MFF)) which presented the detailed design requirements for the EPR plant and the rationale for the options chosen.

The Basic Design studies started in early 1995. In 1997 a Basic Design Report (BDR) was issued and formed the first version of the EPR preliminary safety report.

Further work was carried out in the 1997-1999 period to improve and optimise the design and the investmentAPPROVED costs within the fundamental design specification, resulting in an updated BDR (BDOP). BMU withdrew from the joint project during this period.

Subsequently, in the period 1999-2001, there was a further Post BDOP, in which further design consolidation took place, particularly with regard to radiation protection of workers and environmental emissions.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 5 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

In 2000 the GPR adopted the TG [Ref. 1], which set down design principles for future PWRs that would be acceptable for construction in France. These TGs define the initiating events that would have to be addressed within the design basis for new PWRs, and defined certain multiple failure sequences and core melt sequences that had to be considered in the design. The TGs also included requirements for design against external hazards. The functional requirements of safety systems and principles for their safety classification were stated, including assumptions that needed be made with regard to single failures, and the equipment unavailability due to maintenance.

Following issue of the TGs, further enhancements were made to the EPR design, and three further updates were produced to the EPR safety report.

In Finland, following a call for tenders by Teollisuuden Voima Oyj (TVO) for the Finland 5 Project, the EPR was selected for construction, and a contract signed in December 2003, with AREVA NP as the turn-key supplier of a plant to be constructed on the Olkiluoto site. Following the preparation by the Consortium (AREVA NP / Siemens) of the relevant technical data, the application (Preliminary Safety Analysis Report (PSAR) and related documentation) for a Construction Licence for the OL3 EPR, was submitted by the utility TVO in early January 2004. The Finnish Safety Authority (STUK) issued its statement and its safety evaluation on 21 January 2005, and a Construction Licence was granted in February 2005.

During the detailed design phase, detailed design modifications on both projects (in France and Finland) were the subject of discussions between AREVA NP and EDF.

In 2005, EDF applied for a license to construct the first French EPR at the Flamanville site in Normandy. A Preliminary Safety Analysis report for the FA3 EPR unit was approved by the ASN in 2006 and agreement to begin construction was given in 2007. The FA3 EPR design is the design submitted for Generic Design Assessment (GDA) in the UK.

Since 1993, some six EPR Safety Reports and approximately 180 supporting technical references have been produced and assessed in detail by independent experts in the IRSN / GPR (and by the GRS / RSK up to 1998). During this period approximately 90 evaluation reports were issued by the IRSN / GRS, some 200 meetings were held between the EPR project (EDF, German Utilities and the industrial partners) and the regulatory agencies, and close to one million hours of work were carried out within the EDF-SA engineering functions alone.

It can therefore be seen that the initial UK EPR design that has been through the GDA in the UK has undergone a 20 year process of design optimisation to maximise the safety of the plant within the constraints of practical constructability. The design optimisation process is very similar to the process of design optimisation to achieve an ALARP design in the UK. The EPR design process has been carried out in consultation with regulatory authorities in France (and Germany initially), and all design documentation has been independently reviewed and scrutinised by a large panel of experts in organisations which were independent from the vendor and utility companies.

2.3. PRODUCTIONAPPROVED OF “TECHNICAL GUIDELINES”

French and German safety authorities decided in 1995 that “TGs for future PWRs” should be developed with oversight provided by the GPR and RSK standing commissions. IPSN and GRS submitted a proposal for the structure and contents for the development of these guidelines which was adopted. The outcome of this work was the publication of the “TGs” which brought together all recommendations of the GPR and RSK (German experts) during the period 1993 to 2000.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 6 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

The TGs implement and refine the EPR conceptual safety design features identified in 1993. Several steps were involved in their production, as follows:

 The first step was to propose a structure allowing the GPR / RSK recommendations to be implemented in such a way that the TGs can be used in both French and German regulatory processes. This was the objective of the work performed in 1997.

 The second step was to organise the GPR / RSK recommendations in the adopted structure. This work was performed in the first part semester of 1998.

 In 1998, the IPSN / GRS began to turn the text of the GPR / RSK recommendations into guideline text, rearranging and making some changes in the material (without changing the substances of the original GPR / RSK recommendations). An intermediate version of the TGs was issued by the IPSN / GRS at the end of 1998. This document was reviewed by GPR / RSK members and by the EPR design organisation, leading to the issue of an updated version in 1999.

The final text of the TGs [Ref. 1] was adopted by the GPR and German experts during the plenary meetings held on 19 and 26 October 2000. Chapter 3 of the Pre-Construction Safety Report (PCSR) presents the TGs.

2.4. REVIEW AND VALIDATION OF EPR DESIGN OPTIONS

Each of the EPR project partners carried out design reviews in the early preparatory phase of the EPR project, and later on during the detailed design phases after the issue of the TGs (see Sub-chapter 17.2 – Table 3). In the period in between, NPI had primary responsibility for the EPR technical design review.

During the consolidation phase and the Basic Design phase (see Sub-chapter 17.2 - Table 3), design work was performed under a Basic Design Contract between EDF, German Utilities, Framatome, Siemens and NPI. The organisational arrangements are shown in Sub-chapter 17.2 - Table 2.

The following definitions are of assistance in understanding the work organisation for the definition and validation of the main options considered during the Basic Design Phase:

 Contractor: refers to the group of companies formed by NPI, Framatome and Siemens, these companies being jointly and severally liable to the Utilities, under the leadership of NPI.

 Utilities: refer to the group of companies comprising EDF and the German Utilities.

 Designer: is any of the three companies forming the Contractor (or EDF-CNEN, to the extent APPROVEDit is entrusted by the Contractor to perform services).  EPR Project Directorate (EPD): refers to a joint group formed between the Utilities and the Contractor as project organisation. It makes decisions on all technical questions, apart from those reserved for the EPR Steering Committee (ESC) or submitted by the EPD to the ESC for a decision.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 7 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

 EPR Project Leader Committee (PLC): refers to a joint group formed between the Utilities and the Contractor as project organisation. It is responsible for the realisation of the decisions taken by the ESC and the EPD with regard to technical questions. Furthermore, the PLC is responsible for the execution of the work in due time and appropriate manner according to the instructions of the EPD.

The Basic Design work was performed on the basis of objectives and guidelines defined during the Conceptual Design Phase and the Consolidation Phase. These objectives and guidelines were described in the so-called MFF. The Basic Design activities involved validating and complementing the requirements stated in the MFF which were by definition general and preliminary. In some cases departures from the MFF objectives were required.

The EPD was responsible for deciding on such changes, based on proposals made by the PLC. If the changes were highly significant, approval was required from the ESC.

2.4.1. Work of the Committees and Technical Working Groups

The following committees and working groups met on a regular basis during the initial EPR design phase to make decisions and carry out actions within their respective field of responsibility.

2.4.1.1. EPR Steering Committee (ESC)

The ESC was empowered to take any decision concerning the Basic Design Contract or where appropriate to delegate such decisions to another project body.

2.4.1.2. EPR Project Directorate (EPD)

The EPD was responsible for making decisions on all technical questions, apart from those reserved for the ESC or submitted by the EPD to the ESC for decision.

Sixty-eight EPD meetings were held: 27 during Conceptual Design Phase and Consolidation Phase, and 41 during Basic Design Phase and BDOP.

2.4.1.3. EPR Project Leader Committee (PLC)

The PLC was responsible for the realisation of decisions taken by the ESC and the EPD concerning technical questions. Furthermore, the PLC was responsible for the execution of the work in due time and appropriate manner according to the instructions of the EPD.

The meetings of the PLC were organised in order to review the progress of the project (Progress Review Meeting), in order to control the activities of the working groups and to prepare the results for discussionAPPROVED in the EPD. Ninety-two PLC meetings were held: 36 during Conceptual Design Phase and Consolidation Phase and 56 during Basic Design Phase and BDOP.

2.4.1.4. Working Group Meetings

Subject to approval of the EPD, the PLC established working groups for special problems. The working groups generally consisted of representatives of EDF and the German Utilities, as well as of members of the Contractor organisations and EDF-CNEN when acting on behalf of the Contractor.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 8 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

The meetings were organised by the project leaders who nominated qualified participants from their organisation. The following items were considered by permanent working groups with regular meetings:

1) Safety principles

2) Functional engineering and transient analysis

3) Systems and process

4) Reactor core

5) Containment

6) Layout, Civil (and radiation protection)

7) I&C

8) Electrical systems

9) Components / Equipment units of the primary circuit

10) Severe accidents and radiological calculations

The working groups were involved from the very beginning in such a way that they were aware of ongoing engineering work and of the intermediate results, so they would have a common understanding of the design choices.

2.4.2. Technical Reviews

In addition to the periodic meetings, Technical Reviews were organised with the participation of the Contractor and the Utilities. Reviews were performed on specific subjects, such as:

 safety and systems, in particular severe accident reviews and systems reviews,

 layout, including building layout, accident prevention for personnel, radiation protection for personnel, fire protection, and other hazards.

A Technical Review Group was composed of experts from the Contractor and from Utilities and the PLC. At the meetings, experts from the Contractor and Utilities presented their assessment reports, under the co-ordination of NPI, on the technical issues addressed by the Technical Review. The members of the Technical Review Group could request any further explanations and justifications. Their conclusions were presented in a report to the PLC.

NPI were responsible for documenting the report of the Technical Review Group and distributing it to the PLC, APPROVEDthe EPD and the participants of the Technical Review. After approval by the PLC, the report became effective. NPI then issued a complete report of the meeting, including the comments of the various organisations represented at the meeting and rationales for the conclusions reached.

Technical reviews were held during the course of the Basic Design of the EPR, on different topics such as:

 Emergency Core Cooling (ECC) Mode – 12 September 1995;

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 9 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

 Severe Accidents – 1 December 1995;

 Severe Accidents – 11 April 1996;

 I&C – 17 September 1996;

 Layout – 19 March 1996;

 Systems – 20 February 1996;

 Systems – 5 March 1996;

 Systems – 16 December 1997.

Following the completion of the Basic Design there were further design phases, including the Design Optimisation and Detailed Design phases for the initial EPR design (see Sub-chapter 17.2 - Table 3). Technical Review Group meetings continued during these phases, addressing topics such as the design of the containment building and its liner, design of ventilation systems, selection of steam generator tube material, human factors, HMI, radiological protection and environmental impact.

The phase of the project following the issue of the TGs is of particular interest for design process, as the French safety authority requested a number of improvements to the EPR design.

As a result of the requests, several letters were sent to the French safety authority in late 1999 and early 2000, making commitments to improve the design in areas such as:

 Demonstration that the risk arising from some accident sequences (rapid reactivity insertion accidents, containment bypass sequences) would be reduced to an insignificant level compared with the design basis.

 Reducing the consequences of accidents involving core melt (hydrogen mitigation, cooling of the corium, etc.) and proposals regarding the design of systems to be used in these situations.

 Role of the containment building and the peripheral buildings in the design of the “containment function”.

 Definition of reference events considered in the design basis of the EPR, in particular with regard to cooling of the fuel inside the Spent Fuel Pool (SFP).

 Consideration of earthquakes in the design and the combination of loads to be assumed in design conditions with loads due to the design basis earthquake.

 The programmeAPPROVED to be implemented for the equipment qualification, to ensure demonstration of qualification before start-up of the plant.

 The design objectives for radiation protection, radioactivity releases and radioactive waste production.

 Consideration, at the design phase, of the specific needs and provisions to facilitate decommissioning of the EPR.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 10 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

In addition, and on the basis of these commitments, design reviews on specific items were also conducted, including severe accident mitigation strategy, strategy for radiation protection etc.

2.5. SUMMARY OF R&D WORK UNDERPINNING THE EPR DESIGN

An extensive programme of R&D work has been undertaken to validate the EPR design aspects where changes have been made with respect to earlier plants. The R&D work is divided into three categories:

 Category 1: R&D work essential for the design and for the validation of key design choices (e.g. the behaviour of corium outside the reactor pressure vessel);

 Category 2: R&D work useful for improving and optimising the design (e.g. on the reactor vessel failure modes);

 Category 3: R&D confirmatory studies and work providing additional information to substantiate current design choices (e.g. steam explosion).

A summary of the main research areas is given below.

2.5.1. Subjects not related to Severe Accidents

Specific R&D not related to severe accidents is, in general, limited to qualification, adaptation or improvement of existing equipment. R&D topics studied cover the following areas:

 elements within the vessel and in the bottom of the vessel;

 control rods;

 heavy reflector;

 mitigation of accidents involving the loss of primary coolant;

 mitigation of intermediate accidents involving the loss of primary coolant / steam generator pipe ruptures;

 steam generator components.

These topics have been the subject of an R&D programme for developing models and simulations for confirming the correct operation of EPR design features where differences exist with existing French and German plants. R&D programmes and tests are listed in Sub-chapter 17.2 – Table 4.APPROVED

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 11 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

2.5.2. Severe Accident Topics

Specific EPR design features have been developed for mitigation of accidents involving core melt. In general terms no comparison with the existing French and German plants is possible. New R&D work was deemed necessary to justify the design solutions selected for the EPR, as R&D work in progress worldwide in the area of severe accidents was not specific to the EPR. Nevertheless, relevant worldwide R&D work on this subject was taken into account. The main areas of work were development and validation of calculation codes, including benchmark and validation tests at different scales with simulated and actual materials to identify key phenomena.

The following topics related to severe accidents were addressed in the programme. The work involved both general R&D carried out at research centres and specific R&D performed or initiated by the EPR designers:

 Performance of the Reactor Coolant System (RCP [RCS]) depressurisation valves;

 Vessel internals (lower section);

 Design of the reactor vessel support and the reactor vessel cavity, and behaviour of the RCP [RCS] system in core melt situations;

 Stabilisation of core melt;

 Mitigation of H2 build-up;

 Removal of heat from the containment;

 Methods for limitation of radioactive releases;

 Internal structure of the containment

These topics have been the subject of experimental programmes to validate the design of the EPR specific design features. R&D programmes and tests are listed in Sub-chapter 17.2 – Table 4.

3. CODES AND STANDARDS USED FOR EPR DESIGN

Based on experience and feedback from former French, German and other NPPs, some nuclear codes and standards have been established and regularly improved, through updates, in France and Germany, but also more generally all around the world.

Since the very beginning of the EPR design the consideration of such codes and standards in the design formedAPPROVED part of the discussions between the vendor company (Framatome, now AREVA-NP) and the electrical (French and German) utilities as well as the Regulators (French and German safety authorities).

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 12 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

Most of the codes and standards considered for the initial EPR design are existing French and German codes that had been applied to existing French and German nuclear plants, although where revisions to the codes and standards had been made, they were utilised for the initial EPR design. Additional European codes and standards are also considered. The objectives behind this were, firstly, to benefit from existing French and German nuclear codes and standards and to obtain approval from French and German Regulators, and secondly, to make it possible for a large number of European companies to bid for tenders for a potential EPR construction project in a European country.

The relevance of such codes and standards was assessed during the review and validation of the EPR design options, described in section 2.4 above. This includes the review from both the French and German Regulators.

Sub-chapter 3.8 provides an overview of the codes and standards considered for the HPC design. This list is derived from the list established for the initial EPR design and subsequently updated since to take account of feedback from the GDA process and updated codes and standards where relevant.

4. INCORPORATION OF EXPERIENCE FEEDBACK INTO THE INITIAL EPR DESIGN

In designing the EPR it was decided to follow an evolutionary approach: the advantage of basing an advanced design on operational experience from approximately 100 PWR NPPs in the world (Belgium, Brazil, China, France, Germany, Korea, South Africa and Spain) constructed by Framatome and Siemens was deemed by the designers to be very important.

In addition, experience feedback from other NPPs has been reviewed and design features addressing any generic safety issues identified have been taken into account. The following examples illustrate this approach:

 Steam Generator (SG) tube integrity has been improved by the choice of Inconel 690 as the tube material to avoid corrosion cracking and intergranular attack. Denting and fretting are prevented by an optimised design of the internals and supports. In addition, the design provides accessibility to the tube bundle for inspection and maintenance.

 Overfilling of SG in case of SG Tube Rupture (SGTR) is avoided by reducing the head developed by the Medium Head Safety Injection (MHSI) pumps, by automatic initiation of the fast RCP [RCS] system cooldown and by an automatic shutdown of the Chemical and Volume Control System (RCV [CVCS]) charging pumps on detection of a high water level in the SGs.

 Safety Injection System (RIS [SIS]) sump blockage: in order to avoid blockage by insulation material and other debris, a staggered strategy for debris retention is adopted; this includesAPPROVED use of weirs and a trash rack for protection of openings in the heavy floor, large retention baskets with overflow space below the heavy floor opening and large screens with small meshes. The large screens with small mesh size above the sump pit have a robust construction to cope with increased head losses due to debris blockage and inclined subdivided sump screens are employed in order to facilitate filter cake detaching.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 13 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

 In order to improve the SG feedwater system availability, the EPR is equipped with a four independent train Emergency Feedwater System (ASG [EFWS]), each train being powered by a segregated diesel generator. In addition, the plant design includes a Startup and Shutdown Feedwater System (AAD [SSS]).

 Improved reliability for the power supply system: The Emergency Power Supply System is equipped with four separate and independent diesel generator units that are safety grade and they are automatically started by low voltage or low frequency signals. In addition, the Station Black Out (SBO) power supply has two separate and independent diesel generators which are of a diverse design from the Emergency Diesel Generators (EDGs) sets; they are also safety classified.

 Following a core melt accident, the containment integrity is ensured through design measures dealing with hydrogen detonation, direct containment heating, vessel lift, ex- vessel steam explosion, basemat (foundation raft) melt-through, containment pressurisation and containment leakage.

 Improved electrical design taking into account operating experience from the incident of 25 July 2006 at the Forsmark NPP in Sweden: the diversification in the power supply for I&C has been improved by adding four new distribution switchboards (220V DC) and by requiring diversification of suppliers for the 2-hour batteries between Divisions 1 and 2 and Divisions 3 and 4. In addition, the protection of inverters in case of over-voltage has been modified (in particular, no inverter disconnection on high input voltage).

A systematic review has been carried out to confirm that the EPR design addresses generic issues identified in the International Atomic Energy Agency (IAEA) Technical Documents [Ref. 3]. A similar review in regard of Nuclear Regulatory Committee (NRC) generic safety issues (NUREG 09333) was performed for a US EPR in the framework of an USNRC Design Certification.

EDF and AREVA, who were co-applicants for the GDA for the UK PWR, remain actively aware of international developments in reactor design, operation and regulation through participation in a range of international organisations. In particular EDF is a member and active participant in the World Association of Nuclear Operators and AREVA chairs the Framatome Reactor Owners Group.

5. COMPARISON OF EPR DESIGN WITH NATIONAL AND INTERNATIONAL STANDARDS

Sub-chapter 1.4 provides an overview of the design and safety assessment process for the EPR within France, Finland and the USA. Furthermore to this comparison against national standards, an overview of comparisons of the EPR design against international safety standards (the Western European Nuclear Regulators’ Association (WENRA) reference levels, IAEA Safety Standards, andAPPROVED the European Utility Requirements (EURs) for Light Water Reactor (LWR) NPPs) is provided.

In addition, Chapter 23 discusses the “Licensee response to Fukushima”, where the national and international recommendations issued, following the events which occurred at Fukushima Daiichi in March 2011, are considered.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 14 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

As described in section 2.2 above, the initial EPR design was submitted for the GDA in the UK. Before the submission it was decided to perform a comparison between the initial EPR design and the expectations of the Office for Nuclear Regulation (ONR) Safety Assessment Principles (SAPs) [Ref. 4]. This comparison was intended to provide a contribution to the demonstration that the EPR design process has followed “relevant good practice”, as described by the ONR ALARP guidance [Ref. 5].

The EPR design was developed within a framework involving both the French and German national Safety Authorities. The Safety Authorities produced a specific set of recommendations for the design of new PWRs, known as the “TGs”, which were the fundamental requirements applied to the EPR design. Subsequently, the EPR design was compared against international standards such as IAEA safety guidelines, EURs and WENRA reference levels as described in Sub-chapter 1.4. These guidelines and principles do not correspond in all respects to the recommended practices suggested in the SAPs. Nonetheless, it was considered that all the key nuclear safety requirements embodied in the SAPs were broadly met by the initial EPR design, and in particular that the initial EPR design achieved the fundamental objective that the radiological risk to workers and the public was ALARP, which is the basic legal requirement underpinning UK nuclear safety regulations.

The detailed results of the assessment of the EPR design against the SAPs are presented in the document “Comparison of EPR design with HSE/NII SAP” [Ref. 6].

In addition to this, as described in the ONR Design Acceptance Confirmation (DAC) confirmation letter [Ref. 7]: from July 2007 to December 2012, the ONR undertook a GDA of the UK initial EPR design. On 13 December 2012 a DAC was issued. The present HPC PCSR includes the proposed modifications to address the issues raised during this assessment period with the objective of reaching an ALARP design.

In order to help inform its assessment of the HPC EPR design, NNB GenCo (HPC) has produced the Nuclear Safety Design Assessment Principles (NSDAPs) [Ref. 8]. These principles have been developed based on the EURs, the 2012 version of the ONR SAPs [Ref. 9], relevant IAEA NPP guidance and UK NPP practices. Sub-chapter 1.3 provides a summary of NNB GenCo (HPC)’s assessment of the HPC design against the NSDAPs, further contributing to the demonstration that the HPC design is ALARP.

6. OUTCOME OF OPTIONEERING PROCESS – SAFETY SYSTEMS/STRUCTURES

6.1. GENERAL DESIGN PRINCIPLES

International studies on the safety approach for the next generation of NPPs (for example, IAEA studies) have stressed the importance of strengthening the defence-in-depth concept, and achieving greaterAPPROVED independence between the barriers preventing release of radioactivity to the environment. These measures require, amongst other aspects, explicit consideration of severe accidents in the design of the containment system.

The main elements of the defence-in-depth concept that have been used as a basis for the initial design of the EPR and that are detailed in Sub-chapter 3.1 are:

 balance between the different levels of protection;

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 15 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

 level of independence between different levels of protection;

 achieving an appropriate balance between the prevention and the mitigation of accident situations;

 achieving an adequate level of conservatism in the design and in the protection of the barriers;

 increased emphasis on shutdown states and on specific events that may result in potential containment bypass.

The above considerations have led to a number of design enhancements for the EPR compared with the previous generation of PWRs operating in France and Germany (particularly the N4 and Konvoi designs). Some of the significant enhancements are reviewed in the following sections.

Furthermore, the EPR has been developed to address all issues of safety, public perception and economic operation. Experience to date in both France and Germany on standardisation of plant design has been a major factor in the overall EPR design.

6.2. RESULTS OF DESIGN OPTIMISATION

6.2.1. Plant Size

Like other new plant design processes, the EPR design process began by defining the intended plant size. Current experience in France, Germany, and the rest of the world indicated that the new plant sizes, at least for the foreseeable future, will be larger (> 900 MWe).

The preference for larger plant sizes is based on proven operating experience; the economic advantage of an increased unit size based on available proven technology has also been a major influence.

6.2.2. Containment Design

To meet the safety objectives for EPR, modifications to the containment design were required to improve protection against uncontrolled environmental releases in design scope conditions (see Sub-chapter 3.1). In such accident situations, the requirement was that the structural integrity of the containment and its leak-tightness must be preserved.

The initial concept chosen for the EPR containment building was a double-wall containment based on technology derived from the current French N4 containment design. The inner wall is a pre-stressed concrete shell. The outer wall is made of reinforced concrete and forms part of a global “aircraft shell” that protects most parts of the Nuclear Island from aircraft impact and other external hazards. The two walls are separated by an inter-wall annulus, which is maintained at a sub-atmosphericAPPROVED pressure so that leakages from the inner containment can be collected and filtered before being discharged to atmosphere via the stack. The double-wall containment building stands on a reinforced concrete basemat.

The main technological and design principles for the EPR containment chosen to satisfy the required specifications and their evolution are as described below:

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 16 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

 An internal containment volume of 75,000 m3 was initially chosen to reduce the risk of a global hydrogen detonation. This resulted in the maximum concentration of hydrogen in dry air within the range 10% to 13%. Taking into account the 241 fuel assemblies in the core, passive hydrogen recombiners and a target maximum hydrogen concentration of 10%, optimisation studies resulted in the free volume being increased to 80,000 m3.

 The containment outer wall, made of reinforced concrete, is designed to withstand loads resulting from external hazards (earthquake, explosion, airplane crash, etc.) and for leak recovery. Compared to the loads used in the design of the French N4 plants, the loading combinations due to external hazards considered for the EPR are greatly increased. In particular, the seismic level considered corresponds to a zero period ground acceleration of 0.25 g, and the external explosion load corresponds to an incident pressure wave of 100 mbar. The design of the EPR to withstand aircraft crash initially considered only loads due to the impact of military jet fighters. However, after the 11 September 2001 event, the design loads on the outer wall were considerably increased to embrace a wide range of potential terrorist attacks, including the deliberate crashing of a large commercial aircraft.

 To minimise the possibility of containment bypass events, specific design criteria have been implemented to prevent direct leakages from the Reactor Building (HR [RB]) to the environment. These include a requirement that all pipes carrying radioactive substances passing through the containment wall pass into sealed peripheral buildings so there is no direct release route from inside the containment to the environment. Therefore the peripheral buildings are considered to form part of the containment function.

 In addition to this initial design requirement, an extensive study of all potential bypasses of the containment function due to the failure of equipment connected to pipework passing from the containment building to peripheral buildings, has been performed. This study resulted in changes to the design of some fluid circuits, including installation of complementary isolation methods (see below).

 In the initial design, the leak-tightness of the containment was achieved using a partial composite liner on the inner face of the internal wall. Tests were conducted on a large scale mock-up (with and without the composite liner) to gain experience of the behaviour of such a system, using dry air and air / steam mixtures in pressurised conditions. On the basis of the results of these tests, and experience feedback from current French plants, it was decided to change to the use of a steel liner inside the containment in order to improve its leak-tightness, particularly for the case of severe accidents conditions.

6.2.3. Design Improvements to avoid Containment Bypass Events

Consideration has been given to fault sequences in which radioactive materials might be released to the environment via fluid systems connected to the reactor coolant circuit (e.g. the Safety Injection System operating in Residual Heat Removal Mode (RIS/RRA [SIS/RHRS]), the RCV [CVCS] system, the Extra Boration System (RBS [EBS]) etc.), thus effectively bypassing the containmentAPPROVED function. The risk of containment bypass via SGTR has also been analysed in the containment design process. Design provisions adopted for the EPR, particularly the requirement for the maximum head developed by the safety injection pumps to be below the set pressure of the safety relief valves on the secondary system, the automatic initiation of fast RCP [RCS] system cooldown, and the requirement for automatic shutdown of the RCV [CVCS] system charging pumps on detection of a high water level in the SGs, reduce the risk of primary coolant bypassing the containment through the secondary system.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 17 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

Functional analysis and quantification of the potential initiators to evaluate the risk of bypass for each of the scenarios considered using the PSA methods has suggested that the risk due to bypass is very low. The current PSA presented in Chapter 16 is an update of this initial analysis and includes a review against the Safety Design Objectives (SDOs) defined in Sub-chapter 3.1 to demonstrate that the HPC design is ALARP.

6.2.4. Design for Mitigation of Severe Accidents

A key design objective for the EPR was to achieve a significant reduction in potential radioactive releases due to all conceivable accidents in comparison with current plants, including core melt accidents. In the framework of the EPR design, this objective requires that:

 The risks arising from accident situations involving core melt which lead to large early releases must be reduced to an insignificant level during the design process. This objective applies in particular to high pressure core melt sequences.

 Low pressure core melt sequences must be dealt with so that the maximum conceivable release would necessitate only very limited public protective measures in the vicinity of the plant.

As a result of these requirements, and considering the basis of the defence-in-depth concept that the core melt would have to be cooled outside the reactor pressure vessel, specific means have been designed and implemented to protect the containment building, and in particular its basemat, from the effects of core melt.

For the basemat protection, the original solution selected for the EPR was to allow spreading of the core melt debris over a large area outside the reactor pit. The overall aim of the concept was to stabilise the molten debris by water cooling inside the containment, thus avoiding a long-term release of fission products into the environment, due to excessive thermal loads or damage to structures causing loss of the containment function.

The spreading area which is maintained in dry conditions during normal operation is designed to avoid hydrogen production due to interaction between the basemat concrete and corium. It is connected to the In-containment Refuelling Water Storage Tank (IRWST) by pipes which flood the corium once it has spread into the compartment.

In addition, and in order to limit the pressure increase and to decrease this pressure inside the containment as rapidly as possible, a Containment Heat Removal System (EVU [CHRS]) has been implemented to cool the water used to fill the spreading compartment. This system, which has no active components inside the containment, is a two train system cooled by an intermediate active system for which power is supplied by two specific diesel generators in the event of failure of other emergency power sources.

With regard to control of hydrogen concentration, several solutions were considered including recombiners and igniters to prevent global detonation or deflagration due to high hydrogen concentrations.APPROVED Passive autocatalytic recombiners were ultimately selected for this purpose. Design measures for mitigating the consequences of low pressure core melt scenarios evolved significantly during different phases of the EPR design process. Numerous studies and tests were performed which led to improvements in the design of specific elements or components such as:

 The capacity of the reactor pit to collect the corium that could be produced inside the vessel due to the fuel melting was enhanced by using sacrificial concrete in the reactor pit.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 18 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

 The position and design of the gate used to discharge corium into the spreading area via the melt discharge channel (see Sub-chapter 6.1.6).

 The design of the components protecting the basemat, including replacing a proposed zirconia layer with an appropriate thickness of sacrificial concrete from which heat was extracted via cooling channels placed inside the basemat underneath the spreading area.

6.2.5. Safety Systems Design: Passive Features investigated for the EPR

The ONR ALARP guidance [Ref. 5] states that passive protection systems are preferred over active protection systems.

A major activity in the design of the EPR protective features has involved assessing the comparative benefits of active and passive safety systems incorporating passive features to the greatest extent allowed within the stated design objectives of the EPR. The selection of passive design features is considered in the present sub-section.

6.2.5.1. Criteria used to assess Passive Systems

Potential passive design features and systems were subject to a systematic assessment with respect to the criteria of simplicity of design, impact on simplicity of plant operation, safety and cost.

Firstly, it was required that the design should be simplified, or at least not made significantly more complex by the implementation of the passive feature. In this context, proven technology of the components used was required, in accordance with the ONR Guidance.

The degree of passiveness involved was investigated: to what extent did a proposed solution rely on active equipment like valves or on active auxiliary systems such as cooling or ventilation? Also, it was required that the overall system configuration should be simplified by implementation of the passive feature. An indicator of simplification could be a reduced requirement for system interconnections.

Secondly, the operation of the plant and of the passive system should be simple. Normal operational modes like power operation, start-up, shutdown, refuelling, and maintenance should not be affected by the passive system. Spurious actuation of passive systems should be detectable and recoverable by straightforward actions to avoid undue consequences on overall plant operation. The operation of the passive system itself should also be simple: initiation should be based on plant status and not on difficult diagnosis of an accident scenario: the system operational mode should not depend on plant status or reactor operating situation.

As a general rule, passive features chosen for implementation would need to be inspectable and capable of being tested in-service, with the testing mode being as close as possible to the operational modeAPPROVED of the system. The final assessment criteria were related to safety and cost. To be implemented, a passive system should give clear safety and economic advantages.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 19 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

Additionally it was important to establish that new accident scenarios would not be introduced by passive systems. The systems should fit in with the well-proven defence in-depth concepts and allow an extended time response to incidents or accidents. Accident consequences should not be aggravated by operation of the system. It was considered important that the multiple barrier concept (the integrity of the reactor coolant pressure boundary, control of containment leakages by double containment) used in French and German PWR designs, should not be weakened by the introduction of passive systems.

6.2.5.2. Passive Features adopted during the Design Optioneering Process

Following the review of passive safety features, the following additional passive features were included in the EPR design:

 Larger SG and pressuriser volumes providing increased thermal inertia, thus slowing plant response to upset conditions;

 Initial RIS [SIS] system valve line-up (suction from the IRWST) meets long term cooling needs without realignment;

 Lower core elevation relative to the cold leg cross-over piping which limits core uncovery during small break Loss of Coolant Accidents (LOCAs);

 Absence of lower head penetrations on the reactor pressure vessel for in-core instrumentation, thus eliminating one potential failure mechanism and failure location;

 Passive pressuriser safety valves for both overpressure protection and prevention of spurious opening (passive opening under pressure increase, passive closing under pressure decrease);

 A large dedicated spreading area outside the reactor cavity to prevent the molten core- concrete interaction, by passive spreading and subsequent passive flooding of the corium;

 A large water source in the IRWST located inside the HR [RB] building, draining by gravity into the reactor pit and the corium spreading area;

 A double wall containment with a reinforced concrete outer wall, a pre-stressed concrete inner wall and an intermediate space maintained passively under a small sub- atmospheric pressure during a limited period. A steel liner was integrated into the design of the inner containment to improve leak-tightness under accident conditions. The aircraft proof shell surrounding the HR [RB] building and other safety buildings was modified to withstand the impact of large commercial airliners;

 Passive auto-catalytic hydrogen recombiners in the HR [RB] building, to reduce risks due to hydrogenAPPROVED combustion in severe accident conditions. 6.2.5.3. Passive Features rejected during the Design Optioneering Process

Some 20 passive features were evaluated in the conceptual design phase of the EPR which were not retained in the final design. Some of the principal passive features which were investigated for possible implementation in the EPR, but rejected, are described below.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 20 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

6.2.5.3.1. Passive High Pressure Residual Heat Removal System

The objective of this system is to remove the residual heat by primary side cooling in events where existing designs rely on secondary side cooling, to avoid dependence on the ASG [EFWS] system.

The primary water flows by natural circulation through the Residual Heat Removal (RHR) heat exchanger located in an elevated water filled pool. The RHR heat exchanger is cooled by the pool water which evaporates into the containment. A containment cooling system becomes necessary or alternatively the pool must be cooled by an active cooling system. Active measures are required such as opening of valves for the RHR system flow and start of heat removal from the pool or containment. The main results of the assessment of this system were the following:

 Flow rate through the RHR system depends on (a) the elevation between levels of the RCP [RCS] system loops and the RHR heat exchanger, and (b) diameter of RHR pipes.

 The concept would lead to a significant extension of Class 1 equipment.

 Installation of a water pool including the RHR heat exchanger at about the same level as the operating floor and assuming that more than one train, including pool, would be necessary, would lead to a complex arrangement of the HR [RB] building.

 An operational system would also be necessary to bring the plant to cold shutdown conditions for refuelling.

Although the passive RHR system has the potential advantage of easy operation, it was not retained for the EPR because it failed to meet the criteria of design simplicity or to achieve an adequate safety improvement.

6.2.5.3.2. Safety Condenser

The objective of this concept is to implement an autonomous, self-fed secondary-side RHR system.

The main element of the system is the safety condenser itself, located outside the containment and connected to the SG on the steam side and on the water side, and the demineralised water pool, which is connected to the shell side of the safety condenser.

During normal plant operation the system would be on standby and separated from the SG by closed isolation valves in the condensate line. The valve in the steam supply line is locked in the open position, so that the condenser is full of cold condensate on the tube side and is at main steam pressure. On the shell side, the condenser is partially filled: the closed control / isolation valve prevents the inflow of demineralised water from the demineralised water pool. To start up the system on a safety demand, the redundant, diverse condensate drain valves and the isolation valveAPPROVED in the demineralised water supply system are opened and the load controller activated. Draining of the secondary side of the condenser exposes heat transfer surface; heat transfer from the SG to the condenser takes place when the level on the tube side falls below that on the shell side. The cold condensate flowing from the condenser into the SG absorbs energy, before heat removal by the condenser begins. After the system run-up time, which is governed chiefly by the draining characteristic of the condenser, cooling begins. This is achieved by the admission, via the redundant, diverse control stations, of demineralised water from the demineralised water pool, which is at a higher static head. The result is evaporation to the atmosphere which acts as a heat sink.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 21 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

The power for the valves required in normal operation and to ensure operation under emergency conditions is provided by a battery-backed supply. Since only a low electrical power is required, a grace period of several hours is available for restoring the function of any Alternating Current (AC) generators which may have failed.

Although the safety condenser concept presents potential reduction in activity release in the case of a SGTR, this concept was not retained for the EPR because it failed to pass all the selected criteria. In particular, the system does not meet simplicity and cost effectiveness.

6.2.5.3.3. Passive Emergency Feedwater System

The objective of this system is the same as that of the safety condenser. The heat exchanger and the demineralised water pool are combined in a single component instead of two separated components.

In order to avoid elevated storage of large inventory of water, an emergency feedwater tank under nitrogen or compressed air over-pressure, located at ground level, allows replenishment of the passive condenser as and when required, to make up for water evaporation. This concept was not retained for EPR as it failed to meet the simplification and operational criteria.

6.2.5.3.4. Secondary Side Residual Heat Removal and Passive Feed

The objective of this system is to remove residual heat from the core for events such as SBO and complete loss of feedwater, by providing a passive means to supply water to the SGs.

Elevated demineralised water pools, large enough to supply the SGs for several hours (SBO duration), provide flow by gravity once the associated control valves have been opened and after closure of the SG main steam isolation valves. The cooldown is performed by steam release to the atmosphere through dedicated relief valves.

The main drawback of this concept is that the elevated pools must be protected against external events, particularly earthquakes. Movements of large inventories of water and the design of their supporting structures are major safety and cost challenges.

This concept was also not retained for the EPR because it did not meet any of the four categories of evaluation criteria.

6.2.5.3.5. Medium-Head Safety Injection by Accumulators

The objective of this system is to simplify the RIS [SIS] system without reducing the safety level below that on existing plants. The idea was to remove the MHSI pumps so as to reduce the RIS [SIS] system cost, reduce the maintenance requirements, and simplify operation of the system.

In order to fulfil the MHSI functions it is necessary to provide for an automatic depressurisation system and highAPPROVED pressure accumulators. Potential difficulties arose during the assessment of non-LOCA events with this concept. It was found that the management of SGTR accidents would have to be reconsidered, and questionable operating modes were discovered.

The concept was dropped because it failed to meet the criteria of simplicity and failed to give clear safety benefit compared with a conventional active RIS [SIS] system.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 22 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

6.2.5.3.6. Gravity-Driven Low-Head Safety Injection from Tank / Sump by Primary System Depressurisation

The objective of this system is to provide an efficient ultimate back-up for injection of water at low pressure for long term reactor cooling. The RCP [RCS] system is flooded with water above the loop level and water flows by gravity from sumps, through check valves, into the reactor vessel. Decay heat is removed to the containment atmosphere by evaporation of the flood water. Steam produced inside the containment condenses on surfaces cooled by a containment cooling system, and the condensate flows back to the RCP [RCS] system.

Active measures are required e.g. opening of isolation valves, opening of the RCP [RCS] system discharge and feed line from the sumps, and start-up of the heat removal system in the containment.

The principal results of the assessment of this system were the following:

 A large amount of water is necessary to flood the RCP [RCS] system, the amount depending on the HR [RB] building layout. For typical cases, the volume varied between 4,700 m3 and 10,000 m3.

 Large diameter of discharge line(s) and small flow resistance check valves are necessary to allow gravity flow to the reactor vessel. Spurious opening of valves in the discharge line(s) would have to be avoided. Additional connections to the RCP [RCS] system are required for discharge line(s) and feed line(s). A full scale test to verify the concept would be difficult and extremely costly.

 Although the passive low head safety injection system presents advantages, such as providing a back-up to the low head safety injection pump and avoiding long term recirculation outside the containment, it was not retained for the EPR because it failed to meet the criteria of design simplicity and cost-effective safety improvement.

6.2.5.3.7. External Cooling of Metal Containment

For metal containment structures, a concept in which heat removal is ensured by conduction through the containment wall is feasible in principle. Inside the containment, heat transfer would be by natural convection in the containment atmosphere and condensation on the containment wall inner surface. For external containment heat removal, several alternative cooling schemes can be envisaged. However a completely passive concept, using natural circulation air cooling, would only be possible for small unit sizes and in the long term, after decay heat is sufficiently reduced. Thus, additional means based on water spray on the outside containment surface are required at least in the short term. For the larger unit size of the EPR, water-circulation assisted external cooling would be required even in the long term. Use of water cooling on the containment outside surface, without evaporation and based on an active cooling circuit with a pump and heat exchanger, would allow retention of a double containment barrier, which would not be possible in case of a natural air circulation cooling mode. However, in such a containment heat removal APPROVEDconcept, the passive means of heat removal is provided only on the inside of the containment. Furthermore, the heat transfer capacity by condensation on the inner containment surface in the presence of non-condensable gases is limited and, for the large thermal power of the EPR, could result in elevated containment pressures (several bar), in the medium term following an accident.

For these reasons, this option has not been retained for the EPR.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 23 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

6.2.5.3.8. External Cooling of Reactor Vessel for Melt Retention

Some reactor types use flooding of the reactor pit as a means of maintaining the integrity of the reactor pressure boundary and preventing melt ejection into the containment in core melt scenarios. Heat is transferred from the melted core by conduction through the vessel walls and then by natural circulation to the water in the reactor pit. For the large unit thermal power of an EPR, natural circulation cooling on the outside of the pressure vessel would be insufficient to prevent failure of the reactor vessel wall. Therefore the option of in-vessel melt retention by passive external cooling of the outside of the reactor pressure vessel could not be used for the EPR.

6.2.5.3.9. Sump Cooler with Passive Cooling Chain

The objective of this concept is to remove decay heat following a LOCA by natural circulation from the HR [RB] building sump via submerged coolers and a secondary cooling system to the atmosphere.

Like many other passive concepts, opening of valves is necessary to start operation of this system.

Additional measures to transfer the heat from the containment sump were estimated to be necessary during the evaluation of this concept. A large heat transfer surface for the sump cooler (a minimum of 1,000 m²) was found to be required.

The passive sump cooling feature was rejected because the large height difference required between the ultimate heat sink and the sump cooler to secure natural circulation (a minimum of 20 m) would result in unacceptable implementation costs.

6.2.5.3.10. Containment Condenser Coolers

The objective of this system is to provide a passive means, at least inside the HR [RB] building, for removing decay heat in the long term after a severe accident, in order to avoid the internal pressure exceeding the containment design pressure.

Steam, driven by natural circulation, condenses on the outside surface of coolers. Cooling water circulates inside the coolers. The cooling system is active and located outside the containment.

The major drawbacks of this system, in comparison to the current EPR spray system, which uses the EVU [CHRS] system to spray water into the upper volume of the containment, are the following:

 The heat transfer and containment pressure reduction capability are strongly dependent on the presence of non-condensable gas and on general convection flows inside the containment. The level of uncertainty in modelling these effects at full scale is such that it is not considered possible to predict the effectiveness of such systems with sufficient confidenceAPPROVED.

 The condensers would have to be located in the upper part of the containment where they would promote hydrogen accumulation, reducing their heat transfer capability and potentially increasing the risk of detonation.

 A large amount of space would be required above the operating floor which is a congested area during maintenance and refuelling.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 24 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

 A spray system is more effective than condensers in reducing pressure and removing fission products from the containment atmosphere.

However, this system offers several advantages over a containment spray system, the major one, being that it avoids recirculation of highly radioactive water outside the containment after a severe accident. Therefore, the containment condenser coolers provide a solution to one of the key severe accident challenges: i.e. how to remove heat from the containment building without circulating fluid through its walls and potentially impairing its leak-tightness. Nonetheless, the conclusion was reached that this advantage was outweighed by the drawbacks of a condenser system.

6.2.5.4. Conclusions on Adoption of Passive Safety Features in EPR Design

The EPR has been developed to address all issues of safety, public perception and economic operation. Experience to date in both France and Germany on standardisation of plant design has been a major factor in the overall initial EPR design.

In general, the majority of passive features proposed so far for Generation 3 reactors were considered to be largely unproven in testing and operation. Such features were considered to be economically unjustified and / or liable to lead to increases in plant complexity that may actually degrade rather than enhance safety. The EPR designers have selected only those passive features that meet the requirements of simplicity, operability / inspectability and cost-effective safety enhancement. At the same time they have sought to increase the reliability of active safety features (for example, by supplementing the emergency diesels supplying active safety systems with diverse diesels) in order to ensure that safety functions will be achieved with a very high level of reliability.

7. DOSES TO WORKERS IN ACCIDENTS

The safety design of the EPR has focussed on minimising the risk to members of the general public due to off-site radioactivity releases by minimising the frequency of initiating events and providing defence-in-depth against such events that could occur.

However, measures are also taken to minimise the radiation dose to workers in accidents.

For operators in the Main Control Room (MCR) who cannot be relocated, protection is provided by maintaining the control room at a positive pressure with respect to ambient and supplying air through a filtration system (safety classified).

Generally, worker protection from radiation doses in accidents is achieved through emergency procedures for evacuation and sheltering of workers to a safe area. The plant is designed with escape routes to allow workers to be evacuated from hazardous areas in case of emergencies. For example during refuelling operations, escape routes from the HR [RB] buildings enable workers to escapeAPPROVED to uncontaminated areas outside the building, while a negative pressure is maintained inside the building so that radioactive materials released will remain contained.

Therefore, in the design optioneering carried out between 1987 and 2006 it was considered, in an initial analysis, that doses to workers in accidents would generally be lower than those to exposed individuals off-site, who cannot be immediately protected by evacuation and sheltering.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 25 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

8. OPTIMISATION OF DOSE TO WORKERS AND THE PUBLIC IN NORMAL OPERATION

To establish an ALARP position, under UK ALARP principles, the likely radiation doses to workers and members of the public from plant operation, are required to be ALARP. These aspects are discussed below.

8.1. MINIMISATION OF DOSE TO WORKERS

The EPR design process involved extensive optimisation studies to minimise worker dose. The objective was to apply an optimisation approach to radiological protection similar to that applied to safety. The optimisation was accomplished by improving the reactor design in relation to the best NPP units currently operating in France and Germany, with regard to worker collective dose. Details of the design optimisation are provided in Chapter 19, which is briefly summarised below.

The EPR approach to dose optimisation was to improve the design to both, reduce the source term associated with plant operation and maintenance, and to reduce the amount of exposed work.

The EPR design source term has been reduced by the following design changes:

 Optimising the use of stellite in the reactor vessel internals and valves;

 Modifying the pressuriser layout by adding a floor separating the spray and discharge systems at the pressuriser-dome level. This significantly reduces the dose during maintenance activities on the safety valves, most of which is from the spray nozzles;

 Inclusion in the HR [RB] building of an area dedicated to storing the pressure vessel head (with appropriate shielding);

 Removal of "hot spots" by eliminating pipe connections using socket welds on pipework carrying radioactive fluids, by chemistry optimisation, and by reducing the amount of antimony and chromium in primary system components.

The amount of exposed work (work subject to radiation) has been reduced by the following design choices:

 Design changes to allow maintenance operations to be carried out in the HR [RB] building during power operation, immediately before and immediately after outages. Provision of improved shielding and ventilation in the HR [RB] building zone to which at- power access is permitted ensures a net reduction in the collective radiation doses associatedAPPROVED with outages;  Increased use of bolted connections on key equipment (pressuriser heaters, control rod drive mechanisms etc.);

 Increased size of primary and secondary manways;

 Modification to the SG waterbox layout to give easier access to peripheral tubes;

 Reactor vessel head heat insulation removable as a single unit;

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 26 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

 Absence of a forced ventilation device for the Control Rod Drive Mechanisms (CRDMs) resulting in the elimination of opening and closing operations for the CRDM ventilation system air duct;

 Improvement to reactor vessel level instrumentation to reduce required maintenance operations;

 Routing of the ex-core instrumentation into the reactor-vessel pit through the pool concrete wall to reduce operations associated with instrumentation system covers at the bottom of the pool;

 Optimisation of the fuel handling operation duration;

 Installation of improved shielding around active equipment;

 Use of modular maintenance valves.

Optimisation studies have been carried out on the high dose activities by the designers for installation, materials and operation. Examples include:

 Optimisation of exposure associated with installation of thermal insulation, which is a high dose task in terms of collective and individual dose. Radiation protection modifications currently being studied include use of fast assembly-disassembly thermal insulation on primary and secondary circuit pipework, SGs, pressuriser, and at welds and sensitive tapping points.

 Optimisation of exposure associated with high dose work - site logistics activities such as equipment preparation and monitoring, scaffolding erection and removal, etc. Modifications being studied to optimise logistic operations include provision of shielding anchoring points for high dose activities, installation of fast assembly-disassembly scaffolding, installation of permanent platforms around SG openings etc.

 Optimisation of exposure associated with valve and component maintenance. Optimisation measures include replacement of gate valves with globe valves not requiring cobalt-based hard facing, elimination of pipe joints using socket welds on pipework carrying radioactive fluids, improvement of the water tightness of valves, use where possible of modular-maintenance globe valves to avoid activities such as packing replacement, in-situ grinding of the seat etc.

 Optimisation of doses associated with SG maintenance and inspection. The quantity of exposed work has been minimised by optimising the location of pipes and equipment, as well as the size of the worksites. Access to the interior of the SGs has been improved by increasing the size of access openings compared with N4 NPPs. The frequency of tube bundle cleaning operations on the secondary side has been reduced by selecting materials that limit corrosion, and optimising secondary water chemistry. Additional improvementsAPPROVED have been implemented to reduce damage to tubes and to the feedwater system.

 Optimisation of exposure associated with removal and replacement of the reactor pressure vessel head. Measures taken include optimising the transfer of upper and lower vessel internals underwater, provision of a dedicated storage area for the reactor vessel head, optimising the removal and replacement of the reactor vessel head thermal insulation (insulation removable as a single unit), etc.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 27 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

Taking into account proven modifications and radiological protection modifications under consideration for the initial EPR design, the predicted value of the optimised dose is 0.345 man.Sv per year per unit (achievable over a 10-year operating period), confirming that the dose target level of 0.35 man.Sv per year per unit should be achievable (see Sub-chapter 19.4). This is a significant improvement on the collective dose for the best operating unit of the French fleet, which has achieved 0.44 man.Sv per year over a full cycle of 10 years. Meeting this objective demonstrates that the EPR and HPC target for average collective doses is lower than the design target for collective dose used in earlier PWR plants.

These measures give confidence that the operator dose due to plant operation has been reduced to the minimum practicable level by optimisation of the plant design, and therefore that ALARP principles have been met in respect of worker risk from normal operation of the plant.

8.2. DOSE TO MEMBERS OF THE PUBLIC IN NORMAL OPERATION

Achievement of an ALARP situation requires that radiation doses to the general public due to normal plant operation are minimised and are ALARP.

The initial EPR design is based on the TGs [Ref. 1] which requires similar objectives in that: “The plant shall be designed to limit, following the optimisation principle, the radiation exposure of the public resulting from the discharge of radioactive materials to air or water.” and; “Design provisions have to be made to further reduce the activity and volume of radioactive materials to be removed from the plant as wastes. Taking those materials as a basis, the efforts taken to reduce the releases have to be balanced against the amount of wastes produced by these efforts. Regarding radiation protection, the doses to the public from the releases, the exposures of the personnel and the doses caused by the wastes have to be considered in the optimisation process”.

Based on these principles, the initial EPR design objectives were:

 a reduction in volume of radioactive materials produced by the unit as waste, and that

 doses to members of the public due to wastes and discharges are minimised.

This has resulted in the initial EPR design being optimised to reduce off-site doses to a minimum, showing significant improvements compared with existing French and German NPPs.

The main design measures implemented in the initial EPR and those implemented in the HPC design to reduce the production of radioactive waste are described in the documents submitted under the Radioactive Substances Regulations (RSR) [Ref. 10], and improve the effectiveness of the containment function, in order to reduce off-site radioactive discharges in normal operation. The following gives a summary of key design improvements [Ref. 11] and [Ref. 12]:

 Reduction of the liquid effluent source term by reducing the use of stellites, the cobalt contentAPPROVED of materials and alloys, and the optimised manufacturing of SG tubes.  Optimisation of the EPR chemical parameters to minimise the liquid effluent source term during all periods of operation at power, shutdown and start-up.

 Improvements in the segregation of floor / chemical drains resulting in significant reductions in the activities and volumes of liquids discharged from the effluent treatment systems.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 28 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

 Improved filtration, demineralisation and evaporation techniques for treatment of radioactive liquid effluents.

 Use of hold-up tanks to increase radioactive decay of short lived nuclides before discharge of liquid effluents.

 Reduction in the gaseous effluent term by optimisation of the design of the Gaseous Waste Processing System (TEG [GWPS]). Improvements include sharing of tank ullages; continuous nitrogen flushing of tank ullages and head spaces; recombination of hydrogen released in off-gassing from tanks which helps retain tritium and iodines in the aqueous phase; increased decay of short-lived gases (mainly xenon and krypton) released from the TEG [GWPS] system on absorbent charcoal delay beds.

 Avoidance of pneumatic valves in the HR [RB] building, resulting in reduced gaseous discharges from this building.

 Improved design of the ventilation / filtration system, particularly increased use of iodine traps in the ventilation system of the Nuclear Island buildings.

Radioactive discharge (gaseous, liquid, solid waste and spent fuel volume) levels predicted for the EPR are broadly improved over the existing NPPs in France and Germany and the Sizewell B PWR. This is described in the HPC documents submitted under the RSR [Ref. 10].

Based on the efforts made to reduce the radiation doses to the general public in normal operation, the EPR design is considered to meet the ALARP principle.

The assessment of the off-site collective dose due to normal operation of an EPR performed using the Initial Radiological Assessment (IRA) methodology developed by the UK Environment Agency, is described in the HPC documents submitted under the RSR [Ref. 10].

The purpose of the IRA methodology is to provide an initial conservative assessment of the dose arising from radioactive waste discharges to the environment, and to identify those discharges for which a more detailed assessment should be undertaken. Application of the IRA methodology to the UK EPR gives an annual total dose for the critical group of 25.8 μSv/y. This value is well below the limit for a single installation of 300 µSv/y set by the Environmental Permitting Regulations 2010 [Ref. 13] and considered as part of the SDO-3 in Sub-chapter 3.1, and is close to the level of 20 µSv/y defined as the Basic Safety Objective (BSO) of target 3 in the SAPs [Ref. 9], supporting the view that the risk due to off-site radioactivity emissions is at a very low level, which corresponds to the Broadly Acceptable risk level.

9. USE OF PSA STUDIES IN THE EPR DESIGN

A general objective for the EPR design has been to reinforce the main elements providing defence in depth.APPROVED To achieve this objective, the design has been made on deterministic bases supplemented by the use of probabilistic methods. Reactor operating experience and in–depth studies such as PSA, as well as improvements in knowledge of physical phenomena occurring in accident situations such as core melt scenarios have been taken into account.

PSA can be used to quantitatively demonstrate implementation of the defence-in-depth concept as well as to show that a balance has been achieved between the different levels of protection and that the levels of protection are independent from one another.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 29 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

Different PSA studies have been performed at the initial design stage of the EPR to support the choice of design options, including redundancy and diversity of the safety systems. PSA has also been used to select or reject changes to the main initial EPR options during the BDOP.

As an example, with regard to the availability and reliability of the emergency electrical power supply, PSA was used to determine the number of diesel generators (four EDGs, backed up by two smaller diesels of diverse design, the ultimate diesel generators) and to demonstrate that sufficient independence and diversity exists amongst the two types of diesel generators.

PSA studies have also been used to reduce the impact of common cause failure of redundant systems. This is the case of the EVU [CHRS] system for which several cooling system designs were compared, leading to a final design that includes a dedicated cooling chain, independent of the Component Cooling Water System (RRI [CCWS]), which is cooled by a diverse ultimate heat sink.

In addition to supporting the choice of design options, PSA has been used to confirm the list of events considered in the initial EPR design basis and to define the list of multiple failures, Design Extension Conditions (DEC-A sequences), considered in the framework of core melt prevention.

The systematic use of PSA to develop an optimised design, which minimises risks, subject to practical considerations of cost and constructability, has similarities to the UK process of design optimisation to achieve an ALARP position. It is important to note that use of PSA during the EPR design development phase (1987 to 2006) was based on the application of Level 1 / Level 2 PSA only. The primary objective of the studies was to confirm that design targets for frequency of core damage and large early release of radioactivity had been achieved.

The PSA was extended to a Level 3 analysis in which the off-site consequences of radiological releases due to accidents were calculated. An initial comparison of individual and societal risk levels from the UK EPR Off-site Consequence Risk Assessment (Level 3 PSA) with numerical risk defined in Sub-chapter 3.1 as the SDOs showed that the SDOs targets were met. Specifically, the initial EPR design achieved a Broadly Acceptable level of risk in all Dose Bands of SDO-8. In accordance with the ONR ALARP guidance [Ref. 5], these well supported numerical risk figures were an important element in the initial EPR ALARP demonstration. With these initial EPR design results, the SDOs were likely to be achieved by the HPC design. The current HPC Level 1, 2 and 3 PSA results presented in Sub-chapter 16.2 is an update of this initial analysis, which is reviewed in comparison with the SDOs numerical risk targets defined in Sub-chapter 3.1.

10. CONCLUSIONS ON INITIAL EPR DESIGN REGARDING ALARP

In the previous sections, it has been shown that the initial EPR design process has followed relevant goodAPPROVED practice and has included optioneering reviews where a number of possible options for enhancements to previous designs were considered.

The initial EPR was designed against national and international codes and standards. Feedback from relevant plant operating experiences and R&D was included. A comprehensive design optioneering process was carried out and shared with French and German safety regulators including support from international experts.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 30 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

This has resulted in the addition of enhanced protection to prevent and mitigate the consequences of severe accidents, to protect against external hazards, to improve the capability of the containment function (including reducing the likelihood of radiological releases due to containment bypass sequences) and to increase the use of passive safety measures. The safety improvements have been backed-up by the use of PSA to develop an optimised design that minimises risk. Additionally considerable effort has been expended to reduce the risk to operators and the public due to radiation doses during normal plant operation.

The initial EPR optioneering process has involved a 20-year study to optimise the design, and improve the plant safety, whilst taking into account appropriate consideration of relevant key aspects such as defence-in-depth, cost and constructability. This process is closely analogous to the process of design optimisation to achieve an ALARP solution.

Although an explicit approach to UK ALARP was not directly applied as an integral part of the initial EPR design process, evidence has been provided that this process included many of the key elements which form part of a UK ALARP demonstration including such features as: consideration of relevant good practice from previous designs and their associated facilities, use of relevant codes and standards and implementation of improvements to reduce doses to workers and members of the public during normal plant operation, faults and hazards.

The HPC design is based on the optimised initial EPR design that has been demonstrated to be ALARP, although additional improvements to meet the UK regulations and to adapt this initial generic design into a site specific design for HPC have been identified and are either implemented, or in the process of being implemented. In this additional phase an ALARP process adhering to the ALARP guidance [Ref. 14] is followed and described in Sub-chapter 17.3 and the overall conclusions of the HPC ALARP Assessment are presented in Sub-chapter 17.4.

APPROVED

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 31 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

11. REFERENCES

[1] "Technical Guidelines for the design and construction of the next generation of nuclear pressurised water reactors" adopted during plenary meetings of the GPR and German experts on 19 and 26 October 2000.

[2] EPR Conceptual Safety Features Review File; report jointly prepared by EDF, German Utilities, NPI, Siemens, Framatome, August 1993.

[3] Generic Safety Issues for Nuclear Power Plants with Light Water Reactors and Measures taken for their Resolution - IAEA Technical Document, IAEA-TECDOC-1044, September 1998, IAEA, Vienna.

[4] UK Health and Safety Executive (HSE) - Safety Assessment Principles for Nuclear Facilities (SAPs), 2006 Edition, Revision 1, January 2008.

[5] Nuclear Safety Technical Assessment Guide - Guidance on the Demonstration of ALARP (As Low As Reasonably Practicable), NS-TAST-GD-005, Revision 6, September 2013.

[6] Comparison of EPR Design with HSE/NII SAPS - UK EPR Report, UKEPR-0005-001, Issue 00, June 2008, AREVA/EDF.

[7] New Nuclear power stations: Generic Design Assessment, Design Acceptance Confirmation for the UK EPR reactor, 2012/448621, December 2012.

[8] Nuclear Safety Design Assessment Principles, NNB-OSL-STA-000003, Revision 2.0.

[9] ONR, “Safety Assessment Principles for Nuclear Facilities”, Revision 0, 2014 Edition.

[10] Hinkley Point C Radioactive Substances Regulation Environmental Permit Application, July 2011, NNB Generation Company Limited.

[11] Flamanville 3 EPR - Summary report: specific design provisions related to EPR chemistry, ECEF072084, Revision A1, February 2008, EDF.

[12] Analysis of environmental performance in the EPR France project.,ECEP050315, Revision A1, March 2012, EDF.

[13] Environmental Permitting Regulations - Radioactive Substances Regulation for the Environmental Permitting (England and Wales) 2010, Version 2, September 2011, Department for Environment, Food and Rural Affairs (DEFRA). [14] UK EPRAPPROVED ALARP methodology to support the design modification process, ENSNDR100088, Revision C, July 2016, EDF SEPTEN.

[15] Reactor Safety Issues Resolved by the 2D/3D program GRS report 101 Sept. 1993 2D/3D Program. Work summary report GRS 100. December 1992.

[16] Rapport synthétique d'évaluation BETHSY - Summary report of BETHSY Assessment - CEA, IRSN, EDF, Framatome ANP, SETEX/LETS/02-166, June 2002.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 32 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

[17] The CLOTAIRE International Program – Local Thermohydraulics Measurements in PWR steam Generators Wuhan Conference (China), September 1990.

[18] Axial Economiser steam generator, Transient simulation NURETH 6.

[19] The MEGEVE tests and their analysis by the computer code ANETH Proceedings 6th International topics – Meeting on Nuclear Thermalhydraulic, October 1993, Grenoble France.

[20] Starting up of new steam generator of 1450 MWe plants. 3rd International Steam Generator and Heat Exchanger Conference. Toronto, Canada. June 1998.

[21] R. Krieg et al. Slug impact loading on the vessel head during a postulated steam explosion in pressurised water reactors. Nuclear Technology 111, p 369. 1995.

[22] R. Krieg et al. Model experiments BERDA describing impacts of molten core materials against a PWR vessel head. International Conference on Advanced Reactor Safety ARS. Orlando, Florida. June 1997.

[23] W. Schütz et al. Steam explosion experiments – CEA/FZK Seminar on EPR-related severe accidents research. Karlsruhe. November 1996.

[24] L. Meyer et al. Investigation of the premixing phase of the steam explosion with hot spheres - International Conference on Advanced Reactor Safety ARS – Orlando, Florida. June 1997.

[25] W. Schütz et al. PREMIX, an experimental approach to investigate the mixing behaviour of a hot melt being poured into water - International Conference on Advanced Reactor Safety ARS – Orlando, Florida. June 1997.

[26] D. Magallon et al. Status of FARO/KROTOS melt coolant interaction tests. Water Reactor Safety Meeting. Bethesda, Maryland, USA. October 1995.

[27] P. Piluso et al. Steam explosion of Alumina in Krotos Facility : Is There a Material Effect. ICAPP-05. Seoul, Korea. May 15-19 (2005).

[28] R. Meignen (IRSN). D. Magallon (CEA). Comparative Review of FCI Computer Models Used in the OECD-SERENA Program. Proceedings of ICAPP 05. Seoul, Korea. Paper 5087. May 15-19. 2005.

[29] D. Magallon et al. Status of International Programme SERENA on Fuel Coolant Interaction. ICAPP 05. Seoul, Korea. May 15-19 (2005).

[30] A. Tattegrain. PHEBUS probes core meltdown behaviour : the first results Nuclear Europe Worldscan 9610 – 1995.

[31] A. JonesAPPROVED et al. PHEBUS FP Test Matrix. JRC Technical Note Nr I 96.26. February 1996.

[32] Proceedings of the PHEBUS FP 4th technical seminar. Marseille. March 20-22. 2000.

[33] P. Spitz et al. Mass Transfer Programme in SISYPHE facility. Proceedings of the 5th technical seminar. Aix-en-Provence. June 24-26. 2003.

[34] H. Hirschmann et al. CORVIS. Investigation of Light Water Reactor Lower Head Failure Modes. Nuclear Engineering and Design Vol. 168. pp. 77-104. 1997.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 33 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

[35] J. Devos et al. Pressure vessel and piping design, analysis and severe accidents. ASME Vol. 331. 1996.

[36] J.M. Bonnet et al. Large scale experiments for core melt retention. Workshop on large molten pool heat transfer. CEN Grenoble. France March 1994.

[37] M. Barrachin, F.Defoort. Thermophysical Properties of In-Vessel Corium: MASCA Programme Related Results. Proceedings of MASCA Seminar. Aix en Provence, France. 10-11 June 2004.

[38] T.K. Blanchet, M.M. Pilch, R. Y. Lee, L. Meyer, M. Pellt. Direct Containment Heating Experiments at Low Reactor Coolant System Pressure in the Surtsey test facility. Scandia National Laboratory report. NUREG/CR. 5746. SAND 99-1634. 1999.

[39] L. Meyer et al. Corium dispersal and direct containment heating at low system pressure. Submitted at the 10th International Topical Meeting of Nuclear Reactor Thermal Hydraulics. NURETH 10. Seoul, Korea. October 5-9. 2003.

[40] D. Wilhelm. Recalculation of corium dispersal experiments at low pressure. Submitted at the 10th International Topical Meeting of Nuclear Reactor Thermal Hydraulics. NURETH 10. Seoul, Korea. October 5-9. 2003.

[41] J.M. Seiler et al. Theoretical Analysis for Corium Pool with Miscibility Gap. Nuclear Technology. 141, 233, 2003.

[42] B. Adroguer et al. Core loss during a severe accident (COLOSS). Nuclear Engineering and Design. Vol. 221, 55-76. 2003.

[43] S. Hagen et al. Comparison of the Quench experiments CORA 12, 13, 17. International Quench Workshop Karlsruhe. FZK. 4-6 October 1995.

[44] B.R. Sehgal et al. Assessment of reactor vessel integrity (ARVI). Nuclear Engineering and Design Vol. 221. 25-53. 2003.

[45] G. Azarian et al. Qualification of the MAAP4.04 code on the QUENCH-03 experiment. Proceedings of the 6th International QUENCH workshop. Karlsruhe. October 2000.

[46] W. Hering, Ch. Homann, J.S. Lamy. ISP 45-OECD Comparison report on the Blind Phase of the OECD International Standard Problem No.45 Exercise (QUENCH-06). Report FZKA-6677. March 2002.

[47] Study of the mixing of immiscible liquids. Results of the BALISE experiments Submitted at the 10th International Topical Meeting of Nuclear Reactor Thermal Hydraulics. NURETH 10. Seoul, Korea. October 5-9. 2003.

[48] B. Adroguer et al. COLOSS – CORE LOSS during a severe accident. Nuclear EngineeringAPPROVED and Design Vol. 235, 173-198. 2005.

[49] H. Karwat et al. SOAR on containment thermohydraulics and hydrogen distribution. NEA/CSNI/R(99) 16 June 1999.

[50] P. Royl et al. Analysis of Mitigating Measures during Steam/Hydrogen Distributions in Nuclear Reactor Containments with the 3d field Code GASFLOW. OECD workshop on the implementation of hydrogen mitigation techniques – Winnipeg, Manitoba, Canada. May 1996.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 34 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

[51] L. Wolf et al. Detailed Assessment of the HDR mixing experiments E11. Proc. Intern. Conf. "New trends in Nuclear System Thermohydraulics" Pisa, Italy. 1994.

[52] T. Kanzleiter. HYJET/PACOS Versuche im Modelcontainment. Abschlussbericht. [HYJET/PACOS Tests in the Model Containment. Final Report.] Battelle Report BMBF BF-R40.075-01. December 1996.

[53] G. Langer et al. Experimental investigation of the hydrogen distribution in the containment of a light water reactor following a coolant loss accident. Battelle Report BF-R-63.363.3 NRC Translation 801. 1980.

[54] H. Tekuza et al. Final Comparison Report on ISP-35: NUPEC Hydrogen Mixing and distribution Test M-7-1. OECD Report OECD/GD (95) 29 NEA/CSNI/R (94) 29 Paris. December 1994.

[55] P. Royl et al. Analyses of containment experiments with GASFLOW II. Submitted at the 10th International Topical Meeting of Nuclear Reactor Thermal Hydraulics. NURETH 10. Seoul, Korea. October 5-9. 2003.

[56] J. Vendel et al. “ISP 47” containment hydraulic computer code exercise based on experimental facilities. Submitted at the 10th International Topical Meeting of Nuclear Reactor Thermal Hydraulics. NURETH 10. Seoul, Korea. October 5-9. 2003.

[57] E. Studer et al. On the Use of the MISTRA Coupled Effect Test Facility for the Validation of Containment Thermal-hydraulic codes. Submitted at the 10th International Topical Meeting of Nuclear Reactor Thermal Hydraulics. NURETH 10. Seoul, Korea. October 5- 9. 2003.

[58] T. Kanzleiter et al. First results of the ThAI Thermal Hydraulic containment Tests. ICONE 9. Nice. April 2001.

[59] T. Kanzleiter et al. ThAI multicompartment experiments with atmospheric stratification. NURETH 11. Avignon. October 3-6. 2005.

[60] W. Breitung et al. SOAR on flame acceleration and deflagration to detonation transition in nuclear safety. NEA/CSNI/R(2000)7. August 2000.

[61] A. Veser et al. Multicompartimental simulation of Hydrogen Distribution and Turbulent Combustion in Severe Accidents (HDC). European Commission: FISA 99 EU Research in Reactor Safety. 29. November-1- December 1999.

[62] T. Büscher et al. Analyse Der Bedeutung der Phänomene HPME/DCH und Dampfexplosion für den Quellterm im Sicherheitsbehälter bei schweren Störfällen. Abschlussbericht zum Forschungsvorhaben BMWA 1501084. LEE-10 [Analysis of the Significance of the Phenomena HPME/DCH and Steam Explosion for the Source Term in the Containment of Light Water Reactors in Case of Severe Accidents. Final Report, ReactorAPPROVED Safety Research Project No. 1501084]. August 2003.

[63] W. Breitung et al. Integral large scale experiments on hydrogen combustion for severe accident code validation - HYCOM. Nuclear Engineering and Design 235 253-274. 2005.

[64] M. Heitsch et al. Improvement and application of hydrogen combustion models. Submitted at the 10th International Topical Meeting of Nuclear Reactor Thermal Hydraulics. NURETH 10. Seoul, Korea. October 5-9. 2003.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 35 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

[65] W. Breitung. Numerical Simulation of Turbulent Hydrogen Deflagration in Severe Reactor Accidents. FZK Nachrichten - NR 28. Heft 213. S 175.1996.

[66] B. Durst et al. Investigation of turbulent deflagrations with representative Flow obstacles. OECD workshop on the implementation of hydrogen mitigation techniques. Winnipeg, Manitoba, Canada. May 1996.

[67] N. Arey et al Influence of transport phenomena on the structures of lean premixed hydrogen air flames. Winter Meeting "Thermalhydraulics of Severe Accidents" ANS 1995.

[68] O. Braillard et al. Test of passive catalytic recombiners (pars) for combustible gas control in nuclear power plants. International Topical Meeting on Advanced Reactor Safety ARS. Orlando, Florida. June 1997.

[69] T. Kanzleiter. Experimental Investigation on Recombiner Efficiency in the Battelle Model Containment. International Workshop on Hydrogen Research for Reactor Safety Munich. September 1994.

[70] M. Carcassi et al. HYMI: final summary report. CONT-HYMI (99) – P035.1999 and references therein.

[71] E. Studer et al. The H2PAR facility for hydrogen research. OECD workshop on the implementation of hydrogen mitigation techniques. Winnipeg, Manitoba, Canada. May 1996.

[72] E. Studer et al. Assessment of hydrogen risk in PWR. Eurosafe. November 1999.

[73] B. Eckardt et al. Containment hydrogen control and filtered venting design and implementation. Proceedings of the OECD Workshop on the implementation of severe accident management measures held at PSI. Villingen, Switzerland. September 2001.

[74] Description of the PAR Qualification Tests. Framatome Technical Report NGPS5/2004/en/0076 Rev. B; EdF CP0, CPY Plants. 2004.

[75] M.L. Charbonneau et al. Experimental Analysis and Summary Report for LOFT. Project Fission Product Experiment LOFT FP2. OECD LOFT6T63806. June 1989.

[76] A.M. Beard et al. FALCON Experiments: a comparison of FALCON tests Fal 17 and Fal 18. AEA RS 2380. March 1993.

[77] M. Firnhaber et al. Draft Specification of the International Standard Problem ISP 44: KAEVER. Experiments on the Behaviour of Core-Melt Aerosols in a LWR Containment. GRS. January 2000.

[78] J.A. Capitao. 5th STORM Meeting: Analysis and First Experimental Results. JRC TechnicalAPPROVED Note Nr. I 96.08. January 1996.

[79] T. Kanzleiter et al. ThAI multi-compartment experiments with atmospheric stratification. NURETH 11. Avignon. October 3-6. 2005.

[80] F. Funke et al. Multi-compartmental Iodine Tests at the ThAI Facility. Eurosafe. Berlin. 2004.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 36 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

[81] G. Langrock. Synthesis of PARIS Results (Programme on Air Radiolysis, Iodine and Surfaces). Work Report NGTR/2005/en/0308 Revision A. AREVA. December 2005.

[82] P. Spitz et al. Mass Transfer Programme in SISYPHE facility. Proceedings of the 5th technical seminar. Aix-en-Provence. June 24-26. 2003.

[83] B. Clement. Towards reducing the uncertainties on Source Term Evaluations: an IRSN/CEA/EdF R&D programme. Eurosafe. Paris. 2003.

[84] Alsmeyer et al. BETA experimental results on melt/concrete interaction. CSNI Specialist's Meeting on Core-Debris-Concrete Interaction. EPRI-NP-5054-5R, pp2-2 and 2-17. February 1987.

[85] D H Thompson et al. Compilation, analysis and interpretation of ACE phase C and MACE experimental data – MCCI / Thermohydraulic results. ACEX TR-C-14, Vol 1. Argonne Nat. Lab. November 1997.

[86] M.T. Farmer. M1b Data Report. MACE-TR-D6, Argonne Nat. Lab. September 1992.

[87] M.T. Farmer. MACE test M3b. Data Report MACE-TR-D13. Vol. 1/2. Argonne Nat. Lab. August 1999

[88] M.T. Farmer. MACE Test M4. Data Report - Argonne Nat. Lab. August 1999.

[89] J.M. Bonnet. Thermal hydraulic phenomena in corium pools for ex-vessel situations: the BALI experiment. OECD Workshop on ex-vessel coolability. Karlsruhe, Germany. FZKA 64753. 1999.

[90] TR 61, ‘Description, validation and application of the MCCI code COSACO’. Framatome Work Report NGPS4/2004/en/0100 Rev. B. 24.05.2004.

[91] W. Steinwarz et al. Experimental investigations on Corium interaction with refractory and sacrificial layers (CORESA). BMWI project 1501212. Final report SNT-AB-2002-01. Siempelkamp Nukleartechnik GmbH.

[92] M. Fischer et al. Experimental investigations on Corium interaction with refractory and sacrificial layers (CORESA). BMWI project 1501211. Final report. Framatome ANP GmbH. October. 2002.

[93] B. Eppinger, F. Fellmoser, G. Fieg, H. Massier, G. Stern. Experiments on concrete erosion by a Corium melt in the EPR cavity: KAPOOL 6-8. FZKA 6453. Forschungszentrum Karlsruhe. March 2001.

[94] J. M. Vetteau et al. CORINE Experiments and Theoretical Modelling. FISA 95 Symposium EU Research on Severe Accidents. Luxembourg. November 1995.

[95] G. FiegAPPROVED et al. Simulation Experiments on the spreading behaviour of Molten Core Melts. 1996 National Heat Transfer Conference. Houston. August 1996.

[96] W. Scholtyssek et al. Recent Results of Melt Spreading and Cooling Experiments at Forschungszentrum Karlsruhe - the KATS and COMET Projects. CSARP Meeting. Bethseda. May 1996.

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 37 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

[97] B. Eppinger et al. Simulationsexperimente zum Ausbreitungsverhalten von Kernschmelze: KATS 8-17. [Simulation Experiments on the Spreading Behaviour of Core Melts: KATS 8-17]. FZKA 6589. Forschungszentrum Karlsruhe. March 2001.

[98] Sappok, Steinwartz. Large Scale Experiments on Ex-vessel Core Melt Behaviour. International Conference on Advanced Reactor Safety ARS. Orlando. Florida June 1997.

[99] G. Cognet et al. Corium spreading and coolability. FISA 97 Symposium on EU Research on Severe Accidents. November 1997.

[100] I.M. Shepberd et al. Modelling fission product vapour transport for the FALCON facility. Nuclear Technology 110, p 181-187. 1988.

[101] H. Wider. Transient Cooling of Shallow Debris Beds in the First Two FARO LWR Experiments. Nuclear Engineering and Design 157, p 395-408. 1995.

[102] B.R. Seghal et al. Experimental investigation of melt spreading in one-dimensional channel. Report EU-CSC-1D1-97. Royal Institute of Technology. Stockholm. August 1997.

[103] J.M. Bonnet, J.M. Seiler. Coolability of corium spread onto concrete under water, the PERCOLA model. Proceedings of the 2nd OECD (NEA) CSNI Specialist Meeting on Molten Core Debris-Concrete Interactions, pp. 347-354.Karlsruhe, Germany. April 1992.

[104] M. T. Farmer, S.Lomperski (ANL), S. Basu (US-NRC). Status of the Melt Coolability and Concrete Interaction (MCCI) Program at Argonne National Laboratory. Paper 5644. Proceedings of ICAPP ’05; Seoul, Korea. May 15-19. 2005.

[105] S. Rouge, I. Dor, G. Greffraye. Reactor Vessel External cooling for Corium Retention - SULTAN Experimental Program and Modelling with CATHARE Code. OECD Workshop on In-Vessel debris retention and coolability. Garchingen. Germany. 3-6 March 1998.

APPROVED

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 38 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100097

SUB-CHAPTER 17.2 - TABLE 1 : ORGANISATIONAL RELATIONSHIPS BETWEEN FRENCH AND GERMAN SAFETY BODIES

BMU DFD DSIN (ASN) Bundesministerium Deutsh Französicher Direction de la Sûreté Für Umwelt, Directionauschuss des Installations Naturschutz Nucléaires und Reaktorsichereit

RSK Meetings GPR RSK / GPR Reaktor Groupe permanent Sicherheitskommission Working groups chargé des Réacteurs Nucléaires

GRS GRS / IPSN IPSN (IRSN) Geselschaft für Working groups Institut de Protection Anlagen und et de Sûreté Nucléaire Reaktorsicherheit

APPROVED

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 39 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice and Optioneering HPC-NNBOSL-U0-000-RES- in the Initial EPR Design 100098

SUB-CHAPTER 17.2 - TABLE 2 : ORGANISATION OF THE RELATIONSHIP BETWEEN FRENCH AND GERMAN CO- DESIGNERS

APPROVED

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 40 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100098

SUB-CHAPTER 17.2 - TABLE 3 : DIFFERENT PHASES OF THE EPR DESIGN PROCESS

Dates Design Phases EPR Project Safety bodies Comments deliverables deliverables 1986 NPI founded Letter DSIN in 1989

984/91

Letter GPR Preparatory phase 93/18 1991

08/1993 Conceptual Safety Letter DSIN Features 1321/93 Review File (CSFRF)

Technical Reports Letters GPR Consolidation 94/20 ; phase GPR 94/28; GPR 94/42; GPR 94/50; GPR 94/62; GPR 95/04. 01/1995 Main Features Files Letter DSIN Signature of (MFF) 51/95 the BD contract

Technical Reports Letters GPR Basic Design phase 95/54, GPR 95/59; GPR 96/24; GPR 96/25; GPR 96/47; GPR 97/01; GPR 97/25; GPR 97/41; GPR 97/60. 10/1997 Basic Design Report Signature of APPROVED(BDR 97) the BDOP contract Basic Design Technical Reports Letters GPR Optimisation phase 98/07; GPR 98/15; GPR 98/31. 11/1998 Basic Design Report Withdrawal of (BDR 98) BMU/RSK

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 41 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice HPC-NNBOSL-U0-000-RES- and Optioneering in the Initial EPR Design 100098

02/1999 Basic Design Report (BDR 99) Technical Reports Letters GPR Post Basic Design 99/06; Optimisation phase GPR 99/32; GPR 99/43; GPR 99/55; GPR 00/16.

10/2000 Letter EDF ref SN/99- Technical EDF leader of 1638 Guidelines the FA3 design Technical Reports Letters GPR 02/24; GPR 03/25; GPR 04/12. 12/2003 Detailed Design PSAR (project version) Letter DGSNR Signature of Studies phase 2003 729/2004 OL3 contract EPR Safety Options PSAR (project version) Letters GPR Decision to 2005 05/23; launch FA3 GPR 05/35. project. Construction licence granted for OL3 05/2006 Request for PSAR (project version) Letters GPR construction 2006 06/06; license (DAC) GPR 06/21.

04/2007 Construction licence Decree 2007- granted 534 for FA3

APPROVED

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 42 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice and Optioneering HPC-NNBOSL-U0-000-RES- in the Initial EPR Design 100098

SUB-CHAPTER 17.2 - TABLE 4 : R&D PROGRAMMES / TESTS IN SUPPORT TO THE EPR DESIGN

Components / Event Physical Phenomena Experimental Programmes/Tests Hydraulic Design relating to the flow distribution is based on STAR-CD calculations with a validation based on tests carried Vessel Internals (lower and out in the HYDRA mock-up (small scale). The final validation has been achieved on the basis of the JULIETTE and upper plenums) ROMEO tests, for the lower and upper plenums respectively, at a 1/5 scale (Centre Technique du Creusot). Flow-induced vibration Integral test: VIB, 1/8.5 scale mock-up. Hydraulic and vibration MAGALY tests, 1/1 scale (design optimisation) Control rods – CALVA tests Rod Cluster Control Materials (wear) AURORE and FANI tests Assembly (RCCA) guides Fatigue CALVA tests Mechanical behaviour in case CALVA tests of LOCA and Earthquake Control rod drive Many aspects of the CRDM KOPRA tests mechanism (CRDM) performance, including the rod drop time Heavy reflector Hydraulic HCL tests Loss Of Coolant Accident Thermal-Hydraulic Complementary validation database for the CATHARE code (e.g. EPR specific features): (LOCA) UPTF tests [Ref. 15] BETHSY tests (CEA) [Ref. 16] SGTR Thermal-Hydraulic BETHSY tests (CEA) Steam Generator internals Thermal-Hydraulic and flow- Chooz B1 Steam Generator tests (confirmation of the results from CLOTAIRE Programme [Ref. 17] and MEGEVE induced vibrations tests [Ref. 18] to [Ref. 20] Pressuriser Relief Valves Hydraulic and Mechanic Valve prototype tests

Core-melt Accident Steam Explosion BERDA tests (FZK) [Ref. 21] [Ref. 22] BILLEAU (CEA) [Ref. 23] and QUEOS (FZK) [Ref. 24] tests PREMIX (FZK) [Ref. 25] and FARO (JRC Ispra) [Ref. 26] tests ECO (FZK) and KROTOS (JRC Ispra) tests [Ref. 26] [Ref. 27] Analyses in the frame of the OECD SERENA Programme [Ref. 20] [Ref. 21] Core-melt Accident RCP [RCS] behaviour, Integral tests: PHEBUS FP Programme (IRSN) [Ref. 30] to [Ref. 33] including impact of RPV failure RPV bottom mechanical behaviour: CORVIS (PSI) [Ref. 34] and RUPTHER (CEA) [Ref. 35] tests Corium behaviour in-vessel: KAJET (FZK) and BALI (CEA) tests [Ref. 36], OECD Programmes RASPLAV and APPROVEDMASCA (Kurchatov Institute) [Ref. 37] High Pressure Melt Ejection (corium dispersion) and DCH: SNL tests [Ref. 38] and DISCO tests (FZK) [Ref. 39]

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 43 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice and Optioneering HPC-NNBOSL-U0-000-RES- in the Initial EPR Design 100098

Components / Event Physical Phenomena Experimental Programmes/Tests [Ref. 40] Analysis of Thermo-Hydraulic and Thermochemistry coupled phenomena [Ref. 41] Other analytical works using computer codes [Ref. 42] Core-melt Accident Hydrogen production CORA tests (FZK) [Ref. 43] in-vessel QUENCH tests (FZK) [Ref. 44] PHEBUS-FP tests (IRSN) Computer code analyses [Ref. 30] to [Ref. 33] & [Ref. 45] to [Ref. 48] Core-melt Accident Hydrogen Distribution in the OECD State-of-the-art report of interest [Ref. 49] Reactor Building HDR tests [Ref. 50] [Ref. 51] Battelle tests [Ref. 52] [Ref. 53] NUPEC tests [Ref. 54] Computer code analyses [Ref. 55] TOSQAN tests (IRSN) [Ref. 56] MISTRA tests (CEA) [Ref. 57] ThAI tests (Becker Technology) and OECD ISP-47 [Ref. 58] [Ref. 59] Core-melt Accident Hydrogen Combustion OECD State-of-the-art report of interest [Ref. 60] HDC experiments [Ref. 61] [Ref. 62] HYCOM Programme [Ref. 63] [Ref. 64], including tube experiments TORPEDO, DRIVER and RUT Detonation tests at FZK [Ref. 65] and TUM [Ref. 66] [Ref. 67] ENACCEF tests (CNRS Orleans) Passive Autocatalytic - KALI H2 tests (CEA) [Ref. 68] Recombiners Battelle MC tests [Ref. 69] [Ref. 68] [Ref. 70] H2PAR tests (CEA-IRSN) [Ref. 71] [Ref. 72] Qualification Programme of the AREVA PARs [Ref. 73] [Ref. 74] Core-melt Accident Fission Product Transport in PHEBUS-FP Programme (IRSN) [Ref. 30] to [Ref. 33], the core and primary system LOFT (INEL) [Ref. 75] FALCON tests (AEA-Winfrith) [Ref. 76] CHIP tests (CEA) [Ref. 77] Fission Product Resuspension STORM tests (JRC Ispra) [Ref. 78] KAREX tests (FZK) Iodine behaviour ThAI experiments [Ref. 50][Ref. 79][Ref. 80] PARIS tests (AREVA) [Ref. 81] SISYPHE tests (IRSN) [Ref. 82] EPICUR tests (IRSN) [Ref. 83] APPROVEDAerosol Transport in the KAEVER [Ref. 77] (ISP-44) Reactor Building

NOT PROTECTIVELY MARKED NOT PROTECTIVELY MARKED Page No.: 44 / 44 REDACTED PUBLIC VERSION

HPC PCSR3 – Sub-chapter 17.2 - Reference: Demonstration of Relevant Good Practice and Optioneering HPC-NNBOSL-U0-000-RES- in the Initial EPR Design 100098

Components / Event Physical Phenomena Experimental Programmes/Tests Containment wall - Liner Mechanical, Leakage MAEVA (EDF) Core-Catcher Molten Core – Concrete BETA tests (FZK) [Ref. 84] Interaction (MCCI) ACE tests (ANL) [Ref. 85] MACE tests (ANL) [Ref. 86] to [Ref. 88] BALI [Ref. 89] and BALISE [Ref. 90] tests (CEA) CORESA tests (Germany) [Ref. 91] [Ref. 92] OECD MCCI Programme (tests at ANL) Core-Catcher Corium – ZrO2 interaction CIRMAT tests (LSK Saint-Petersburg) and CORESA programme (Germany) [Ref. 91] [Ref. 92] Core-Catcher Melt Plug behaviour KAPOOL tests (FZK) [Ref. 93] Core-Catcher Corium spreading CORINE tests (CEA) [Ref. 94] KATS tests (FZK) [Ref. 95] to [Ref. 97] COMAS tests (SNT) [Ref. 98] VULCANO tests (CEA) [Ref. 99] [Ref. 100] FARO spreading tests (JRC Ispra) [Ref. 101] S3E test (RIT) [Ref. 102] Core-Catcher Corium Quenching MACE tests (ANL) [Ref. 86] to [Ref. 88] KAPOOL tests (FZK) [Ref. 93] PERCOLA tests (CEA) [Ref. 103] SSWICS tests (ANL) [Ref. 57] ECOKATS tests (FZK) Core-Catcher Long Term Corium Cooling Corium behaviour: SULTAN tests (CEA) [Ref. 104] Core Catcher Cooling Channel Thermal-Hydraulic tests (AREVA Erlangen) [Ref. 105] . APPROVED

NOT PROTECTIVELY MARKED