RIDM Use in CNSC Category 3 Safety...

Application of the CNSC Risk-informed Decision Making Process

to Category 3 CANDU Safety Issues

Development of Risk-Informed Regulatory Positions for CANDU Safety Issues

August 2009 E-Doc # 3413831

Approved by: Date:

____________________________________________________G. Frappier, Director GeneralDirectorate of Assessment and Analysis

_____________________

Approved by: Date:

____________________________________________________G. Rzentkowski, Director GeneralDirectorate of Power Reactor Regulation

_____________________

ii

EXECUTIVE SUMMARY

Regulatory and industry experience with operating CANDU reactors has led to the identification of several generic Safety Issues. Despite continuing efforts directed at ensuring and enhancing safety of operating plants, these Safety Issues remain at various stages of resolution.

In 2007, the staff of the Canadian Nuclear Safety Commission (CNSC) assessed the status of outstanding design and analysis Safety Issues for Canadian CANDU reactors, and identified control measures to address potential residual concerns on nuclear safety. The initial list of issues was developed using the IAEA TECDOC-1554 “Generic Safety Issues for Nuclear Power Plants with Pressurized Heavy Water Reactors and Measures for their Resolution”. Additional issues were identified through regulatory oversight of currently operating reactors, results of life extension assessments, and pre-licensing reviews of new CANDU designs. These Safety Issues were classified into three broad categories according to the adequacy and effectiveness of the control measures implemented by the Licensees to maintain safety margins. The issues that were considered relevant to CANDU reactors in operation in Canada were then assessed using a Risk Informed Decision Making (RIDM) process.

Following the presentation in September 2007 of this assessment to the CANDU reactor licence holders in Canada, the Canadian Nuclear Safety Commission and the Industry agreed to establish a joint Working Group responsible for the review of the assessment of the issues that were identified by the Canadian Nuclear Safety Commission as applicable to the reactors in operation in Canada, and which are referred to as the Category 3 Safety Issues. The Terms of Reference of the Working Group specify that the group was to work by consensus. The overall objectives of the joint CNSC/Industry Working Group are to:

1. Progress the resolution of the Category 3 issues using Risk Informed Decision Making (RIDM) as soon as reasonably practical.

2. Increase CNSC/Industry alignment on Risk Informed Decision Making (RIDM), including recommending the final detailed process and documentation structure for Risk Informed Decision Making (RIDM) application for both the Canadian Nuclear Safety Commission and the Industry.

This document is an update of the Canadian Nuclear Safety Commission report that was issued in 2007. It documents the results of the activities of the Working Group that were aimed at making progress on the resolution of the Category 3 issues. The deliberations on the application of the Risk Informed Decision Making (RIDM) process served as inputs to update the Canadian Nuclear Safety Commission Risk Informed Decision Making (RIDM) process; separate documents on the activities to increase CNSC/ Industry alignment on RIDM, including an updated Risk Informed Decision Making (RIDM) process, have also been prepared.

In order to progress the resolution of the Category 3 issues, the first task performed was to revise the definition of the various issues. The aim of this activity was to ensure that the issues were clearly defined and that there was a common understanding between the Canadian Nuclear Safety Commission and the Industry of the issues. The report includes a summary description of each of the twenty issues. More detailed descriptions are provided in 9.3.

iii

The second task involved updating the risk evaluation and assessment of the various issues. This update was carried out in taking into account the clarifications to the Risk Informed Decision Making (RIDM) process and the most recent information on the Safety Issues that was not accounted for in the previous assessment. This exercise has led to re-categorization of 4 issues to lower categories. Specifically:

• AA 7 Analysis for pressure tube failure with consequential loss of moderator – is moved to Category 1

• CI 2 Deterioration of core internals – is moved to Category 2

• GL 4 Inadequacy of reliability data – is moved to Category 2

• SS 1 ECCS sump screen adequacy – is moved to Category 1

When considering the safety areas related to public risks, namely Severe Accident Risks and Radiological Dose to Public at Design Basis Accidents (DBA), the Risk Significance Levels for the various risk scenarios are all within the tolerable region (RSL equal to 1 or 2). Risk Significance Levels for “negative impacts on safety” for some risk scenarios are in the Unacceptable region (RSL 3). This reflects the fact that for some issues, it is considered that there are still gaps in the understanding of the issues which affects the defense-in-depth and the safety margins.

As a consequence, the Risk Control Measures (RCMs) to reduce the risks in the “negative impacts on safety” safety areas are generally aimed at improving the understanding of the Safety Issue, and to address margins, and uncertainties associated with the Safety Issue. More specifically, the results of application of the Risk Informed Decision Making (RIDM) process indicate that most of the outstanding Safety Issues can be addressed by further work in the following areas:

• validation of data, models and codes used in accident analyses (AA 3; AA 8; IH 6; PF 15; PF 20; PSA 3; SS 5; SS 8; LBLOCA issues: AA 9, PF 12, PF 9, PF 10)

• acquisition of additional experimental data on fuel behavior under accident conditions (PF 18; LBLOCA issues: PF 9, PF 10);

• management of ageing of System Structure Component (SSC) and assessment of the impact of ageing on plant response to accidents (CI 1, GL 3; PF 19);

• implementation of design improvements where confirmed by the above mentioned activities (IH 6; PSA 3; SS 5; LBLOCA issues: AA 9, PF 12, PF 9, PF 10).

The LBLOCA (LBLOCA) safety related issues, namely AA 9 (Analysis for Void Reactivity Coefficient), PF 12 (Channel Voiding During Large LOCA), PF 9 (Fuel Behaviour in High Temperature Transients), PF 10 (Fuel Behaviour in Power Pulse Transients) remain high-profile issues.

iv

A CNSC/Industry Working Group was set up to better define the issues pertaining to Large Break Loss of Coolant Accident (LBLOCA) and to identify Risk Control Measures that could address the LBLOCA-related issues. The main conclusion of the work carried out by the CNSC/Industry LBLOCA Working Group is that two (Risk Control Measures (RCM)) could be considered to address the issues related to Large Break Loss of Coolant Accident (LBLOCA), namely:

• the Composite Analytical approach option (RCM-1) and

• the Low Void Reactivity Fuel (LVRF) option (RCM-2).

The Composite Analytical approach involves a partial reclassification of the classical LBLOCA event considered in existing CANDU design to the Beyond Design Basis Accident (BDBA) category and other analytical activities aimed at providing a more representative assessment of the consequences of this event, and confirmation that safety margins are adequate. This approach is expected to confirm the level of confidence in the adequacy of existing design provisions and the supporting safety case.

Low Void Reactivity Fuel (LVRF) involves the implementation of fuel design changes to reduce the positive coolant void reactivity, and as such alleviates the root cause of the problem and therefore enhances the robustness of the Loss of Coolant Accident (LOCA) safety case.

Assessments of the merits of the Composite Analytical approach (RCM-1) and the LVRF option (RCM-2), based on the selected evaluation criteria, indicate that both Risk Control Measures (RCM) are comparable in addressing the Large Break Loss of Coolant Accident (LBLOCA)-related CANDU Safety Issues.

Based on the results of the assessment of these Risk Control Measures (RCM) by the RIDM Working Group, it was concluded that the Licensees need to determine which option they will pursue to address the LBLOCA-related CANDU Safety Issues for their facilities. A complete justification of the selected option, including the technical rationale, implementation timeline, and development and implementation costs needs to be provided. More precisely, the Licensees need to decide whether they will:

1. Implement the Composite Analytical approach (RCM-1).

A program defining the detailed scope, tasks, success criteria for the elements of the Composite Analytical approach, and schedule will need to be prepared for development and implementation of the Composite Analytical approach. A Terms of Reference, with clear accountabilities for the Canadian Nuclear Safety Commission and the Industry participants, will need to be developed as well.

Considering the challenges regarding the implementation of this RCM, and consistent with the Risk Informed Decision Making (RIDM) process, a monitoring process will need to be put in place to:

• demonstrate that the level of confidence in the successful outcome of the Composite Analytical approach increases with time and

v

• verify that the proposed approach is effective in reducing the Risk of Negative Impact on Safety of the Category 3 issues related to Large Break Loss of Coolant Accident (LBLOCA).

In this approach, Licensees may also include design improvements not related to Low Void Reactivity Fuel.

The LVRF option is considered to be the fall back option in the event that the success criteria for the Composite Analytical approach are not met. As such, a high level schedule for LVRF implementation (including a cost estimate for development and implementation) needs to be developed in parallel with implementation of the Composite Analytical approach.

or

2. Implement LVRF (RCM-2).

A program defining the detailed scope, tasks, and schedule will need to be prepared for development and implementation of the Low Void Reactivity Fuel.

Work also needs to be performed in two areas that are essential elements of any overall solution. These areas are:

• Technical Area #1 (TA1): This technical area relates to qualification of reactor physics predictions and uncertainty estimation of the reactivity feedback coefficients and kinetics parameters, with special focus on the Coolant Void Reactivity and related uncertainties.

• Technical Area #2 (TA2): This technical area relates to the adequacy of the acceptance criteria for design basis LBLOCA, confidence in simulation models used in safety analysis including validation, and the relevant experimental basis for Large Break Loss of Coolant Accident (LBLOCA).

Finally, the report provides schedules for implementing the various Risk Control Measures that are proposed; the Risk Control Measures (RCM) with the schedule for their implementation are summarized in the Table below. These schedules and the monitoring process to verify the progress of the implementation of the Risk Control Measures (RCM) have to be agreed between the Canadian Nuclear Safety Commission Executives and the Canadian Nuclear Utility Executive Forum ( CNUEF).

Issue Risk Control MeasuresAA 3 Computer code and plant model validation

Update Technical Basis Document and Validation Matrices. Develop Code accuracy and uncertainty analyses methodologies: Target date: December 31, 2009. In addition, a specific milestone to close this issue will be established to summarize the work on Safety Analysis Improvement. A Safety Analysis Improvement Project Plan is to be completed by December 31, 2009.

To address the issue in the short and medium term (i.e., until gaps are filled), additional measures should continue to be taken in the safety analysis performed in the meantime to account for any shortcomings that have been identified. Moreover, code

vi

Issue Risk Control Measuresvalidation is a continuous process and the Industry will continue code validation work and keep on-going discussions with the CNSC.

Successful completion of the proposed work is expected to result in improved confidence in computer code predictions.

CI 1 Fuel channel integrity and effect on core internals

Document and Implement an Integrated Fuel Channel Ageing Management Plan (FC AMP): Improve pressure tube ageing management program to ensure that the consequences of ageing on fuel channel integrity are adequately managed, and that the appropriate information is collected to support the safety analysis assumptions related to pre-accident pressure tubes characteristics. Target date: December 31, 2011

Successful completion of the proposed Risk Control Measures (RCM) is expected to result in fuel channel ageing management programs that ensure that the consequences of ageing on fuel channel integrity are adequately managed, and that the appropriate information to continue to confirm safety analysis assumptions is collected.

GL 3 Ageing of equipment and structures

Document and Implement an Integrated Ageing Management Plan (AMP): Improve ageing management programs to ensure that the consequences of ageing on Systems Important to Safety are adequately managed, and that the appropriate information is collected to support safety analysis assumptions. Target date: December 31, 2011.

Complete condition assessment in the context of plant life extension projects.

Successful completion of the proposed Risk Control Measures (RCM) is expected to result in Integrated Ageing Management Programs that ensures that System Structure Component (SSC) ageing is understood and managed effectively, and that ageing effects of System Structure Component are detected (through inspection, testing or surveillance programs) and corrective actions taken (operating limits, operation, maintenance, repair, replacement) before loss of SSC integrity or functional capability occurs. In addition, the program should ensure that the appropriate information is collected to support the safety analysis.

IH 6 Need for systematic assessment of high energy line break effects

Complete a systematic assessment of high energy line break effects. Completion of the proposed Risk Control Measure requires a systematic review of the dynamic and environmental effects of high energy piping breaks inside the containment and the consequences on plant safety, an assessment of the consequential damage associated with the postulated failure and identification of potential design improvements. Target date: Station specific – Linked with Life Extension Project.

PF 15 GAI 95G01: Molten fuel/moderator interaction

The closure document (COG-08-2054) summarizing the entire Molten Fuel/Moderator Interaction (MFMI) program conducted at Argonne National Laboratories and at AECL’s Chalk River Laboratories has been completed and submitted to the CNSC. Based, on information submitted to date, CNSC expects closure of this issue by December 2009.

Successful completion of the proposed Risk Control Measures (RCM) involves the acceptance by the CNSC that the consequences of molten fuel/moderator interaction are manageable.

PF 18 Fuel bundle/element behaviour

As part of this work, the Licensees will produce:

• Experimental evidence to clarify the conditions for fuel deformation and for fuel sheath failure (i.e. dryout, fuel temperature, timing of failure), and for consequential

vii

Issue Risk Control Measuresunder post-dryout conditions

failure of fuel channels.

• Establish firm acceptance criteria for Special Shutdown Systems (SDS) and Reactor Regulating System (RRS) trips to ensure their effectiveness.

This work is carried out through various COG work packages. Details are provided in Appendix E. The target date to complete the program is March 2013.

Successful completion of the proposed Risk Control Measures (RCM) is expected to result in an improved knowledge for post-dryout fuel, fuel bundle and pressure tube behaviour, in support of the current safety case.

PF 19 Impact of ageing on safe plant operation

Document and Implement an Integrated Ageing Management Program (AMP) that ensures that plant ageing mechanisms are identified in all safe operating limits, and collects information appropriate to confirm safety analysis assumptions. Target date: December 31, 2011.

Successful implementation of the proposed Risk Control Measures (RCM) is expected to result in Integrated Ageing Management Programs that ensures that plant ageing mechanisms are identified, their impacts determined and addressed in an integrated manner, and are adequately accounted for in the shutdown system trip parameter setpoint adjustments, and other safe operating limits.

PF 20 Analysis methodology for NOP / ROP

The Industry NOP/ROP Working Group on new Neutron/Regional Overpower Protection (NOP/ROP) methodology should continue to perform the activities that were identified in the Working Group Terms of Reference: WP23009 NOP Trip Effectiveness Methodology, and includes follow-up on the recommendation from the Independent Technical Panel's assessment of the proposed new NOP methodology. Bruce Power and OPG1 will provide a program plan to address these comments by August 31st, 2009.

Successful completion of the proposed Risk Control Measures (RCM)is expected to result in improved confidence in preventing fuel dryout following a slow loss of regulation.

PSA 3 Open design of the balance of plant - steam protection

Perform a review of the Probabilistic Safety Assessment (PSA) assumptions to determine if more realistic assumptions related to the assessment of the consequences of secondary side breaks, could be made. The possibility of improving the protection against steam/feedwater line breaks outside containment should be examined. This issue is only applicable to multi-unit stations; moreover it has already been addressed by Bruce Power stations. The target date to complete the review of the PSA models is December 31, 2010.

Successful implementation of the proposed Risk Control Measures (RCM) is expected to result in plant design models that better reflect plant design features currently present to protect against steam and feedwater line breaks outside containment. The RCM could also result in the identification of potential design changes that improve the protection against steam and feedwater line breaks outside containment.

SS 5 Hydrogen control

Install Passive Autocatalytic Recombiners (PARs) to improve hydrogen control during design basis accidents and assess the need for additional PARs to control hydrogen

1 Up to now, the CANDU 6’s have not modified their NOP/ROP methodology, even though they participate to this COG program.

viii

Issue Risk Control Measuresmeasures during accidents

during beyond design basis accidents.

GAI 88 G02 was closed in 2009, however station specific action item have been opened. The target dates to complete the installation of the PARs are station specific and generally linked to Life Extension Projects.

Successful implementation of the proposed Risk Control Measures (RCM) is expected to result in identification of provision to mitigate the impact of hydrogen production during Design Basis Accidents (DBA)s.

AA 8 Analysis for moderator temperature predictions &

SS 8 Availability of the moderator as a heat sink

Licensees addressed the GAI 95G05 “Moderator Temperature Predictions” closure criteria. The CNSC is planning to close this generic action item for the various Licensees in 2009. However, station-specific action items related to this issue will be raised.

Successful implementation of the proposed Risk Control Measures (RCM) is expected to result in improved confidence in moderator temperature predictions.

AA 9 Analysis for void reactivity coefficient &

PF 9 Fuel behaviour in high temperature transients &

PF 10 Fuel behaviour in power pulse transients &

PF 12 GAI 00G01 Channel voiding during a Large LOCA



or


As a milestone an overall plan including information about cost, deliverables, milestones, resources (people and experts), schedule and the acceptance criteria for Composite Analytical Approach (RCM-1) should be developed before March 31, 2010. A high level schedule should also be prepared for Low Void Reactivity Fuel (RCM-2) by March 31, 2010.

ix

Acknowledgements

The contributions of the following individuals in the preparation of this document are gratefully acknowledged.

Name Affiliation

E. Bennett COG

E. Chan Bruce Power (Issues team member)

P. Chan Bruce Power (Issues team member)

M. Couture CNSC

K. Dinnie NSS

A. Farr OPG

G. Hotte HQ (Issues team member)

R. Humphries NSS

G. Ishack CNSC

J. Jin CNSC

T. Kapaklili Bruce Power (Retired) (Issues team member)

D. Komljenovic

HQ

V. Lau AECL (Issues team member)

D. Miller CNSC (Issues team member)

D. Mullin NBP (Issues team member)

M. O’Neill OPG (Issues team member)

Y. Parlatan OPG (Issues team member)

M-A. Petrilli NSS/Nucleonex (Issues team member)

C. Poirier NSS/Nucleonex

G. Rzenkowski

CNSC

P. Wan CNSC

B. Willemsen NBP

x

TABLE OF CONTENTSEXECUTIVE SUMMARY........................................................................................................................................III

1.INTRODUCTION......................................................................................................................................................1

2.STRUCTURE OF THE REPORT...........................................................................................................................2

3.ISSUE IDENTIFICATION ......................................................................................................................................3

4.CATEGORIZATION OF SAFETY ISSUES..........................................................................................................5

5.DESCRIPTION OF THE RISK-INFORMED DECISION MAKING PROCESS.............................................8

6.THE RISK-INFORMED DECISION MAKING PROCESS..............................................................................11

1.1. INITIATE PROCESS .................................................................................................................................................. 11 1.2. PILOT PROJECT ...................................................................................................................................................... 12

7.ISSUE DEFINITIONS.............................................................................................................................................15

1.3. POSITIVE VOID REACTIVITY AND LARGE LOCA ....................................................................................................... 17 7.1.1.Analysis for Moderator Temperature Predictions (AA 8) & Availability of the Moderator as a Heat sink (SS 8)...................................................................................................................................................................177.1.2.Analysis for Void Reactivity Coefficient (AA 9).........................................................................................187.1.3.Fuel Behaviour in High Temperature Transients (PF 09).........................................................................187.1.4.Fuel Behaviour in Power Pulse Transients (PF 10)..................................................................................197.1.5.Channel Voiding During Large LOCA (PF 12).........................................................................................19

1.4. COMPUTER CODE AND PLANT MODEL VALIDATION (AA 3) ....................................................................................... 20 1.5. ANALYSIS FOR PRESSURE TUBE FAILURE WITH CONSEQUENTIAL LOSS OF MODERATOR (AA 7) ...................................... 20 1.6. FUEL CHANNEL INTEGRITY AND EFFECT ON CORE INTERNALS (CI 1) ........................................................................... 21 1.7. DETERIORATION OF CORE INTERNALS (CI 2) ............................................................................................................. 21 1.8. AGEING OF EQUIPMENT AND STRUCTURES (GL3) ...................................................................................................... 22 1.9. INADEQUACY OF RELIABILITY DATA (GL 4) ............................................................................................................. 23 1.10. NEED FOR SYSTEMATIC ASSESSMENT OF HIGH ENERGY LINE BREAK EFFECTS (IH 6) .................................................. 23 1.11. MOLTEN FUEL/MODERATOR INTERACTION (PF 15) ................................................................................................. 25 1.12. FUEL BUNDLE/ELEMENT BEHAVIOUR UNDER POST-DRYOUT CONDITIONS (PF 18) ....................................................... 26 1.13. IMPACT OF AGEING ON SAFE PLANT OPERATION (PF19) .......................................................................................... 26 1.14. ANALYSIS METHODOLOGY FOR NEUTRON OVERPOWER PROTECTION / REGIONAL OVERPOWER PROTECTION TRIPS (PF 20) .................................................................................................................................................................................. 27 1.15. OPEN DESIGN OF THE BALANCE OF PLANT – STEAM PROTECTION (PSA 3) ................................................................ 29 1.16. ECCS SUMP SCREEN ADEQUACY (SS 1) .............................................................................................................. 30 1.17. HYDROGEN CONTROL MEASURES DURING ACCIDENTS (SS 5) ................................................................................... 31

8.RISK ESTIMATE AND EVALUATION..............................................................................................................32

1.18. RISK ESTIMATE AND EVALUATION TASKS ............................................................................................................... 32 1.19. RISK SIGNIFICANCE LEVEL SUMMARY .................................................................................................................... 33

9.CONTROL RISK.....................................................................................................................................................48

1.20. RCMS IDENTIFICATION AND ASSESSMENT TASKS .................................................................................................... 49 THE RIDM ISSUE TEAM (RIT) REVIEWED THE CANDIDATE RESOLUTION ACTIVITIES ( CRA)S PROPOSED BY THE LBLOCA WORKING GROUP AND CONCLUDED THAT IT WAS APPROPRIATE TO TREAT THESE AS RISK CONTROL MEASURES (RCM)S AND THERE WAS NO NEED, IN THE CONTEXT OF THE ASSESSMENT OF GENERIC RISK CONTROL MEASURES (RCM)S, TO TRY TO IDENTIFY ADDITIONAL RISK CONTROL MEASURES (RCM). THIS CONCLUSION TAKES INTO ACCOUNT THE EFFORT THAT WAS SPENT BY THE LBLOCA WORKING GROUP TO IDENTIFY ACCEPTABLE CONTROL MEASURES AND THE FACT THAT THE LBLOCA WORKING

xi

GROUP HAS ALREADY EVALUATED THE MERITS OF THE PROPOSED CONTROL MEASURES RELATIVE TO SOME OF THE EVALUATION CRITERIA THAT ARE PRESENTED IN TABLE 8. .................................................................................................................... 57 IN CONCLUSION, THE COMPOSITE ANALYTICAL APPROACH OPTION AND THE LOW VOID REACTIVITY FUEL OPTION ARE CONSIDERED THE TWO OPTIONS APPROPRIATE FOR ASSESSMENT BY THE RIDM ISSUE TEAM (RIT). IN THE FOLLOWING LBLOCA ISSUES SUB- SECTIONS, THE COMPOSITE ANALYTICAL APPROACH WILL BE REFERRED TO RCM-1, WITH CRA-1, -2 AND -3 BEING REFERRED TO AS RCM-1.1, RCM-1.2 AND RCM-1.3, AND THE LOW VOID REACTIVITY FUEL OPTION WILL BE REFERRED TO RCM-2, WHICH IS EQUIVALENT TO CRA-4. ........................................................................................................................................... 57 IT IS IMPORTANT TO NOTE THAT THE ACTIVITIES IDENTIFIED UNDER TA1 AND TA2 WILL HAVE TO BE PERFORMED WHICHEVER RESOLUTION STRATEGY IS SELECTED. ............................................................................................................................... 57 9.2.2 ASSESSMENT OF THE RCMS FOR THE LBLOCA ISSUES .......................................................................................... 57 9.2.3 CONCLUSIONS FROM THE ASSESSMENT OF THE RISK CONTROL MEASURES (RCM) FOR THE LBLOCA ISSUES ............... 59 9.3. RISK CONTROL MEASURES (RCM) FOR THE NON LBLOCA ISSUES .......................................................................... 66

10.MONITORING THE IMPACT OF THE RCM.................................................................................................69

11.CONCLUSION.......................................................................................................................................................70

12.REFERENCES ......................................................................................................................................................73

13.GLOSSARY............................................................................................................................................................74

14.FIGURES................................................................................................................................................................78

APPENDIX A. ISSUES DEFINITION FOR CATEGORY 3 CANDU SAFETY ISSUES..................................82

APPENDIX B.RISK ESTIMATIONS AND RISK EVALUATIONS FOR CATEGORY 3 CANDU SAFETY ISSUES.......................................................................................................................................................................183

APPENDIX C.RISK MATRICES...........................................................................................................................223

APPENDIX D.RISK CONTROL MEASURES ASSESSMENT FOR CATEGORY 3 ISSUES......................226

APPENDIX E.RISK CONTROL MEASURES ASSESSMENT FOR CATEGORY 3 ISSUES......................246

TABLES

TABLE 1: CATEGORIES OF CANDU SAFETY ISSUES.....................................................................................6

TABLE 2: LIST OF GENERIC SAFETY ISSUES CATEGORIES......................................................................8

TABLE 3: ISSUE DEFINITION TEMPLATE.......................................................................................................14

TABLE 4: LARGELOSS OF COOLANT ACCIDENT (LOCA) RSLS SUMMARY........................................35

TABLE 5: NON LBLOCA RSLS SUMMARY.......................................................................................................38

TABLE 6: UPDATED RISK CATEGORIES (NOTE: THESE ARE NOT THE RISK SIGNIFICANCE LEVELS)......................................................................................................................................................................47

TABLE 7: GUIDANCE ON CORRELATION OF RCM WITH RISK SIGNIFICANCE LEVEL (RSL)S....52

TABLE 8: EVALUATION CRITERIA FOR APPLICATION TO THE CATEGORY 3 ISSUES..................53

xii

TABLE 9: SUMMARY ASSESSMENT OF THE LBLOCA CANDIDATE RESOLUTION ACTIVITIES ( CRA)S AGAINST THE CATEGORY 3 LBLOCA RELATED SAFETY ISSUES...........................................62

TABLE 10: SUMMARY ASSESSMENT OF THE LBLOCA CANDIDATE RESOLUTION ACTIVITIES ( CRA)S AGAINST SELECTED EVALUATION CRITERIA.............................................................................64

TABLE 11: SUMMARY OF RISK CONTROL MEASURES..............................................................................66

xiii

LIST OF ACRONYMNS AND SYMBOLS

ACR Advanced CANDU ReactorAECL Atomic Energy Canada LimitedAHP Analytic Hierarchy ProcessAOO Anticipated Operational OccurrenceBDBA Beyond Design Basis AccidentBEAU Best Estimated and UncertaintyBOT Break Opening TimeCANDU CANada Deuterium Uranium, is a registered trademark of AECLCCF Common Cause FailureCDF Core Damage FrequencyCNSC Canadian Nuclear Safety CommissionCNUEF Canadian Nuclear Utility Executive ForumCOG CANDU Owners GroupCRA Candidate Resolution ActivitiesCVR Coolant Void ReactivityDBA Design Basis AccidentsECCS Emergency Core Cooling SystemEEP Expert Elicitation ProcessEQ Environmental QualificationFLOR Fast Loss of RegulationsGAI Generic Action ItemHIS Hydrogen Ignition SystemsHTS Heat Transport SystemHVAC Heating Ventilation Air ConditioningIAEA International Atomic Energy AgencyICET Integrated Chemical Effects TestIE Initiating EventIST Industry Standard ToolsetITP Independent Technical PanelLBB Leak Before BreakLBLOCA Large Break Loss of Coolant AccidentLISS Liquid Injection Shutdown SystemLOCA Loss of Coolant AccidentLOE Limit of Operating EnvelopeLOECC Loss of Emergency Core CoolingLOF Loss of FlowLOM Loss of Moderator LOR Loss of RegulationLVRF Low Void Reactivity FuelMC Matter of ConcernMFMI Molten Fuel / Moderator InteractionNOP Neutron Overpower ProtectionNPP Nuclear Power Plant

xiv

OP&P Operating Policies and Principles PARs Passive Autocatalytic RecombinerPHT Primary Heat TransportPHWR Pressurized Heavy Water ReactorPIE Post Irradiation ExaminationPKPIRT Phenomena and Key Parameter Identification and Ranking TablePRA Probabilistic Risk AssessmentPSA Probabilistic Safety AssessmentPT Pressure TubeRAB Reactor Auxiliary BayRCM Risk Control MeasuresRIDM Risk Informed Decision MakingRIT RIDM Issues TeamROP Regional Overpower ProtectionRPT RIDM Process TeamRSL Risk Significance LevelRTS Risk Tolerable ScaleSAM Severe Accident ManagementSLOR Slow Loss of RegulationSPOC Single Point of ContactSSC System Structure ComponentTBS Transition Break sizeUS NRC United State Nuclear Regulatory CommissionUPM Unified Partial MethodsWG Working Group

xv

1. INTRODUCTION

The first complete application of the Canadian Nuclear Safety Commission (CNSC) Risk Informed Decision Making (RIDM) process to the design and analysis Safety Issues for Canadian CANDU reactors was published in 2007 9.3. This assessment was sent to the Industry for comments in a letter dated September 2007 9.3. Following this, high level Canadian Nuclear Safety Commission (CNSC) and Industry management decided to create a Working Group composed of Canadian Nuclear Safety Commission (CNSC) staff and Industry members to address the industry comments, and provide an update for the report issued in 2007. The terms of reference of this Working Group are documented in 9.3. The joint COG/CNSC Risk-Informed Decision-Making (RIDM) Working Group (RIDM WG) is operating under the direction of the CNUEF/CNSC Executives (the ‘decision makers’ for this activity). The Working Group was subdivided into three teams: the Steering Team (ST), the RIDM Process Team (RPT) and the RIDM Issues Team (RIT).

The overall objectives of the joint CNSC/Industry Working Group 9.3 are to:

1. Progress the resolution of the Category 32 issues using Risk Informed Decision Making (RIDM) as soon as reasonably practical.

2. Increase Canadian Nuclear Safety Commission (CNSC)/Industry alignment on Risk Informed Decision Making (RIDM), including recommending the final detailed process and documentation structure for Risk Informed Decision Making (RIDM) application for both the Canadian Nuclear Safety Commission (CNSC) and the Industry.

The RIDM Process Team (RPT) has developed a Risk Informed Decision Making (RIDM) process 9.3 which enables the RIDM Issue Team (RIT) to assess Risk Significance Levels (RSLs) for the Safety Issues for each risk scenario being analyzed.

Collaboration between the RIDM Working Group and the large break LOCA (LBLOCA) Working Group (LBLOCA Working Group) has been established to address the LBLOCA related to Category 3 Safety Issues.

This report documents the activities that were completed by the RIDM Issue Team (RIT) and provides a revision of the previous report documenting the assessment of the Category 3 design and analysis Safety Issues 9.3. It was carried out using the most current version of the Canadian Nuclear Safety Commission (CNSC) Risk Informed Decision Making (RIDM) process 9.3. This document takes into consideration recent developments from the industry to close or improve understanding of the Category 3 issues identified by the Canadian Nuclear Safety Commission (CNSC). It describes the results of the assessment conducted by the RIDM Issue Team (RIT) (including the list of key outstanding Safety Issues, their categorization and evaluation of risk significance) and the main findings following Risk Informed Decision Making (RIDM) process application to the Category 3 issues.

2 Refer to Section 3 for further information regarding the categorization of the Safety Issues.

1

As a result of the application of the Risk Informed Decision Making (RIDM) process by the industry and the staff of Canadian Nuclear Safety Commission (CNSC), some Category 3 issues were reclassified as Category 1 or Category 2 issues. The updated list of Category 3 issues is presented in Table 6 of section 1.19.

This document describes the consensus-based approach to address the remaining concerns regarding the Category 3 issues. It defines the path forward for the resolution of potentially safety-significant issues in the context of currently operating reactors and life extension of existing reactors. It is to be pointed out that, in contrast to the previous version of the report 9.3, this version does not address new reactors.

The results of this work form the basis for the recommendations of the Canadian Nuclear Safety Commission (CNSC)/Industry Risk Informed Decision Making (RIDM) Issues Team to the decision makers with respect to risk control measures, and the timelines for their implementation, for the Safety Issues addressed.

2. STRUCTURE OF THE REPORT

The structure of the report is similar to the structure of the report that originally documented the assessment of the Category 3 issues 9.3. It has been slightly modified to map more explicitly with the Risk Informed Decision Making (RIDM) process. More specifically:

• Chapter 3 describes the process used to identify the Category 3 Safety Issues.

• Chapter 4 lists the various Safety Issues that are considered and categorizes them.

• Chapter 5 presents the Risk Informed Decision Making (RIDM) process starting with the initiation of the process and finishing with the monitoring of the impact of the recommended actions. It also defines the Risk Significance Level (RSL) scale used to evaluate the magnitude of the impact of a risk scenarios related to a Category 3 Safety Issues.

• Chapter 6 describes the mandate given to the RIDM Issue Team (RIT) and the scope of the activities carried by the team.

• Chapter 7 summarizes the issue definitions.

• Chapter 8 presents the estimation and the evaluation of the risks associated with the various issues.

• Chapter 9 explains in details the steps followed to determine the Risk Control Measures and options to reduce significantly the risks associated with the Safety Issues. First, the LBLOCA Risk Control Measures (RCM) options are presented and then the non LBLOCA Risk Control Measures (RCM).

• Chapter 10 mentions the expectations for the monitoring of the impact of the Risk Control Measures (RCM)s.

• Chapter 11 presents the conclusions of the report.

2

The report also includes 5 appendices documenting the detailed information that was generated during the course of the project. More specifically:

• Appendix A contains the Issue Definition Forms for each Safety Issues.

• Appendix B presents the risk estimations and evaluations for each scenario identified for the various Safety Issues.

• Appendix C comes directly from 9.3 and presents the risk matrices developed to estimate and evaluate the risk significance level.

• Appendix D describes the process followed by the RIDM Issue Team (RIT) to assess the risk control measures.

• Appendix E presents the Risk Control Measures (RCM) for the issues that remain Category 3 Safety Issues.

3. ISSUE IDENTIFICATION

An initial list of issues was developed using the International Atomic Energy Agency (IAEA) TECDOC 1554“Generic Safety Issues for Nuclear Power Plants with Pressurized Heavy Water Reactors and Measures for their Resolution” 9.3. Additional issues were identified through:

• regulatory oversight of currently operating reactors;

• results of life extension assessments; and

• Safety Issues identified in pre-licensing reviews of new CANDU designs.

For the purpose of this work, only design and analysis Safety Issues were considered based on the following definition of a Safety Issue:

"A Safety Issue is an issue related to the design or analysis of NPPs that has been identified as potentially challenging to safety functions, safety barriers, or both.”

This definition is consistent with that provided in IAEA TECDOC 1044 9.3 and IAEA TECDOC 640 9.3. The generic Safety Issues listed in these documents were mainly identified from (i) operational experience or events, (ii) deviations from current standards and practices, and (iii) potential weaknesses recognized through analysis by focusing on the impact of the issue on safety functions and barriers.

Although the issues identified in this document remain at various stages of resolution, they should not be viewed as questioning the safety of operating reactors which have attained a very high operational safety record, but rather as areas where uncertainty in knowledge exists, where the safety assessment has been based on conservative assumptions, and where regulatory decisions are needed or will need to be confirmed. Further work, including experimental

3

research, may be required to more accurately determine the overall effect of an issue on the safe operation of the reactors, to confirm that their operation within current limits and conditions is acceptable, and there remain adequate safety margins.

It is important to note that some of the Safety Issues identified and described in this document in the context of CANDU reactors are common to other reactor types. On the other hand, not all International Atomic Energy Agency (IAEA) Safety Issues apply to every CANDU power plant.

4

4. CATEGORIZATION OF SAFETY ISSUES

The first step in the prioritization of outstanding Safety Issues, and the development of the path forward for their resolution, is categorizing the issues into three broad categories, as illustrated in Figure 1. The categories are:

• Category 1 : The issue has been satisfactorily addressed in Canada.

Issues may be dropped from the list if the issue does not meet the definition of a Safety Issue, or if the issue has been satisfactorily addressed in Canada.

• Category 2 : The issue is a concern in Canada - appropriate measures are in place to maintain safety margins.

The Licensees have appropriate control measures in place to address the issue and to maintain safety margins. Licensees’ performance with regards to addressing the issue is adequate. The Canadian Nuclear Safety Commission (CNSC) continues to monitor Licensee’s management of the issue.

• Category 3 : The issue is a concern in Canada - measures are in place to maintain safety margins, but the adequacy of these measures needs to be confirmed.

The Licensees have some control measures in place to maintain safety margins, but further experiments and/or analysis are required to improve knowledge and understanding of the issue, and to confirm the adequacy of safety margins. Additional measures may be needed such as design improvements, supplementary administrative and operational controls, additional surveillance and/or inspections. The Risk Informed Decision Making (RIDM) process is applied and the path forward for resolution of the issue for operating reactors, life extension of operating reactors and new reactors is developed. The Canadian Nuclear Safety Commission (CNSC) will continue to monitor Licensee’s management of the issue and the additional work to ensure its timely and effective resolution.

It can be seen from Figure 1 that multiple flow paths were needed to reflect the fact that, although an issue may be under control for operating reactors, it is prudent to determine whether other actions could be taken to address the issue at the time of life extension of existing reactors or design reviews of new reactors (i.e., undertake design changes rather than addressing the issue through operational or administrative measures).

Table 1 lists all issues with their initial categorization. Details on the status of the issues in Canada and the rationale for categorization of the issues are provided in an accompanying report 9.3. As 9.3 refers to the International Atomic Energy Agency (IAEA) document discussed in section 1.17, this categorization has been revisited during the review of the issues to take into account information from related activities that were carried out subsequent to publication of 9.3.

5

Table 1: Categories of CANDU Safety Issues

Category 1 – an issue has been satisfactorily addressed

Category 2 – an issue, but appropriate measures are in place to maintain safety margins

Category 3 – an issue, apply RIDM to develop path for resolution

GL 1 Classification of components GL 2 Environmental qualification of equipment and structures


GL 5 Need for performance of plant-specific probabilistic safety assessments (PSA)

RC 1 Inadvertent dilution or precipitation of poison under low power and shutdown conditions

GL 4 Inadequacy of reliability data

RC 2 Fuel cladding corrosion and fretting

CI 3 SG tube integrity CI 1 Fuel channel integrity and effect on core internals

SS 2 Potential problems in Emergency Core Cooling System (ECCS) switchover to recirculation

CI 4 Loads not specified in the original design

CI 2 Deterioration of core internals

SS 4 Leakage from systems penetrating containment or confinement during an accident

CI 5 Steam and feedwater piping degradation

SS 1 Emergency Core Cooling System (ECCS) sump screen adequacy

SS 7 Assurance of ultimate heat sink PC1 Overpressure protection of the primary circuit and connected systems

SS 5 Hydrogen control measures during accidents

ES 1 Reliability of off-site power supply

PC 2 Safety valve and relief valve reliability


SS 8 addressed through AA8. Consequently, this issue will not be developed further.

ES 5 Reliability of instrument air systems

PC 3 Water hammer in feedwater and steam lines


ES 6 Solenoid valve reliability SS 3 Severe core damage accident management measures

AA 3 Computer code and plant model validation

IC 1 Inadequate electrical isolation of safety from non-safety-related equipment

SS 6 Reliability of motor-operated and check valves

AA 7 Analysis for pressure tube failure with consequential loss of moderator

IC 2 I&C component reliability ES 2 Diesel generator reliability AA 8 Analysis for moderator temperature predictions

IC 3 Lack of on-line testability of protection systems

ES 3 Reliability of emergency DC supplies

AA 9 Analysis for void reactivity coefficient

IC 4 Reliability and safety basis for digital I&C conversions

ES 4 Control room habitability PSA 3 Open design of the balance of plant - steam protection

IC 5 Reliable ventilation of control room cabinets

IC 7 Availability and adequacy of accident monitoring instrumentation

PF 9 Fuel behaviour in high temperature transients

IC 6 Need for a safety parameter display system

IC 9 Establishment and surveillance of setpoints in instrumentation

PF 10 Fuel behaviour in power pulse transients

IC 8 Water chemistry control and CS 1 Containment integrity PF 12 GAI 00G01 Channel voiding

6

Category 1 – an issue has been satisfactorily addressed

Category 2 – an issue, but appropriate measures are in place to maintain safety margins

Category 3 – an issue, apply RIDM to develop path for resolution

monitoring equipment (primary and secondary)

during a Large LOCA

IH 5 Need for systematic internal flooding assessment including backflow through floor drains

IH 1 Need for systematic fire hazards assessment

PF 14 Positive reactivity feedback

All elements are captured in AA 9, AA8, PF 9, PF 10, PF 12 Safety Issues for major aspects of LBLOCA scenarios. Consequently, this issue will not be developed further.

IH 7 Need for assessment of dropping heavy loads

IH 2 Adequacy of fire prevention and fire barriers


IH 8 Need for assessment of turbine missile hazard

IH 3 Adequacy of fire detection and extinguishing

PF 18 Fuel bundle/element behaviour under post-dryout conditions

AA 2 Adequacy of plant data used in accident analyses

IH 4 Adequacy of the mitigation of the secondary effects of fire and fire protection systems on plant safety

PF 19 Impact of ageing on safe plant Operation

AA 4 Need for analysis of accidents under low power and shutdown conditions

EH 1 Need for systematic assessment of seismic effects

(EH 2, Need for assessment of seismic interaction of structures or equipment on safety functions, is a sub-set)

PF 20 Analysis methodology for NOP / ROP trips

AA 6 Need for analysis of total loss of AC power

EH 3 Need for assessment of plant-specific natural external conditions

MA 5 Degraded and non-conforming conditions and operability determinations

EH 4 Need for assessment of plant-specific man induced external events

OP 1 Operating experience feedback AA 1 Adequacy of scope and methodology of design basis accident analysis

AA 5 Need for severe accident analysis

MA 13 Availability of R&D, technical and analysis capabilities for each Nuclear Power Plant (NPP)

PSA 2 Equipment qualification

PSA 4 Primary Heat Transport (PHT) relief

7

Table 2: List of Generic Safety Issues Categories

AA Accident AnalysisCI Component IntegrityCS ContainmentEH External HazardsEP Emergency PreparednessES Electrical and Other Support SystemsFH Fuel HandlingGL GeneralIC Instrumentation and Control (including Protection Systems)IH Internals HazardsMA ManagementOP OperationsPC Primary Circuit and Associated SystemsPF Physics and FuelPSA Probabilistic Safety AssessmentRC Reactor CoreRP Radiation ProtectionSM Surveillance and MaintenanceSS Safety SystemsTR Training

5. DESCRIPTION OF THE RISK-INFORMED DECISION MAKING PROCESS

The process that was used to assess the Category 3 issues is documented in reference 9.3. This process is an update of the process that was used in the original assessment by the Canadian Nuclear Safety Commission (CNSC) of the Category 3 issues. The process remains similar to the original but has been updated to incorporate feedback received during its application by the Canadian Nuclear Safety Commission (CNSC) staff and the RIDM Working Group.

The Risk Informed Decision Making (RIDM) process applied for determining the risk significance of Safety Issues, 9.3 is based on the Canadian CSA Q-850 standard, 9.3. In the process described in CSA Q-850, recommended Risk Control Measures are based on risk estimation and evaluation; risk management is accomplished through implementation of these measures and monitoring their impact.

The Risk Informed Decision Making (RIDM) process is shown schematically in . The main activities include:

• setting up the team, identification of constraints, definition of an issue, identification of stakeholders (Step #1);

• performing initial analysis: identify hazards and risks, assess whether immediate measures need to be taken (Step # 2);

8

• estimation of the identified risks, assessment of the magnitude of the consequences, identification of the risk scenarios leading to those consequences, and assessment of the likelihood of the risk scenarios / consequences (Step # 3);

• evaluation of the risks, i.e. determining the significance level of the risks (Step # 4); and

• recommending measures to control the more significant risks (Step # 5).

The Risk Informed Decision Making (RIDM) process provides the decision makers with information on the risk environment and recommends risk control measures. It must be recognized, however, that the risk associated with Safety Issues is not the only input to be considered by the decision makers, as depicted in Figure 3. Other inputs (e.g. past practice, operational experience, etc.) may be equally or more important, depending on the risk environment are considered in the recommendations.

The documentation of all these activities, including the recommendations on how to address the risks, is then provided to the decision makers. Following the decision, the Risk Informed Decision Making (RIDM) process provides for:

• implementation of actions to reduce the risks (Step # 6); and

• monitoring the impact of these actions (Step # 7).

In the development of the Canadian Nuclear Safety Commission (CNSC) Risk Informed Decision Making (RIDM) process, special attention was given to ensuring that the methodology for risk estimation and evaluation is clearly aligned with the Canadian Nuclear Safety Commission (CNSC) regulatory framework. This was done by:

• use of the Canadian Nuclear Safety Commission (CNSC) regulatory requirements (such as frequency classification of events and dose limits for anticipated operational occurrences and design basis events, limits for Safety Goals, reliability of special safety systems, dose limits for workers) and environmental release limits defined in Licensees documentation as the basis for defining the risk significance levels on the tolerability scale;

• considering the Canadian Nuclear Safety Commission (CNSC) licensing ratings;

• use of concepts specific to the Canadian Nuclear Safety Commission (CNSC) regulatory approach and integration of the previous Canadian Nuclear Safety Commission (CNSC) work on determining safety significance and risk significance.

The evaluation of the Risk Significance Level (RSL) is based on the Tolerability of Risk (). It involves assigning significance levels to the risks identified and estimated based on their tolerability levels, regardless of the nature of these risks. Use of the risk tolerability as a common scale has the following advantages:

• ensures consistency in determining the risk significance;

9

• permits comparing risks in different areas via their significance level/tolerability and avoids assigning weighting factors for risks in different risk areas; and

• allows taking into consideration the subjective perception of the risk by experts in diverse risk areas, without affecting consistency in determining the risk significance levels for risks in these diverse risk areas.

The Risk Significance Level of an issue is a measure of the impact on the risks related to various safety areas of a given issue, whether the risk categories, described in the previous section, are related to the relevance of an issue in Canada. The implementation of the Risk Control Measures to a Category 3 issue would reduce the Risk Significance of the issue, which would lead to consider that the issue is no longer an issue in Canada (Category 1) or that the issue is adequately managed (Category 2). The Risk Significance Level (RSL) represents the magnitude of the impact of a matter of concern on the overall risk related to the various safety areas. Four risk significance levels are employed:

RSL1:There is no additional risk due to the matter of concern (MC) or the additional risk is negligible. The uncertainties in making this estimation are not relevant. It may be appropriate to recommend addressing the risk as part of actions to resolve higher ranked risks.

RSL2:The Matter of Concern causes a moderate increase of the risk but it is still well within the tolerable region. Margins to accepted limits are eroded. There are uncertainties in risk estimation but they are relatively well understood such that it is judged that meeting the accepted limits is not challenged. Risk control measures should be taken if it is reasonably practicable to do so.

RSL3:The increase of the risk from the state when the Matter of Concern is absent is significant. RSL3 lies at or near the upper limit of the tolerable range and, as such, it represents significant concerns. It is possible that epistemological uncertainties, and uncertainties in the largely qualitative estimations of the potential consequences and of their probabilities, could render it difficult to determine whether the regulatory limits are exceeded or not. Interim measures may have to be recommended.

RSL4:Highest risk increase. The accepted limits are exceeded. The risk is intolerable. The uncertainties in making this estimation can hardly challenge this conclusion on the magnitude and tolerability of the risk. Immediate actions should be recommended. For issues involving plant safety, the Canadian Nuclear Safety Commission (CNSC) may instruct the Licensee to stop operation until compensatory measures are implemented.

The correspondence between the risk significance levels on the Risk Tolerability Scale is represented in .

The bottom vertex of the triangle on represents the case when the Safety Issue is absent. When a Safety Issue arises, the risk associated with the issue results in an increase of the total risk. The

10

total risk has two components: the risk due to the existence of the plant in the absence of the Safety Issue and the incremental risk associated with the Safety Issue. The Canadian Nuclear Safety Commission (CNSC) relevant requirements are determining the limit separating tolerable risks from unacceptable risks.

Within each risk area, risk matrices are used for estimation and evaluation of the risks. Risk matrices are defined in the risk plane (consequences and likelihood). The criteria for consequence categories and the criteria for the likelihood categories are used to define the risk matrix. A risk significance level is assigned to each element of the matrix according to the above definitions, and to the tolerability of the risk given by the particular consequence/likelihood criteria. The risk significance level for the issue is determined using the results of the assessment of the consequences and of their likelihood, according to the applicable consequence and likelihood criteria.

The Risk Significance Level (RSL) definitions include indications on the need that the Risk Control Measures recommended to the decision makers are commensurate with the significance of the risk. It is recognized that a Matter of Concern may introduce several risks, in diverse risk areas, having various Risk Significance Level (RSL)s. The control measures should focus on addressing the more significant risks associated with the Matter of Concern. However, the decision on the actual measures to be implemented is beyond the scope of the definition of Risk Significance Level (RSL) because there are other inputs (and associated recommendations) to be considered by the decision makers. The degree of “severity” and “urgency” of the actions depends not only on the Risk Significance Level (RSL), but on ALL the inputs to the decision makers. These aspects should be treated as part of the integration of other inputs to Risk Informed Decision Making (RIDM).

6. THE RISK-INFORMED DECISION MAKING PROCESS

1.1. Initiate Process

As discussed in the introduction (Section ) the work described in this report is an update of the work previously carried out and documented in reference 9.3 attached to reference 9.3. This update is carried out following the Terms of Reference of the Canadian Nuclear Safety Commission (CNSC)/Industry RIDM Working Group documented in reference 9.3.

The scope of work of the RIDM issue team is to:

Revisit the application of the Risk Informed Decision Making (RIDM) process to the Category 3 issues, which imply a revision of the Issue definitions, a re-assessment of the RSLs and a review of the Risk Control Measures, so as to: 1. Account for the current discussions between the Canadian Nuclear Safety Commission

(CNSC) and the Industry on the process itself.2. Agree on assessment of these issues by involving a broader spectrum of stakeholders which

should allow better definitions and assessments of the issues; and

11

3. Agree on proposed resolution paths for approval by the CNUEF/CNSC Executives Forum.

The RIDM Issues Team consisted of a core team responsible for applying Risk Informed Decision Making (RIDM) to all the outstanding Category 3 Safety Issues, so as to ensure alignment on all aspects of the Risk Informed Decision Making (RIDM) process application (including issue definition, risk estimate, risk assessment, and risk control measures). The issue team was composed of members representing the Canadian Nuclear Safety Commission (CNSC) staff and the Industry. The team was responsible for drawing on additional resources as required and for reaching consensus on the issue. In particular, the Large LOCA Working Group was an established technical group that provided the technical input to the Risk Informed Decision Making (RIDM) issues team with respect to issue description and candidate Risk Control Measures for Large Break Loss of Coolant Accident (LBLOCA).

Meeting notes (documenting decisions and actions) were recorded to maintain documentation and transparency. The key deliverable for the Risk Informed Decision Making (RIDM) Issues Team was the development of criteria for closure of the issue as well as the schedule for addressing and resolving the issue. This is documented in the present report.

The RIDM Issues Team based its work on existing information. The possible limitations related to existing information, in particular to support risk estimates, were considered in the risk assessments and were taken into account in the proposed risk control measures.

1.2. Pilot Project

One of the first activities of the RIDM Issues Team was to carry out a pilot project. The RIDM Pilot Project - Industry Workshop was held on June 18 and 19, 2008 at the Canadian Owner Group ( COG) Offices in Toronto. Participants from Canadian Nuclear Safety Commission (CNSC) and all Industry members, including AECL, were present 9.3. The team decided to use the issue PF 18 (Fuel bundle/element behaviour under post-dryout conditions) as the basis of this pilot project. The pilot project was carried out to clarify the process and provide input to the RIDM Process Team. The main general recommendations from the workshop, and their dispositions, are:

• The licensing framework for carrying out the RIDM process should be clarified. Following this, it was decided to use the licensing framework defined in the CNSC Regulatory Documents RD-337 and RD-310 as the basis for carrying out the Risk Informed Decision Making (RIDM) process for the Category 3 issues. This decision was made because this framework is the most up-to-date licensing framework applicable in Canada and constitutes the reference for safety reviews, such as those performed in the context of nuclear power plant life extension projects (see Regulatory Document RD-360). The main elements of RD-337 and RD-310 that are relevant to the application of the Risk Informed Decision Making (RIDM) process are a) the event classification (Anticipated Operational Occurence (AOO), Design Basis Accidents (DBA) and BEYOND DESIGN BASIS ACCIDENT (BDBA)), b) the safety objectives, c) the dose limits, and d) Safety Goals.

12

• More precise guidance to define issues should be provided . Following this recommendation, an update Issue Definition Template was prepared. This form is presented in Table 3.

• The Risk Significance Level assessment matrices and in particular the matrix on Negative Safety Impact, need to be revised. Following this comment the matrix of the Likelihood categories for the Negative Safety Impact was modified. A new category (L0 - The consequences are highly unlikely to occur (<5% chance)) was introduced to account for unlikely events. The Risk Matrix for Risk of Negative Impact on Safety was modified accordingly. These changes were incorporated in the version 5 and 6 of the Risk Informed Decision Making (RIDM) process.

13

Following the Pilot Project, it was also agreed that only existing nuclear power plants currently operating in Canada are considered in this exercise. Future plants were specifically excluded from this assessment. Finally, it was agreed not to aggregate the risk significance levels from the various risk areas; this change was incorporated in the version 5 and 6 of the Risk Informed Decision Making (RIDM) process.

The other results of the pilot projects are specific to the issue PF 18 and are integrated with the results of the other issues in the following sections.

Table 3: Issue Definition Template

Issue ID Date :

Title

Background Information• Provide general information related to the issue • Historical background • How has it been identified• Relationship to other RIDM Issues and/or Technical Areas

Issue DescriptionProvide a description of the issue:

• What is the problem?• What is the harm (or harms)?• Which risk areas are affected?• Under which plant conditions is the issue relevant? • Which event(s) are affected?• What are the relevant regulatory requirements (regulation, regulatory requirement,

Operating Licence)?Knowledge Base

• Provide the design basis for the issue

• What aspects of the analysis (e.g. methodology, assumptions, acceptance criteria, codes and their validation/experimental basis, etc.) are related to the issue?

• Describe the complete current knowledge base for the issue.

• Existing Licensing Basis/Practices

• Include in particular reference to State of the Art Documents, Technical Basis Documents, Code Documentation including Validation Matrices, Test reports etc.

• Describe ongoing R&D or other activities related to the issue resolution.

RIDM Issue Team (RIT) Lead / Single point of contact stakeholders

RIT Lead:Stakeholders SPOC:

14

7. ISSUE DEFINITIONS

To apply the Risk Informed Decision Making (RIDM) process for evaluating the CANDU Safety Issues effectively, the following technical information was acquired and assessed.

• A realistic description of an issue as basis for adequate understanding of the safety implications. This included a discussion of the adequacy/sufficiency of the information/knowledge for determining the plant conditions for which the Safety Issue is relevant and the impact of the issue on the plant safety.

• Identification of the applicable regulatory requirements. If applicable, differences in applicability/interpretation of the requirements for new builds, existing plants and life extension projects were clarified.

• Identification of the plant operating states for which the Safety Issue is relevant (i.e., Normal Operation, Design Basis Accidents, and Beyond Design Basis Accidents, including Severe Accidents). The categories of events were identified and described, including combination of specific conditions that render the Safety Issue relevant. Their frequencies were evaluated.

• Identification of the safety functions and safety barriers that may be degraded by the Safety Issue. The degree of impairment, including the accident conditions and frequency under which these impairments occur, was identified and described. For risk estimation purposes, the likelihood of these impairments was qualitatively evaluated. If safety barriers were affected, the potential increase of the off-site releases, including the public doses, was qualitatively evaluated (e.g., by comparisons with other accident scenarios already analyzed in the Safety Report that would lead to similar releases).

The issue definitions provided in reference 9.3 were used as the starting points for the RIDM Issue Team (RIT) preparation of the updated issue definitions. These definitions were incorporated in the Issue Definition Template presented in Table 3.

A preliminary update was then performed to account for recent developments, including recent R&D results and licensing developments. An effort was also made to clarify the boundaries between certain overlapping issues, in particular between the various issues related to ageing and those related to Large Break Loss of Coolant Accident (LBLOCA). For each issue a RIDM Issue Team (RIT) lead, who was an Industry member of the RIDM Issue Team (RIT), and a Stakeholders Single Point Of Contact (SPOC) were identified; the Stakeholders SPOCs are Industry technical experts that are familiar with the issues under considerations. The Issue Definitions were then revised by the RIDM Issue Team (RIT) lead. The revised versions were sent to the other RIDM Issue Team (RIT) members and after consensus were sent by the RIDM Issue Team (RIT) coordinator to the Stakeholders Single Point of contact (SPOC). The Stakeholders Single Point of contact (SPOC) then revised the Issue Definitions; where appropriate they coordinated their review with the other Industry experts. The revised versions

15

were sent back to the RIDM Issue Team (RIT) coordinators who verified that the changes were appropriate.

16

The issue definitions were then sent to the CNSC RIT member for review by CNSC experts. The revised versions were returned to the RIT coordinators. Where required, iterations between the various stakeholders took place. The final Issue Definitions were accepted by all the RIT members. These Issue Definitions are presented in 9.3 and are summarized below.

1.3. Positive Void Reactivity and Large LOCA

A number of CANDU Safety Issues are related to the positive void reactivity coefficient of the reactor that leads to challenges in Anticipated Operational Occurrences (AOO) and Design Basis Accidents (DBA) where core void increases as a result of the initiating event. In particular, a Loss of Regulation (LOR), a Loss of Flow (LOF) and a Loss of Coolant Accident (LOCA) are all made more severe by positive feedback. Among these accident scenarios, a Large LOCA is the most difficult accident to analyze for a CANDU reactor because many aspects of the reactor behavior under accident conditions, and its computer modeling, are subject to considerable uncertainties.

7.1.1. Analysis for Moderator Temperature Predictions (AA 8) & Availability of the Moderator as a Heat sink (SS 8)

During someLoss of Coolant Accident (LOCA)s, the integrity of fuel channels depends on the capability of the moderator to temporarily provide cooling and arrest deformation of the Pressure Tube (PT) and CT until ECI flow is established. A channel will likely fail if sustained dry-out on the calandria tube surface occurs. Calculations done to show that pressure tube integrity will be maintained depend on several computer codes. Canadian Nuclear Safety Commission (CNSC) staff believes that moderator temperatures predicted have not been adequately validated, given the tight safety margins that exist currently.

Insufficient moderator sub-cooling increases the likelihood of channel failure, following aLoss of Coolant Accident (LOCA), due to sustained calandria surface dryout. Considering that the issue is the accuracy of code prediction, the primary risk area is the 'risks of Negative Impact on Safety'. Because the consequence of this issue is that the integrity of a significant number of pressure tubes can be lost, this has the potential to affect the 'public dose' and 'severe core damage' risk areas. The issue is primarily relevant for power operation.

To bring this generic action item to closure, the Licensees are required to carry out:

• A 3-D integrated test program under simulated reactor conditions; test results are to be analyzed and the underlying phenomena identified; and

• Code validation against the integral test data carried out in line with the expectations of GAI 98G02; pre-simulations should be carried out as part of code validation; validation results should be used to determine code uncertainties for reactor applications.

Since there is a close relationship between Risk Informed Decision Making (RIDM) Issues AA 8 and SS 8, the information and all elements in regard to the evaluation process for SS 8 are included in AA 8 documentation. Both Safety Issues are defined and assessed together under AA 8 Safety Issue.

17

7.1.2. Analysis for Void Reactivity Coefficient (AA 9)

The safety analyses in support of the acceptability of the safety system performance to ensure meeting the fuel and fuel channel integrity acceptance criteria are based, to a large extent, on numerical simulations of the power pulse. It is therefore important that safety analyses account for the positive void coefficient of reactivity in a conservative manner, which requires the assessment of the accuracy in determination of this coefficient. However, the current validation of the theoretical models and computer codes used by the CANDU industry are such that errors associated with void reactivity calculations are not well defined due to a lack of specific experimental data at in-reactor operating conditions and fuel burnup.

Inadequate knowledge of the uncertainties in models and data used to predict the key phenomena increases the risk that consequences of a limiting Large Break Loss of Coolant Accident (LBLOCA) could be greater than those currently estimated in plant Safety Reports. Large Break Loss of Coolant Accident (LBLOCA) is of interest because it is the design basis event for shutdown systems and Emergency Core Cooling System (ECCS). However, the increased magnitude of void reactivity is potentially of concern for predicted consequences of other relatively high frequency events, such as Loss of Regulation (LOR) or Loss of Flow (LOF), to beyond design event sequences, such as Loss of Regulation (LOR) or smallLoss of Coolant Accident (LOCA) with failure to shutdown.

7.1.3. Fuel Behaviour in High Temperature Transients (PF 09)

In certain Large Break Loss of Coolant Accident (LBLOCA) transients, there could be significant mismatch between the energy deposited in the fuel and the rate of heat removal from the fuel. If the fuel heatup is excessive, it could lead to fuel bundle deformation (sagging, slumping, settling, melting, etc), resulting in loss of a "coolable geometry" and the possibility of consequential fuel and/or fuel channel failure.

At sufficiently high temperatures a bundle would lose its structural rigidity and would start deforming. In addition, after heating up and subsequent cool-down, the bundle materials could undergo a change in properties and lose their ductility, e.g., would become brittle and susceptible to fragmentation due to thermo-mechanical stresses. If, as a consequence of bundle deformation, the coolable geometry is lost then the Emergency Core Cooling System (ECCS) may not be able to re-establish fuel cooling, and this special safety system would not be effective. In addition, fuel deformation may lead to pressure tube failure prior to contact with the calandria tube.

The off-site doses to the public can be higher than those estimated in the Safety Report for Large Break Loss of Coolant Accident (LBLOCA). However, the doses are expected to remain within the single failure dose limits because there is significant margin available between the presently calculated off-site doses and the allowable dose limit.

18

The issue revolves around whether there is sufficient confidence to support the current industry assessments of accidents involving high fuel temperature. Although adverse findings could affect the "radiological risk to public at Design Basis Accidents (DBA)" and "severe accident risks" areas, the primary risk area affected is that of "risks of Negative Impact on Safety"

Most accidents involve deteriorated cooling conditions, resulting in elevated fuel temperatures which in some events may reach very high values, such as in some Large Break Loss of Coolant Accident (LBLOCA) transients. In stylized single channel events, such as stagnation break or flow blockage, several bundles in a single channel are predicted to experience melting.

7.1.4. Fuel Behaviour in Power Pulse Transients (PF 10)

Deposition of significant energy in the fuel matrix over a short period of time gives rise to safety concerns. It is known that at high levels of energy deposition fuel cladding would fail; at higher levels of energy deposition, both fuel matrix and cladding can be fragmented. There are no available CANDU fuel experimental results for the currently predicted range of power pulse parameters obtained using conservative analysis of Large Break Loss of Coolant Accident (LBLOCA). Canadian Nuclear Safety Commission (CNSC) staff is concerned that in power pulse transients CANDU fuel can experience failures due to mechanisms which are not accounted for in safety analyses.

Inadequate knowledge of the impact of bundle deformation behaviour and the sparse data available to predict some phenomena may increase the risk that consequences of a limiting Large Break Loss of Coolant Accident (LBLOCA) could be different than those currently estimated in plant Safety Reports. The issue revolves around whether there is sufficient confidence to support the current industry assessments of accidents involving high fuel temperature. Although adverse findings could affect the "radiological risk to public at Design Basis Accidents (DBA)" and "severe accident risks" areas, the primary risk area affected is that of "risks of Negative Impact on Safety". Reactivity transients could occur from any plant operating state but those occurring from full power are likely to be most limiting.

7.1.5. Channel Voiding During Large LOCA (PF 12)

The voiding transient in a Large LOCA is calculated by system thermal-hydraulics codes, CATHENA and TUF. Experimental uncertainties, scaling effects and code uncertainties need to be considered to ensure that a conservative estimate of the void fraction is used in the physics codes for prediction of the magnitude of the Large LOCA power pulse. Canadian Nuclear Safety Commission (CNSC) staff has a concern that the computer codes used for prediction of overpower transients for CANDU reactors with a positive coolant void reactivity coefficient have not been adequately validated.

A lack of validation of models calls into question the ability to predict safety margins and hence provide confidence that they are conservative. There is a risk that the consequences of a Large

19

Break Loss of Coolant Accident (LBLOCA) may be more severe than currently estimated in Safety Reports. The crux of the issue is the level of confidence that can be associated with code predictions of coolant voiding. Although adverse findings could affect the "radiological risk to public at Design Basis Accidents (DBA)" and "severe accident risks" areas, the primary risk area affected is that of "risks of Negative Impact on Safety". The issue is a concern only for Large Break Loss of Coolant Accident (LBLOCA) occurring at high reactor power.

In an accident sequence that involves phenomena the prediction of which is recognized to involve significant uncertainty, it is desirable to apply a conservative approach to calculation of margins between analysis predictions and acceptance criteria. Lack of validation of models calls into question the ability to predict safety margins and hence provide confidence that they are conservative. There is a risk that the consequences of a Large Break Loss of Coolant Accident (LBLOCA) may be more severe than currently estimated in Safety Reports. The initiating event of interest is the Large Break Loss of Coolant Accident (LBLOCA).

1.4. Computer Code and Plant Model Validation (AA 3)

Inadequate code validation leads to lack of confidence in the results of safety analyses, the safety margins may be smaller than estimated and the consequences of design basis events may be worse than estimated.

In an accident sequence that involves phenomena the prediction of which is recognized to involve significant uncertainty, it is desirable to apply a conservative approach to calculation of margins between analysis predictions and acceptance criteria. Lack of validation of models calls into question the ability to predict safety margins and hence provide confidence that they are conservative. To address the issue in the short and medium term (i.e., until gaps are filled), additional measures should continue to be taken in the safety analysis performed in the meantime to account for any shortcomings that have been identified.

The crux of the issue is the level of confidence that can be associated with code predictions. Although adverse findings could affect the “radiological risk to public at Design Basis Accidents (DBA)” and “severe accident risks” areas, the primary risk area affected is that of “risks of Negative Impact on Safety”. The issue is a potential concern for all plant conditions. The issue is a potential concern for all events. This issue is related to the generic action item 98G02 and to regulatory documents RD-310 and RD-337.

1.5. Analysis for Pressure Tube Failure with Consequential Loss of Moderator (AA 7)

Following a spontaneous pressure tube rupture, the calandria tube may also fail and there is a probability that end-fitting(s) may then eject leading to the consequential loss of moderator. The unavailability of the moderator as a backup heat sink and to maintain integrity of unaffected fuel channels, during an in-core Loss of Coolant Accident (LOCA) and Loss of Emergency Core Cooling (LOECC) event could lead to severe core damage.

20

Experiments suggest that it is possible for the moderator water to drain during the following postulated scenario: rupture of the pressure tube and calandria tube failure followed by end-fitting ejection and drainage of the moderator. This loss of moderator could result in severe damage to a large number of channels, with consequences in excess of those anticipated in the Safety Report for then in-coreLoss of Coolant Accident (LOCA) + Loss of Emergency Core Cooling (LOECC) event.

This issue has a potential to affect the “radiological risk to public at Design Basis Accidents (DBA)”, “severe accident risks” and “Negative Impact on Safety” risk areas. The issue mainly affects the power operation. The event that is affected by this issue is the spontaneous pressure tube rupture, with simultaneous, but not consequential loss of ECC. The Industry has submitted the plans of actions to reduce the potential risk associated with this postulated event. Canadian Nuclear Safety Commission (CNSC) staff has, in principle, agreed with the proposed administrative measures taken to mitigate the potential consequences of this event, and also agreed that implementation of any substantial design changes to reduce the likelihood of the event could be done during plant refurbishment and replacement of fuel channels.

1.6. Fuel Channel Integrity and Effect on Core Internals (CI 1)

It should be verified that Fuel channel ageing is adequately monitored to ensure that the consequences of ageing on fuel channel integrity are adequately managed.

Although the CANDU reactor design has the capability to withstand the consequences of a pressure tube rupture, designers and operators must strive to reduce the probability of pressure tube failure. Fuel channel failure consequences are severe, particularly when taking into consideration the potential for damage to other channels and/or core internals. The issue is that it should be ensured that proper fuel channel inspection program is in place. Therefore the primary risk area related to this issue is “Negative Impact on Safety”. The issue is mostly relevant to power operation. The issue primarily affects pressure tube rupture including events with consequential loss of moderator. This issue is related to the RD-337 expectation on ageing.

1.7. Deterioration of Core Internals (CI 2)

The issue is that Licensees currently do not have an Ageing Management program for internal components.

The degradation mechanisms of the core internal could lead, if uncorrected, to operation outside design conditions. Deterioration of core internals could affect shutdown system capability and could cause other damage through loose parts. Such degradations are usually slow allowing time for detection and corrections. The primary risk area related to this issue is “Risk of Negative Impact on Safety - safety margins”. The issue is relevant to all plant conditions. In principle all the events that require the activation of the shutdown systems are affected by the issue. It is also acknowledged that the Canadian Nuclear Safety Commission (CNSC) is currently preparing a regulatory document on the management of ageing.

21

1.8. Ageing of Equipment and Structures (GL3)

To ensure that Nuclear Power Plant (NPP)safety is maintained, System Structure Component (SSC) ageing must be understood and managed effectively; that is, ageing effects of System Structure Component (SSC) must be detected (i.e. through inspection, testing or surveillance programs) and corrective actions taken (i.e. operating limits, operation, maintenance, repair, replacement) before loss of System Structure Component (SSC) integrity or functional capability occurs.

Licensees have established Component Life Cycle Management Programs as well as Fitness-For-Service Guidelines for the major Life Limiting Components for CANDU reactors (i.e., feeders, pressure tubes, steam generator tubes). However, Licensee programs for ageing management of other structures, systems and components (SSC) important to safety have not been as well established or systematically implemented as yet, and there are concerns that ageing degradation in passive components (e.g. calandria / reactor internals, concrete containment, etc.) is not as adequately managed. In addition, information to support the assumptions made in the safety analysis, and to support the Safe Operating Envelope has not been collected in a systematic manner.

Inadequate ageing management programs could lead to degradation of components due to untimely detection and mitigation of ageing effects on components, which could reduce the effectiveness of safety functions, lead to challenges in plant safety or reduce defence-in-depth.

The potential harm associated with an ineffective ageing management program involves:

1. Loss of safety functions;

2. Potential under-estimate of plant risks;

3. Potential for forced outages;

4. Potential damage to collateral equipment, or safety concerns for staff, if equipment fails catastrophically; and

5. Loss of defence-in-depth and designed-in redundancies.

Safety-related functions in nuclear power plants must remain effective throughout the life of the plant, including any extended life. Licensees are expected to have a proactive programme in place to prevent, detect and correct significant degradation in the effectiveness of important safety-related functions.

The issue is that it is not well demonstrated that the existing ageing management programs include systematic assessment of the ageing mechanism and their implications on the safe operating envelope. This is a finding from some of the Integrated Safety Reviews (ISR) being conducted for life extension projects, which includes the safety factor on management of ageing. Therefore the primary risk area related to this issue is “Negative Impact on Safety”. The issue is relevant to all plant conditions.

22

In principle all the events could be affected by this issue. Ageing degradation may reduce the ability of an System Structure Component (SSC) to perform its design functions and to meet its performance requirements over time. Ageing effects may also increase the probability of common cause failures or lead to a reduction of defence in depth.

CNSC regulatory document S-210 “Maintenance Programs For Nuclear Power Plants” requires that “the Licensee shall have a process to detect, assess, and manage deterioration of SSCs as a result of ageing effects such as irradiation, corrosion, erosion, fatigue, and other material degradation. The type and frequency of maintenance activities shall be modified to accommodate such effects”.

In the context of the implementation of Canadian Nuclear Safety Commission (CNSC) S-98 which is referenced in the PROL, the stations have also put in place programs to monitor the reliability of the systems important to safety. Moreover, at stations that are currently involved in life extension programs, extensive condition assessments of all the System Structure Component (SSC) important to safety have been performed.

It is also acknowledged that the Canadian Nuclear Safety Commission (CNSC) is currently preparing a regulatory document on the management of ageing.

1.9. Inadequacy of Reliability Data (GL 4)

When using quantitative tools (e.g. Probabilistic Safety Assessment (PSA)) to identify weaknesses and their prioritizations of issues, the lack of realistic component data may lead to inadequate decisions with respect to design or procedure modifications and regulatory requirements.

Global underestimation of component failure rates could result in incorrect Core Damage Frequency (CDF)/LRF estimates, which could allow the utility and the Canadian Nuclear Safety Commission (CNSC) to make decisions that, in reality, could represent a higher-than-acceptable plant risk. It also decreases our level of confidence in estimation of the risks related to the operation of the plant.

This, however, is not likely as sensitivity assessments for most components show that the impact of wide variations in failure probabilities has little significant impact on the quantified results, and in particular on Safety Goals. Also, for those component failures that are shown to have significant impact, a focused assessment can be done to avoid or reduce inappropriate data by taking into account all available experience with these specific components (including related OPEX).

The primary risk area related to this issue is “Negative Impact on Safety”, due to the possibility of making a wrong decision.

1.10. Need for Systematic Assessment of High Energy Line Break Effects (IH 6)

23

The issue is that for certain plants there has not been a systematic review of the dynamic and environmental effects of high energy piping breaks inside the containment and the consequences on plant safety. Moreover, consequential damage associated with failure postulated is not systematically considered in probabilistic risk assessments or in the design basis accidents used for nuclear safety analyses in accordance with the licensing basis for the plants.

Dynamic effects at high energy pipe breaks (e.g. pipe whip, jet impingement) can cause consequential failure of Structures, Systems and Components (SSCs) and impair defence-in-depth. This raises concerns of increased radiological risks to public and of severe accident risks.

The possible consequences are:

• dynamic effects caused by the ruptured pipe;

• effects resulting from fluid flow, jet impingement, irradiation and contamination;

• variation in local ambient conditions (pressure, temperature, humidity, floods);

• debris generation and potential for blockage of emergency recirculation during design basis accident.

Pipe ruptures may lead to safety systems, equipment, structures and containment being damaged and/or the accident mitigation being jeopardized.

Upon the review of International Atomic Energy Agency (IAEA) Nuclear Safety Guide NS-G-1.11 and past Canadian practices, it is considered that it is necessary to assess and document the consequences associated with the postulated rupture of high-energy piping systems.

Also, International Atomic Energy Agency (IAEA) NS-G-1.11 acknowledge that for existing plants some design oriented recommendations may not be practicably achievable. The objective of the subject systematic review should be to quantify consequences and subsequent work would be required to mitigate these consequences to the extent practicable.

The issue is primarily related to the fact that there has not been a fully documented systematic review of the consequences of high energy pipe breaks. There are uncertainties in the existing safety assessments related to such breaks. Therefore the main risk area related to this issue is “Negative Impact on Safety”.

This issue is relevant for all operational states when the definition of high energy pipe is met (power and shutdown states).

The issue affects all events that involve high energy pipe breaks in the primary side of NPP.

Difference in design of plants will have an impact on the consequence of postulated piping failures. Plant specific systematic reviews must be performed and these places an onus on assessing both core damage and large release frequencies associated with postulated piping ruptures.

24

For example:

• Some containment designs have process equipment “sticking-out” of containment and others have main steam lines penetrating containment. The potential for containment impairment due to the dynamic effects of postulated rupture will be different.

• Multi-unit stations have different scope of periodic inspection than single unit stations.

• The difference in containment designs can impact on the ability to detect leakage from the primary heat transport circuit.

1.11.Molten Fuel/Moderator Interaction (PF 15)

Severe flow blockage in a fuel channel, or flow stagnation, could potentially lead to fuel melting and ejection of molten fuel into the moderator. The primary concerns of GAI 95G01 are the ejection mechanism, and the subsequent interaction of the molten fuel with the moderator. There are uncertainties in the nature of the interaction between the molten material and the D2O in the moderator (forced interaction vs free interaction). The extent of the damage to the shutoff rods, fuel channels, other core internal and the calandria itself depends on the nature of this interaction.

High-pressure ejection of molten fuel into the subcooled moderator may occur during an in-coreLoss of Coolant Accident (LOCA) that follows a stagnation feeder break or severe flow blockage, possibly leading to a steam explosion. The additional loads due to molten fuel/metal interaction may cause impairment of the shutdown function (failure of Special Shutdown System (SDS)1 rods guide tubes). In addition, the fuel cooling function may be impaired if several channels consequentially fail due to loads generated during the molten fuel/metal interaction.

The issue is that there are uncertainties in the nature of the interaction between molten material and the moderator fluid. Therefore the primary risk area related to this issue is “Negative Impact on Safety”. If the shutdown function or the cooling function fails, there is a significant likelihood that design basis accidents may propagate to severe core damage. As the containment integrity is not expected to be challenged, the public doses are not expected to be significant.

The events affected by this issue are severe flow blockage in a single channel and feeder stagnation break.

There is no specific regulatory requirement directly related to the issue. The issue is nevertheless indirectly related to the requirements in the Siting Guide, and in the Regulatory Documents C-6, RD-310 and RD-337 that apply to design basis events.

The Canadian Nuclear Safety Commission (CNSC) raised the Generic Action Item GAI 95G01 “Molten fuel-moderator interaction” to address the concern.

25

1.12. Fuel Bundle/Element Behaviour under Post-dryout Conditions (PF 18)

The knowledge base for post-dryout fuel, fuel bundle and pressure tube behaviour, in support of the current safety case may be inadequate.

The issue is relevant for accident conditions covered under G-144. These generally involve high Heat Transport System (HTS) pressure, relatively high channel flows and relatively mild temperature. The frequency of the events is relatively high such that most of the events considered here are Anticipated Operational Occurence (AOO)’s under RD-310 event categorization.

Lack of models (fuel bundle deformation) or lack of rigour/confidence in the models (fuel element behaviour) causes lack of confidence in safety analysis predictions that there is no fuel element or fuel channel failure. Licensees have traditionally used a conservative Limit of Operation Envelope (LOE) methodology. Some better estimate models are reported in the Darlington Safety Report; they show improved results, i.e., larger margins. A statistically-based best-estimate model is under development by OPG and BP, which are expected to demonstrate larger margins. G-144 acceptance criterion for the first trip is sufficient but not necessary for fuel or fuel channel integrity. This criterion may be difficult to meet especially using the Limit of Operation Envelope (LOE) methodology and aged reactor conditions.

Fuel element failure would lead to loss of a barrier to fission product release from containment. This would not necessarily lead to fission product release to containment if Heat Transport System (HTS) remains intact. The importance of fuel failure depends whether the Heat Transport System (HTS) is breached due to initiating event itself (such as small breakLoss of Coolant Accident (LOCA)) or whether it also results in consequential fuel channel failure.

Consequential pressure tube failure may lead to loss of a barrier to fission product release (if not already breached due to the initiating event), lead to severe core damage and loss of coolable geometry. Maintenance of a coolable geometry is a fundamental safety principle.

Generally the conservative Limit of Operation Envelope (LOE) methodology is used. A statistical-based best-estimate methodology, using the same codes and models, is under development to demonstrate larger margins.

1.13. Impact of Ageing on Safe Plant Operation (PF19)

Plant ageing related issues are varied and complex and there are several issues associated with the impact of plant ageing. One such issue is the adverse impact of plant ageing on safety and safety related systems designed to prevent or mitigate accidents. In particular, the concern is whether all the plant ageing mechanisms are identified and their impact are determined, addressed in an integrated manner and adequately accounted for in the shutdown system trip parameter setpoint adjustments.

26

Therefore, the above concerns are related to the adequacy of monitoring, collecting and analysing data from the ageing parameters to verify that the assumptions and requirements from safety analysis are modified and analyzes. If the SOE must be modified adequate guidance to help to translate those modifications into operational documentation should be available.

The issue is that there is a concern that existing ageing management programs do not include a complete assessment of all the implications of plant ageing on the safe operating envelope. Therefore the primary risk area related to this issue is “Negative Impact on Safety”. Licensees need to make sure that ageing effects are taken into account when establishing appropriate operating limits and conditions. The issue is relevant to all plant conditions.

In principle all the events could be affected by this issue. Due to the very nature of Neutron Overpower Protection / Regional Overpower Protection trips measuring neutron flux as a measure of reactor power, it is one of the first design basis events (slow loss of reactivity control) that would be affected the most and directly. There are other Design Basis Accidents (DBA)s that are affected by the ageing of the plants, such Loss of Flow (LOF), Electrical failures, SmallLoss of Coolant Accident (LOCA), Slow Loss of Regulation (SLOR), Fast Loss of Regulation (FLOR). The impact of ageing on these events is mainly related to the potential changes on critical channel power. The impact of ageing on the behaviour of fuel channels following high temperature/pressure fuel channel transients also has to be taken into account.

The instruments that are prone to ageing are flow orifices, RTDs, Neutron Overpower Protection (NOP)detectors, pressure transducer impulse lines, etc. It should be noted that some instruments need to be calibrated for the intended range of operation. However, instruments such as orifices cannot be re-calibrated because it is not possible to take them out of the Heat Transport System (HTS). Although there are other means to confirm the measurements of some instruments (such as ultrasonic flow measurements), these are taken at steady state, normal operating conditions and not under the conditions of accidents. The safety system still relies on the aged instruments to perform as designed under accident conditions.

It is also acknowledged that the Canadian Nuclear Safety Commission (CNSC) is currently preparing a regulatory document on the management of ageing.

1.14. Analysis Methodology for Neutron Overpower Protection / Regional Overpower Protection Trips (PF 20)

The general issue is that, due to concerns on new Neutron/Regional Overpower Protection (NOP/ROP) methodology, the confidence level in preventing fuel dryout following a slow loss of regulation may be eroded. Detailed issues are (irrespective of importance):

• Completeness of selected core states/flux shapes set: Regional Overpower Protection (ROP)/ Neutron Overpower Protection (NOP)system design is based on information derived from simulations of certain reference and perturbed flux shapes in the reactor core. Trip setpoints are established from these simulations to prevent any channel reaching its critical power limit in case of a bulk loss of regulation. One key component in the analysis is the relationship between flux values at detector locations and channel powers for various flux

27

shapes. The analyses assume that the ratios of changes in fluxes and channel powers due to perturbation, called simulation ratios, are invariant with respect to the reference flux shape; this assumption is based on the superposition principle. On this basis a limited number of combinations of credible perturbed flux shapes and an untilted reference flux shape are analysed to derive trip setpoint values. Furthermore, these trip setpoint values provide coverage for different plant states. Differences in the reference flux shape used in the analyses and actual flux shapes are accounted for by regular detector calibration. There are limits on acceptable flux tilt limits such that the existing analysis is applicable to initial tilted states.

• Statistical treatment of uncertainty categories (true value and simulation).

• Assessment of the impact on Neutron/Regional Overpower Protection (NOP/ROP) analysis of not including the xenon free effects due to refueling - fresh fuel, initially, has no xenon causing changes in local Neutron Overpower Protection (NOP)detector readings, temporary changes in the axial flux distribution, and changes in the instantaneous channel power distribution. All these affect the trip setpoint.

• Channel and detector uncertainties and their impact on the Neutron/Regional Overpower Protection (NOP/ROP) analysis.

• Improved basis for abnormal Neutron/Regional Overpower Protection (NOP/ROP) handswitch setpoints.

• Quasi steady-state Neutron Overpower Protection (NOP)analysis method may not be realistic for some core states (especially for slow Loss of Regulation (LOR)s) because it does not capture the impact of the void feedback on flux shape or Neutron Overpower Protection (NOP)detectors response (the current BP/OPG position is that the existing slow Loss of Regulation (LOR) method is conservative due to the assumption that the neutronic and thermal power lag is neglected). A realistic, dynamic study of a Loss of Regulation (LOR) transient has been provided as part of 2005 submission.

• Impact of ageing on Neutron/Regional Overpower Protection (NOP/ROP) analysis. o Point Lepreau and Gentilly-2 have dealt with the plant ageing and its impact on the Regional Overpower Protection (ROP) trip coverage. o OPG/BP have developed advanced and detailed uncertainty assessment methodology. Neutron Overpower Protection (NOP)Analysis was the first instance of incorporating Heat Transport System (HTS) ageing effects into safety analysis in an integrated manner with Bruce B NOP Analysis submitted to the Canadian Nuclear Safety Commission (CNSC) in 2005. Canadian Nuclear Safety Commission (CNSC) is in the process of reviewing the BP/OPG NOP analysis and the associated methodology through an Independent Expert Panel. Canadian Nuclear Safety Commission (CNSC) has requested Bruce Power to participate in the conduct of the Independent Expert Panel.

An inadequate Neutron/Regional Overpower Protection (NOP/ROP) trip may lead to fuel failures or fuel bundle deformation in loss of regulation accidents (LORA), affecting margins to fuel channel failures prior to reactor shutdown on other trips.

28

Since the new methodology is currently under review by the Canadian Nuclear Safety Commission (CNSC), the issue is that there are uncertainties in the new methodology that could lead to the eroded trip effectiveness. Therefore the primary risk area related to this issue is “Negative Impact on Safety”. Nevertheless, considering that it is acknowledged that the analysis methodology also contains certain inherent conservative assumptions, it is considered that these uncertainties do not affect the other risk areas. Finally, this issue is also relevant to power operation.

The issue affects the prediction of the consequences of slow loss of regulations. There is no specific regulatory requirement directly related to the issue. The issue is nevertheless indirectly related to the requirements in the Siting Guide, R-8, C-6, RD-310 and RD-337 that apply to design basis events.

1.15. Open Design of the Balance of Plant – Steam Protection (PSA 3)

In Bruce A/B, Pickering B and Darlington, the steam line break and feedwater line breaks are the largest contributors to the Core Damage Frequency (CDF) and the Large Release Frequency (LRF). Safety Goals are met, but given the results indicate a highly unbalanced design or conservatively simplified modelling. These results suggest that improvements should be considered; conversely, the model could be reviewed to determine if more realistic assumptions would reduce the contributions from those events.

A steam line break impacts the entire turbine hall and many electrical cabinets, and instrument air could fail; more detailed and realistic assessment could nevertheless show that even equipment that are not environmentally qualified could survive or be recovered in ‘mild’ environments associated with such events. The turbine hall is an open design with very little steam protection. The installation of the Powerhouse Emergency Venting System (PEVS) in Bruce and Darlington, however, can help reduce the degree of harshness of steam conditions for small to intermediate steam line breaks (specially for locations far from the steam line break) which can improve survival or potential recovery of exposed components in the powerhouse.

Licensees need to consider practicable measures to reduce the probability of consequential failures of support systems to control, cool, and contain (e.g., instrument air, electrical, Heating Ventilation Air Conditioning (HVAC)) and ensure adequate reliability of powerhouse venting to mitigate the consequences of a steam line break.

This is not an Environmental Qualification issue, as the electrical components cannot be fully qualified for steam conditions. Barriers (enclosures, shields) will be needed to protect electrical equipment. The existing provisions for steam protection are not considered as fully effective in the Licensees Probabilistic Safety Assessment (PSA)s. This issue is considered to have potential impact on all risk areas. Finally, this issue is mostly relevant to power operation. There could also be an impact on a shutdown unit from a steam line break in an operating unit. This issue affects primarily secondary side breaks in the balance of plant. The issue is related to the expectations in RD-337.

29

1.16. ECCS Sump Screen Adequacy (SS 1)

A postulatedLoss of Coolant Accident (LOCA) would dislodge significant quantities of insulation material (fibrous and particulate) which could potentially lead to partial blockage of the strainers and small debris may also clog the plant’s downstream components located in the Emergency Core Cooling System (ECCS) and containment spray system (CSS) thereby impairing Emergency Core Cooling System (ECCS) recirculation.

Break-up of thermal insulation around equipment and pipes inside the containment can, underLoss of Coolant Accident (LOCA) conditions, lead to an impairment of ECC recirculation by clogging the sump screens and/or the Emergency Core Cooling System (ECCS) heat exchangers.

The U.S. Integrated Chemical Effects Test (ICET) program has found that certain chemicals could cause a thin impervious layer to be formed on ECC strainers causing a large enough pressure drop that recovery pump Net Positive Suction Head (NPSH) requirements would not be met and ECC recirculation would be impaired.

The debris in the sump was considered to be generated in one of five ways – dislodgement of insulation and other material due to direct impingement by the jet of reactor coolant from the failed piping, transportation of pre-existing debris from on or near the floor in the flow path from the break discharge to the strainer, peeling of coatings from walls, floors or equipment, which could be carried by the flow of the condensate to the sump, or chemical effect leading to precipitation of dissolved materials over long term ECC recovery operation.

Affected downstream components may include: heat exchangers, orifices, containment spray nozzles, reactor internals and fuel assemblies (core flow).

The main concern is that even though there have been recent improvements made to CANDU ECC strainers and debris reduction programs these initiatives did not fully consider chemical effects in the building sumps. The primary risk area related to this issue is “Negative Impact on Safety”. The uncertainties on safety margins lead to impact on the other risk areas, mainly radiological risk to public at Design Basis Accidents (DBA) and severe accident risks. Finally, this issue is mostly relevant to power operation. The only events that may be significantly affected by the issue areLoss of Coolant Accident (LOCA)s, since they are the only events where Emergency Core Cooling System (ECCS) recirculation is credited.

The severity ofLoss of Coolant Accident (LOCA) with consequential loss of recirculation (with or without containment failure) depends on the degree of strainer fouling, and the time at which Emergency Core Cooling System (ECCS) begins to be impaired.

The Generic Action Item GAI 06G01 states that Licensees are to evaluate the Integrated Chemical Effet Test (ICET) tests and demonstrate that CANDU ECC strainers are not vulnerable to deposits such as those identified in the Integrated Chemical Effet Test (ICET) and take additional actions if they can not show that this is the case.

30

1.17. Hydrogen Control Measures during Accidents (SS 5)

Hydrogen released in Pressurized Heavy Water Reactor (PHWR) Nuclear Generating Stations during certain accident sequences may produce flammable gas mixtures in some regions of containment. The mechanical and thermal loads generated by the ignition of these gas mixtures may challenge the integrity of the containment envelope, supporting internal walls and required safety-related equipment.

Insufficient hydrogen mitigation during accident scenarios may impair the containment or confinement function.

Generic Action item GAI 88G02 addresses the extent and depth of analysis concerning hydrogen mixing, combustion modes and loads in containment and the capability of hydrogen mitigation systems. In the past, Canadian Nuclear Safety Commission (CNSC) staff has indicated that more work was needed to reduce uncertainties related to: hydrogen concentration, standing flames, flame acceleration, flame propagation between compartments, transition from deflagration to detonation and effectiveness of considered hydrogen mitigation measures. Therefore the primary risk area related to this issue is “Negative Impact on Safety”. The uncertainties on safety margins lead to impact on the other risk areas, mainly radiological risk to public at Design Basis Accidents (DBA) and severe accident risks.

Finally, this issue is mostly relevant to high power operation coincident with aLoss of Coolant Accident (LOCA) and impairments to ECC. The likelihood of impairment to containment function from hydrogen “slow burns” is extremely low.

The event associated with generation of hydrogen is theLoss of Coolant Accident (LOCA) and the credible dual-failure case ofLoss of Coolant Accident (LOCA) and loss of emergency coolant injection (LOECI). Following aLoss of Coolant Accident (LOCA), combustible gases, principally hydrogen, may accumulate inside the reactor containment as a result of:

• metal-water reaction involving the fuel element cladding;

• the radiolytic decomposition of the water in the reactor core and the containment sump;

• the corrosion of certain construction materials;

• any synergistic chemical, thermal and radiolytic effects of post-accident environmental conditions on containment protective coatings and electric cable insulation.

Highly stylized sensitivity studies of post-blow-down steam flows through the core have indicated escalation of the hydrogen and radionuclide production for flows larger than zero but less than 100 g/s per channel. The dual failure events with critical steam flow in the channels are assessed to be of very low probability (with source terms more representative of severe accident scenarios) and, as such, would be classified as beyond design basis under modern regulatory requirements such as RD-310 and RD-337.

31

GAI 88G02 requires implementation of adequate hydrogen mitigation for design basis accidents As indicated in the Risk Control Measures (RCM) at the end of the Report, GAI88G02 was closed in 2009 based on detailed plans and proposals presented by the various Licensees to install Passive Autocatalytic Recombiners (PARs)s. Station specific action items have been opened to track the completion of the implementation activities, including addressing the adequacy of hydrogen control measures for beyond design basis accidents.

8. RISK ESTIMATE AND EVALUATION

Following the completion of the Issue Definition step, the Risk Informed Decision Making (RIDM) process was applied to estimate and evaluate the significance of the safety related risks of the Category 3 Safety Issues, as listed in Table 1.

Again the starting point for these estimates and evaluations was the information contained in reference 9.3. As in reference 9.3, the following risk areas were considered in performing the risk estimates and evaluations:

• Radiological Risk to Public at Design Basis Accidents (DBA);

• Severe Accident Risks;

• Risk of Negative Impact on Safety.

The estimates and evaluations were performed using the updated Risk Informed Decision Making (RIDM) process 9.3, and in particular the revised tables for estimating the Risk of Negative Impact on Safety.

1.18. Risk Estimate and Evaluation Tasks

The following tasks were completed to estimate and evaluate the risks of the various issues:

• Review the template for preparing the risk evaluation . This review was performed by the Industry RIDM Issue Team (RIT) coordinator. Some changes to the format were proposed and accepted by the CNSC RIT member. The changes were then proposed to the RIT members who recommended to the RIDM Process Team (RPT) to adopt them. They were adopted by the RIDM Process Team (RPT) and included in the updated version of the CNSC RIDM process 9.3. The changes consisted in reversing the order of the estimation of the consequences and likelihood of the issues; the basis for this change was that the consequences had to be specified before estimating the likelihood of the risk scenarios since these consequences are related to a sequence of barrier failures.

• Review the risk scenarios relevant to each of the risk areas and for each issue. The basis for defining the scenarios is documented in the RIDM process document 9.3. The risk scenarios are event sequences (note that the term ‘event sequences’ is used here in a broad sense and is not limited to station specific system failures, operator errors, common mode failure or external events) whose consequences or likelihood are affected by the

32

issue under consideration. In particular, the risk scenarios for the Risk of Negative Impact on Safety area include event sequences that implicitly assume that the initiating event itself is the issue under consideration; the likelihood of the scenario reflects the likelihood of the issue. The review of the risk scenarios was performed jointly by the Industry RIT coordinator and the CNSC RIT member. In general the original risk scenarios were retained. The proposed risk scenarios were presented to the RIT members and they were finalized during the RIT meetings.

• Perform preliminary risk estimates and evaluations . The risk estimates and evaluations were performed using the risk matrices documented in the Risk Informed Decision Making (RIDM) process document 9.3. Estimation and evaluation of risks involved qualitative judgments, although numerical data were used when available. In practice the preliminary assessment was performed by the Industry RIT coordinator and the CNSC RIT member who took into account the original assessments, the new information on the various issues, as documented in the issue definition forms (see 9.3), and the revised Risk Matrices 9.3. These preliminary assessments were then presented to the RIT members and were accepted or revised during RIT meetings.

• CNSC staff review of the risk estimates and evaluations: The proposed risk estimates and evaluations were then reviewed by the CNSC subject matter experts. The feedback from the CNSC staff was sent to the Industry RIT coordinator who reviewed and incorporated them and presented any significant changes to the RIT members for endorsement. It is to be pointed out that for the Large Break Loss of Coolant Accident (LBLOCA) issues, three CNSC staff involved in the Large Break Loss of Coolant Accident (LBLOCA) Working Group joined the RIDM Issue Team (RIT) to directly participate in the risk estimation and evaluation exercise.

The complete updated risk estimates and evaluations for all the Category 3 issues are presented in 9.3.

1.19. Risk Significance Level Summary

The results of the assessment of the risk significance levels for Category 3 issues are summarized in Table 4 for the Large Break Loss of Coolant Accident (LBLOCA) related issues and in Table5 for the non-LBLOCA issues.

These tables show that, for the Radiological Risk to Public at Design Basis Accidents (DBA) and the Severe Accident Risk, none of the issues has a risk significance level higher than 2, which means, according to , that for these safety areas the risks are within the Tolerable range. For a limited number of scenarios, the risk significance level for the Risk of Negative Impact on Safety is equal to 3, which indicates that Risk Control Measures need to be identified and implemented to lower the risk significance of these issues. The identification and assessment of these Risk Control Measures are discussed in Section 1.19.

It is also to be pointed out that during the review of the issues previously identified as Category 3, it was determined that, based on the results of the R&D completed since the original

33

assessment of these issues, and taking into account the results of this assessment, some of the issues were no longer considered as Category 3 issues. The updated issue Categorization is presented in Table 6. Four issues are no longer considered as Category 3 issues. Issues that have been re-categorized are:

• AA 7 Analysis for pressure tube failure with consequential loss of moderator – moved to Category 1

• CI 2 Deterioration of core internals – moved to Category 2

• GL 4 Inadequacy of reliability data – moved to Category 2

• SS 1 ECCS sump screen adequacy – moved to Category 1

These issues are not discussed further.

34

Table 4: LargeLoss of Coolant Accident (LOCA) RSLs Summary3

Issue Scenarios Risk of Negative Impact on Safety

Radiological Risk to Public at Design Basis Accidents (DBA)

Severe Accident Risk

AA 8

Analysis for Moderator Temperature Predictions

2007 CNSC Report: RSL 3

Confidence in prediction of moderator sub-cooling and of adequacy of sub-cooling to ensure integrity of the fuel channel.

C1*L1–> 1 - -

Failure of several fuel channels due to inadequate cooling under a LOCA.

C2*L0–> 1 - -

Consequential CT/PT Failure because of inadequate sub-cooling during a LOCA, or LOCA + LOECC.

- C2*L1–> 1 -

Large LOCA where there is a need to rely on moderator for fuel cooling.

- - 1

AA 9

Analysis for Void Reactivity Coefficient


Code prediction of the coolant void reactivity (CVR) may be under-predicted due to inadequate validation.

C2*L2–> 3 - -

CVR is under-predicted during a large LOCA, but this does not affect the prediction that there is no fuel channel failure occurring.

C1*L1–> 1 - -

Fuel channel integrity may be affected due to under-prediction of the CVR at large LOCA with multiple consequential fuel channel failures occurring.

C2*L0–> 1 - -

Fuel channel integrity may be affected due to under-prediction of the Coolant Void Reactivity (CVR) at smaller voiding rates, - fuel channel failures not occurring.

C1*L1–> 1

3 The consequence categories (C1, C2, C3) and Likelihood categories (L0. L1, L2, L3) refer to the categories defined in the risk matrices presented in reference 9.3 and which are reproduced in 9.3.

35




Increased doses to public when Coolant Void Reactivity (CVR) is under-predicted during a large LOCA, but without fuel channel failure occurring.

- C2*L2-> 2 -

Increased doses to public due to fuel failure / fuel channel failure when Coolant Void Reactivity (CVR) is under-predicted during a large LOCA with consequential multiple fuel channel failures.

- C2*L2-> 2 -

Safety Goals unchanged if no fuel channels fail at LOCA due to under-prediction of Coolant Void Reactivity (CVR).

- - 2

PF 9

Fuel Behaviour in High Temperature Transients


Fuel behaviour under high temperature transients. C2*L2–> 3 - -

Large LOCA leading to high fuel temperatures and therefore multiple fuel channel failures.

C3*L0–> 2 C2*L2–> 2 2

Large LOCA leading to high fuel temperatures and therefore multiple fuel failures.

C2*L1–> 2

PF 10

Fuel Behaviour in Power Pulse Transients


Fuel behaviour under CANDU Power Pulse conditions. C2*L2–> 3 - -

Large LOCA leading to large power pulse and therefore multiple fuel channel failures.

C3*L0–> 2 C2*L2–> 2 2

Large LOCA leading to large power pulse and therefore multiple fuel failures.

C2*L1–> 2 - -

36




PF 12

GAI 00G01 Channel Voiding during a Large LOCA

2007 CNSC Report: RSL 2/3

Fuel channel failure due to power pulse greater than estimated due to underestimation of the voiding rate.

C2*L1–> 2 - 2

37

Table 5: Non LBLOCA RSLs Summary




AA 3

Computer Code and Plant Model Validation


The computer codes do not adequately characterize the phenomena affecting the outcome of events and accidents.

C1*L3 -> 3 - -

The computer codes have not been validated to predict the magnitude of important process/plant parameters and the numerical accuracy of some predictions is not sufficiently assessed.

C2*L2 -> 3 - -

AA 7

Analysis for Pressure tube Failure with consequential Loss of Moderator


Based on this assessment and taking into account current

Consequential moderator drain due to end-fitting ejection at in-core LOCA with single channel failure (ECC available)

C1*L1–> 1 - -

Consequential moderator drain due to end-fitting ejection at in-core LOCA with single channel failure (ECC unavailable)

- C3*L1–> 1 2

Consequential moderator drain due to end-fitting ejection at in-core LOCA with Loss of Emergency Core Cooling (LOECC) and multiple fuel channel failure.

C3*L0–> 2 C4*L1–> 3

(2, due to very low likelihood. In fact this sequence is considered below the Design Basis Accidents (DBA) frequency

2

38




information, it is recommended to move this issue to Category 1.

threshold whereas this criterion is for Design Basis Accidents (DBA).)

CI 1 Fuel Channel Integrity and Effect on Core Internals

2007 CNSC Report: RSL 2 (through GL 3)

Fuel channel failure due to ageing degradation. C2*L0–> 1 C2*L2–> 2 2

Accounting for the impact of fuel channel degradation on assumptions in the plant safety analysis.

C1*L2 -> 2 - -

CI 2

Deterioration of Core Internals


Based on this assessment and taking

Contact between calandria tubes and the liquid poison injection shutdown system nozzles (LISS nozzles) and/or the horizontal flux detector units, due to creep during the design life.

C2*L1–> 2 C1*L2–> 1 1

39




into account current information, it is recommended to move this issue to Category 2.

GL 3

Ageing of Equipment and Structures


Failure of SSCs to perform safety function. C2*L1–> 2 - -

Mitigating system failure. - C2*L2–> 2 2

GL 4

Inadequacy of Reliability Data


All scenarios of impairment of individual Safety functions. C1*L1–> 1 - -

All scenarios of cumulative impairment of Safety functions and Safety barriers.

C2*L1–> 2 - -

The challenges to Safety Goals are underestimated if reliability data are underestimated.

- - 2/1

40




Based on this assessment and taking into account current information, it is recommended to move this issue to Category 2.

IH 6

Need for Systematic Assessment of High Energy Line Break Effects


Mechanical damage to nearby SSCs following High Energy Line Breaks.

C3*L0–> 2 C2*L2–> 2 2

Degradation of Safety function and Safety barriers. C3*L0–> 2 C2*L2–> 2 2

PF 15

GAI 95G01: Molten Fuel / Moderator Interaction

Insufficient data to predict melted fuel/moderator interaction. C2*L0–> 1 - -

Fuel melting after stagnation feeder break or flow blockage

(Damage to Special Shutdown System (SDS)1).

C2*L0–> 1 - -

41






(Multiple channel failure).

C2*L0–> 1 - -


(Impairment of Special Shutdown System (SDS)1 and ECI).

C3*L0-> 2 C2*L2-> 2 2

PF 18

Fuel Bundle / Element Behaviour under Post-Dryout Conditions


Small loss of coolant. C3*L0–> 2 C2*L1–> 1 2

Small loss of coolant and deflated airlock. C3*L0–> 2 C2*L1–> 1 2

Single pump trip. C3*L0–> 2 C2*L2–> 2 2

Insufficient data to understand the behavior of element under post-dryout condition.

C2*L1–> 2

(Industry)

or

C2*L2–> 3

(CNSC)

- -

42




PF 19

Impact of Ageing on Safe Plant Operation


Impact of ineffective monitoring and assessment of ageing parameter on plant Safe Operating Envelope.

C2*L1–> 2 C2*L2–> 2 2

PF 20

Analysis Methodology for NOP / ROP Trips (ageing aspects)


Incorrect prediction of Neutron Overpower Protection (NOP)trip set points from the analysis methodology.

C2*L1–> 2 - -

Fuel deformation leading to fuel element / Pressure Tube (PT) contact under dryout conditions resulting from Neutron Overpower Protection (NOP)trip issues.

C2*L1–> 2 - -

Cannot prevent dryout following slow loss of regulation, due to Neutron Overpower Protection (NOP)trip issues, leading to fuel failures.

C3*L1–> 3 C1*L2–> 1 -

43




Cannot prevent dryout following slow loss of regulation due to NOP trip issues and there is a single fuel channel failure.

C3*L0–> 2 C2*L2–> 2 1

Cannot prevent dryout following slow loss of regulation due to NOP trip issues and there are multiple fuel channel failures.

C3*L0–> 2 C2*L2–> 2 2

PSA 3

Open Design of Balance of Plant - Steam Protection


Steam/Feedwater Line Breaks outside containment resulting in high pressure steam in turbine hall and, with the failure of other SSCs, consequential core damage and containment failure due to loss of support systems.

C3*L0 –> 2 C4*L1 –> 3

(2, due to very low likelihood. In fact this sequence is considered below the DBA frequency threshold whereas this criteria is for DBA )

2

SS 1 LOCA + Consequential Loss of Recirculation . C2*L1 –> 2 C1*L2 –> 1 1

44




ECCs Sumps Screen Adequacy


Based on this assessment and taking into account current information, it is recommended to move this issue to Category 1.

LOCA + Consequential Loss of Recirculation + Failure of Containment.

- C1*L1 –> 1 -

SS 5

Hydrogen Control Measures during Accidents


Large LOCA. C2*L1 -> 2 C1*L2 -> 1 -

Large LOCA + LOECC. C3*L0 -> 2 C2*L1 -> 1 -

Small LOCA + LOECC. C3*L0 -> 2 C2*L2 -> 2 -

LOCA (Large or Small) + LOECC + Loss of Moderator as a Heat Sink (due to any other failure) and Containment is damaged due to hydrogen burned.

- - 2

45




LOCA (Large or Small) + LOECC + Loss of Moderator due to H2 deflagration.

- - 2

LOCA (Large or Small) + LOECC + Loss of Containment integrity due to H2 deflagration.

- - 2

46

Table 6: Updated Risk Categories (note: these are not the Risk Significance Levels)

Safety Issue New Categorization after RIDM process update

AA 3 Computer code and plant model validation 3

AA 7 Analysis for pressure tube failure with consequential loss of moderator

1

AA 8 Analysis for moderator temperature predictions 3

AA 9 Analysis for void reactivity coefficient 3

CI 1 Fuel channel integrity and effect on core internals 3

CI 2 Deterioration of core internals 2

GL 3 Ageing of equipment and structures 3

GL 4 Inadequacy of reliability data 2


3

PF 9 Fuel behaviour in high temperature transients 3

PF 10 Fuel behaviour in power pulse transients 3

PF 12 GAI 00G01 Channel voiding during a large LOCA 3

PF 15 GAI 95G01: Molten fuel/moderator interaction 3


3

PF 19 Impact of ageing on safe plant operation 3

PF 20 Analysis methodology for NOP / ROP 3

PSA 3 Open design of the balance of plant - steam protection 3

SS 1 ECCS sump screen adequacy 1

SS 5 Hydrogen control measures during accidents 3

SS 8 Availability of the moderator as a heat sink 3

47

9. CONTROL RISK

The 5th step of the RIDM process (see ) is the step during which Risk Control Measures (RCMs) are identified and assessed. As described in 9.3, the team suggests various options for mitigating the risk, and discusses their advantages and disadvantages. Risk control options are designed to reduce either the frequency (of the issue/problem at hand) or its consequences, or both; they should focus on the more significant risks associated with the issue. For many of the Category 3 Safety Issues addressed in this report, the lack of knowledge and understanding of the issue, and/or confidence in the adequacy of safety margins was a significant factor in the risk assessment. These concerns were a significant contributor to the risk significance level assignments, and can be addressed through further experiments and/or analysis.

When considering risk reduction, the following “hierarchy of risk control principles” is considered:

• Can the risk be eliminated if the work/activity were done in a different way (that does not introduce new hazards), or if control were shifted to another group?

• Can the frequency be reduced, e.g. by a less hazardous path, improved training, continuing monitoring and maintenance, etc.?

• Can the consequences be reduced, e.g. by introducing contingency plans, wearing protective equipment, etc.?

• Can the time-at-risk be reduced?

• Can the hazard be controlled at source through physical engineering controls?

• Can the hazard be minimized by introducing procedural controls such as work procedures with hold-points, independent verification or using personal protective clothing and equipment?

• Can the knowledge and understanding of the issue, and/or confidence in the adequacy of safety margins be improved through further experiments and/or analysis?

In addition, the following key elements are considered when assessing risk control measures:

• The Risk Control Measures recommended to the decision makers are commensurate with the significance of the risk

• The control measures should focus on addressing the more significant risks associated with the matter of concern.

• The degree of “severity” and “urgency” of the actions depends not only on the risk significance level, but on all the inputs to the decision makers

• The risk in the intolerable region should be ruled out unless Risk Control Measures (RCM) are implemented to bring the level of risk into the lower regions.

• Within both the tolerable and acceptable ranges, additional Risk Control Measures (RCM) should be taken if it is reasonable to do so.

48

• R&D, or further analysis performed to better understand critical phenomena is an appropriate Risk Control Measures (RCM) where uncertainties in behaviour are identified as a significant issue, and a significant contributor to the identified risks (this is this “perceived risk” aspect, that underlies the definition for a Category 3 issue).

The following subsections describe the process used to identify and assess the Risk Control Measures (RCM)s for Category 3 issues and summarize Risk Control Measures (RCM)s proposed for all the Category 3 issues. The details of the various Risk Control Measures (RCM)s that are proposed to address the revised Category 3 issues, including high level implementation plans and schedules are provided in 9.3.

1.20. RCMs Identification and Assessment Tasks

The Risk Control Measures (RCM)s for each issue under consideration are identified based on expert judgement. More specifically, for each of the non-LBLOCA issues that have been identified as a Category 3 issue:

• The RIT Industry coordinator:

- performed a review of the Risk Control Measures that were proposed in the previous version of this report 9.3;

- performed a review of the Canadian Owner Group ( COG) programs related to the various issues under consideration;

- proposed Risk Control Measures (RCM)s using the guiding principles from the CNSC RIDM process which are summarized in the previous section and in Table 7. Considering that for non LBLOCA issues, the highest risk significance level relates to the “Negative Impact on Safety” risk area, the Risk Control Measures (RCM)s are focused on improving the knowledge base related to the issues and are aimed at reducing the uncertainties related to these issues thereby improving safety margins and defence in depth.

• The CNSC RIT member reviewed and commented upon the proposed Risk Control Measures (RCM).

• The proposed non LBLOCA Risk Control Measures (RCM) were then submitted to the RIT members for review and comments. The Risk Control Measures (RCM)s for non LBLOCA issues were endorsed by the RIT members during RIT meetings.

• The Risk Control Measures (RCM)s endorsed by the RIT members were then sent for comments to the CNSC staff.

• The proposed Risk Control Measures (RCM)s were finalized following exchanges between the Industry and the Canadian Nuclear Safety Commission (CNSC), which, where applicable, involved discussions and meetings between CNSC staff and Industry experts. It is to be pointed out that for the PF 18 issue (Fuel Behaviour under Post-dryout) these tasks were completed during the execution of a Pilot Project and in particular during a 2-day workshop that involved RIT members as well as CNSC and Industry technical experts.

49

In the case of the Large Break Loss of Coolant Accident (LBLOCA) issues, a separate Industry/CNSC Working Group has been set up. The objective of this Working Group was to:

• Prepare Canadian responses on Large Break Loss of Coolant Accident (LBLOCA) safety margins and the related issue of Void Coefficient for the Nuclear Safety Convention.

• Provide technical support to the CNUEF- CNSC Executive in their efforts to establish a mutually agreed success path on the resolution of positive reactivity feedback, reactivity control, reactor shutdown, Large Break Loss of Coolant Accident (LBLOCA) safety margins and the related issue of Void Coefficient.

• Provide input and support to the joint CNSC-Industry Working Group on the application of Risk Informed Decision Making to those CANDU Safety Issues related to Large Break Loss of Coolant Accident (LBLOCA) and designated as Category 3 issues by the CNSC.

The RIDM issue team has used the information provided by the LBLOCA Working Group as an input to identify and assess the Large Break Loss of Coolant Accident (LBLOCA) related CANDU Safety Issues. To assess the identified Risk Control Measures (RCM)s, the guidance from 9.3 is followed. In addition, the RIDM issue team consulted the RIDM process team to get clarifications on how to combine the opinions of the various CNSC and Industry experts to define a recommended path forward to reduce the risks associated with the Category 3 issues. An Expert Elicitation process (EEP) based on the Analytic Hierarchy Process (AHP) has been proposed by the Process Team. These methods are well-established 9.3, and have been used to support the decision making process in various industries, including the nuclear industry outside (9.3 and 9.3) and inside Canada 9.3. Even though the methodology is well-established, its implementation for a particular application such as the assessment of the Risk Control Measures (RCM)s for the Category 3 CANDU Safety Issues requires effort. As a first application of this process by a Working Group involving the Industry and CNSC staff, and considering time constraints, the process team (RPT) recommended to apply a simplified version of the Expert Elicitation Process (EEP) methodology and to use a qualitative approach.

Contrary to the standard ANALYTIC HIERARCHY PROCESSR practice, no weighting of the evaluation criteria was made. Also the ranking for the evaluation criteria for the various risk scenarios and Safety Issues was made qualitatively. Table 8 presents the evaluation criteria that have been proposed to assess the Category 3 issues.

The Expert Elicitation Process (EEP) process is normally applied only for the issues for which:

• there is more than one Risk Control Measures (RCM), in addition to the status quo, identified,

• at least one of the risk scenarios has a risk significance level (Risk Significance Level (RSL)) higher than 1.

Conversely, if for an issue the Risk Significance Level in at least one safety area is larger than 2, and if only one Risk Control Measures (RCM) is identified and it is estimated that the Risk Control Measures (RCM) will lower the Risk Significance Level (RSL), then it will generally be

50

recommended that the Risk Control Measures (RCM) be pursued and no further analysis is performed.

More details on the EEP/Analytic Hierarchy Process (AHP)and its application to the Category 3 issues are provided in 9.3.

51

Table 7: Guidance on Correlation of RCM with Risk Significance Level (RSL)s

RSL1 RSL2 RSL3 RSL4

Recommendations for regulatory oversight and degree of scrutiny

- Additional efforts to control the risk may not be justified. - It may be appropriate to request addressing the risk as part of actions to resolve higher ranked risks, or as part of addressing other safety concerns due to the issue.

- Request the Licensee to identify measures to reduce the risk and to define a work plan to bring the risk in the acceptable region as far as practicable. Interim measures are not required. - Periodic review by CNSC of the status of the issue and of the implementation of the risk control measures.

- Request the Licensee to define a work plan within a firm timeframe to address the risk. Interim measures to reduce the risk may have to be recommended. - Intense scrutiny from CNSC with respect to verification (including inspections) of the implementation of risk control measures.

- Request the Licensee to implement immediate action to reduce risks. - Request establishing of compensatory measures until the safety problems are resolved. CNSC may instruct the Licensee to stop operation until compensatory measures are implemented.

Recommendations on potential measures that the Licensee can be requested to take for addressing the risk

- It may be appropriate to request addressing the risk as part of actions to resolve higher ranked risks, or as part of addressing other safety concerns due to the issue.

- Identify and implement Risk Control Measures such as restoring margins to bring the risk in the acceptable region as far as practicable. - Examples: refining safety analyses, improving operational procedures; reconfiguration of systems, R&D, design changes may also be considered if they are cost effective.

- Doing nothing to reduce the risk is not an option. - Where applicable, reducing the uncertainties should be part of the strategy to reduce risks, followed by a re-evaluation of the significance. - Examples: as for RSL2 plus reconfiguration of systems, R&D, design changes, interim change of operational parameters including power reduction.

- Any measure that will reduce the risk back to the lower regions. - Examples: as RSL3 plus reactor shutdown.

Time at risk considerations

- No specific limitation. - More time (than for RSL3) would be available for implementation of risk control measures. The timeframe should be agreed by both the Licensee and CNSC.

- Urgency of addressing the problems is increased as allowable time at risk in absence of interim measures is limited.

- Allowable time at risk is very low. Measures to reduce the risk have to be implemented immediately.

Weight of risk concerns in the decision to address the issue

- Risk is not a concern; other inputs (such as compliance with CNSC expectations, codes and standards) may have a dominant role in justifying the need for addressing the issue.

- It is expected that other inputs may have a greater weight in determining the actions to address the issue.- CBA arguments may become prevalent in selecting the measures to control the risk.

- The weight of the risk input becomes very significant (i.e. with respect to CBA) in the decision to select measures to address the issue.

- Decision on addressing the issue will be largely determined by the unacceptable risk... - Risk reduction should be undertaken independent of costs.

52

Table 8: Evaluation Criteria for Application to the Category 3 issues

Level 1 Evaluation Criteria Level 2 Evaluation Criteria#1 Severe Accidents Risks / /

#2 Radiological Risk to Public at DBA / /

#3 Risk of Negative Impact on Safety / /

#4 Practicality

#4.1 Likelihood of completion (Technically feasible?)

#4.2 Probability of success (Likelihood of obtaining meaningful result)

#4.3Timeframe for completion (Will the results be available in time to be used?)

#5 Impact on other Safety Areas /

#6 Benefit/Cost Considerations4 / /

9.9.2. RCMs for the LBLOCA issues

9.2.1. Identification of the Risk Control Measures (RCM)s for the LBLOCA issues

As described in section 7.1 there are 5 issues primarily related to Large Break Loss of Coolant Accident (LBLOCA): 1. Analysis for Void Reactivity Coefficient (AA 9) 2. Channel Voiding During Large LOCA (PF 12) 3. Fuel Behaviour in Power Pulse Transients (PF 10)4. Fuel Behaviour in High Temperature Transients (PF 9) 5. Analysis for Moderator Temperature Predictions (AA 8) and Availability of the Moderator as

a Heat sink (SS 8)

The Risk Significance Level (RSL)s for these issues are summarized in section 8.2 and in particular in Table 4. As can be seen from Table 4, for all safety areas and risk scenarios related to the issue AA 8 (Analysis for Moderator Temperature Predictions), the Risk Significance Level (RSL) is equal to one. This assessment reflects the fact that moderator temperature distribution experiments have been performed and that the MODTUR-CLAS code, which is used to predict such temperature distribution, has been validated (see Appendix A, issue AA 8). The main action 4 This evaluation criteria was originally subdivided in two secondary criteria: i) Benefit/Cost Ratio and ii) Net Present Value (NPV). However, during the performance of the assessments it was considered that there was not enough details to perform the assessment on these more specific criteria and therefore only a general „cost‟ criteria was used.

53

that remain to be completed to move this issue from a Category 3 to a Category 1 issue is the review by the CNSC staff of the reports from the industry on the moderator temperature distribution experiments and the MODTURC-CLAS validation (see Appendix E, issue AA 8). No further discussion of the various Risk Control Measures (RCM)s to address this issue is required.

For the other LBLOCA issues, the starting point for the identification and assessment of the potential Risk Control Measures (RCM)s is the work that has been completed by the LBLOCA Working Group and which is documented in [14], and more specifically Stages 1 and 2 of the evaluation described in Appendix 7 of that report.

The LBLOCA Working Group has developed a problem statement to characterize the LBLOCA issues and identified six (6) technical areas [14]:

• TA1: Related to Coolant Void Reactivity (CVR)

• TA2: Related to LBLOCA acceptance criteria

• TA3: Related to the use of Best Estimated and Uncertainty (BEAU) methods

• TA4: Related to break sizes and dynamics

• TA5: Related to design changes

• TA6: RIDM

The LBLOCA Working Group indicated that Technical Area #1 (TA1: related to Coolant Void Reactivity (CVR)) and Technical Area #2 (TA2: Related to LBLOCA acceptance criteria) contain essential elements to any overall solution, but would not of themselves be sufficient. Therefore the activities identified under TA1 and TA2 have to be performed whichever resolution strategy is selected.

Technical Area #1 relate to qualification of reactor physics predictions and uncertainty estimation of the reactivity feedback coefficients and kinetics parameters, with special focus on the Coolant Void Reactivity and related uncertainties. Technical Area #2 relate to the adequacy of the acceptance criteria for design basis Large Break Loss of Coolant Accident (LBLOCA), confidence in simulation models used in safety analysis including validation, and the relevant experimental basis for Large Break Loss of Coolant Accident (LBLOCA). More details on the activities included in TA1 and TA2 are provided in [15].

In Stage 1, four candidate resolution activities (CRA), having the potential to resolve the LBLOCA issue, have been identified:

• CRA-1: this Candidate Resolution Activities ( CRA) is based upon the application of Best Estimated and Uncertainty (BEAU) (LBLOCA TA3). The use of Best Estimated and Uncertainty (BEAU) as the basis for a Candidate Resolution Activity is aimed at addressing the CANDU Large Break Loss of Coolant Accident (LBLOCA) margin problem by demonstrating that the predicted consequences are significantly less severe

54

than computed by the current licensing analysis approach, i.e., the Limit of Operating Envelope (LOE) method, A Best Estimated and Uncertainty (BEAU)-based Candidate Resolution Activities ( CRA) serves to obtain a more realistic estimate of the margin between safety variables (e.g., peak fuel sheath temperature) and the corresponding safety limit agreed to by the Regulator or the failure point characterizing the onset of non-negligible damage.

• CRA-2: this Candidate Resolution Activities ( CRA) is based upon the reclassification of that portion of large LOCA break range whose frequency is estimated to be below the Design Basis Accidents (DBA) frequency range (i.e., less than 10-5/yr) to a BEYOND DESIGN BASIS ACCIDENT (BDBA) event (LBLOCA TA4). The approach to be adopted would be similar to the alternative rule to risk-inform 10 CFR 50.46 that is being developed in the USA. The United State Nuclear Regulatory Commission staff is currently developing a schedule to complete this rulemaking to redefine large LOCA. This approach divides theLoss of Coolant Accident (LOCA) break size spectrum into two regions delineated by the Transition Break Size (TBS).

- Pipe breaks less than the Transition Break Size (TBS) are analyzed by the methods, assumptions, and acceptance criteria currently used forLoss of Coolant Accident (LOCA). The approach evaluates the single-ended break sizes up to Transition Break Size (TBS) at the limiting Primary Heat Transport (PHT) pipe location(s).

- Pipe breaks greater than the Transition Break Size (TBS) (up to the double-ended guillotine break of the reactor headers) are considered as beyond design basis accidents consistent with RD-310. It is anticipated that these breaks can be analyzed using current licensing methods or by more realistic methods and with somewhat relaxed acceptance criteria. Deterministic analysis assuming coincident loss of offsite power and a single additional failure is not required. Mitigation capability for allLoss of Coolant Accident (LOCA)s (up to the double-ended guillotine break of the reactor headers) shall be maintained.

• CRA-3: this Candidate Resolution Activities ( CRA) is based upon the development and use of a more realistic break-opening model (LBLOCA TA4). The use of a more realistic break-opening model for the large LOCA scenario changes the severity of the challenge posed by the Post Irradiation Examination (PIE) in a fundamental way. In particular, use of a more realistic break-opening model for the large LOCA scenario changes the speed of the voiding transient. The large LOCA scenario is included as a Post Irradiation Examination (PIE) in the design basis of CANDU plants to demonstrate the capability of the safety systems to mitigate rapid and large voiding transients. Thus, the speed of the voiding transient associated with the large LOCA scenario is a fundamental characteristic of this Post Irradiation Examination (PIE) as a Design Basis Accidents (DBA). A move to change a fundamental characteristic of a Post Irradiation Examination (PIE) in the design basis must be supported with overwhelming evidence. Otherwise, it can give rise to the perception that we are changing or bending the established analysis rules or

55

practice for a well-established Design Basis Accidents (DBA) to accommodate a particular design weakness in a particular design.

• CRA-4: this Candidate Resolution Activities ( CRA) is based upon the implementation of low void reactivity fuel (LBLOCA TA5). The Low Void Reactivity Fuel (LVRF) bundles, utilizing slightly enriched uranium pellets in conjunction with a neutron absorbing material, would be sufficient by itself to address the concerns with the magnitude of the positive void reactivity coefficient and the resulting power pulse following a large LOCA.

These four Candidate Resolution Activities ( CRA) options have been reviewed by the LBLOCA Working Group in Stage 2 of its process. It was decided that the first three options listed above could be combined [14] and is referred to as the Composite Analytical Approach. The combination of these three options in a composite Candidate Resolution Activity is considered to provide analytical “defence-in-depth”, includes principles of the Limit of Operation Envelope (LOE) methodology in its strategy and involves a partial reclassification of the classical Large Break Loss of Coolant Accident (LBLOCA) event considered in existing CANDU design to the BEYOND DESIGN BASIS ACCIDENT (BDBA) category and, other analytical activities aimed at providing a more representative assessment of the consequences of this event, and confirmation that safety margins are adequate.. This approach is expected to confirm the level of confidence in the adequacy of existing design provisions and the supporting safety case. Defence-in-depth in this context implies the use of complementary methods of investigation to avoid reliance on a single argument or analytical approach. Since each method of investigation might itself be imperfect, the use of complementary methods of investigation provides a set of redundant technical barriers, each of which provides support against the limitations of the others. It was further noted that the Composite Analytical Approach does not preclude the possibility of introducing design changes where practicable.

56

The RIDM Issue Team (RIT) reviewed the Candidate Resolution Activities ( CRA)s proposed by the LBLOCA Working Group and concluded that it was appropriate to treat these as Risk Control Measures (RCM)s and there was no need, in the context of the assessment of generic Risk Control Measures (RCM)s, to try to identify additional Risk Control Measures (RCM). This conclusion takes into account the effort that was spent by the LBLOCA Working Group to identify acceptable control measures and the fact that the LBLOCA Working Group has already evaluated the merits of the proposed control measures relative to some of the evaluation criteria that are presented in Table 8.

In conclusion, the Composite Analytical Approach option and the Low Void Reactivity Fuel option are considered the two options appropriate for assessment by the RIDM Issue Team (RIT). In the following LBLOCA issues sub-sections, the Composite Analytical approach will be referred to RCM-1, with CRA-1, -2 and -3 being referred to as RCM-1.1, RCM-1.2 and RCM-1.3, and the Low Void Reactivity Fuel option will be referred to RCM-2, which is equivalent to CRA-4.

It is important to note that the activities identified under TA1 and TA2 will have to be performed whichever resolution strategy is selected.

9.2.2 Assessment of the RCMs for the LBLOCA issues

Each of the candidate resolution activities was assessed by the LBLOCA Working Group relative to their impacts on the LBLOCA-related Category 3 CANDU Safety Issues. The LBLOCA team evaluated the ability of CRA-1, CRA-2, CRA-3 and CRA-4 to address the risk posed by the LBLOCA-related Category 3 CANDU Safety Issues. The LBLOCA team did not specifically rank the Composite Analytical Approach (CRA-1, CRA-2 and CRA-3, which collectively is referred to as RCM-1).

The results of the ranking performed by the LBLOCA team are summarized in Table 9. The information in Table 9 is based on Tables A1-5, A2-7, A2-8 and A3-6 of the Appendix 7 of the LOCA report 9.3. Table 9 shows that the Best Estimated and Uncertainty (BEAU) approach and the Break Opening Time approach have high impacts in term of their ability to address the LBLOCA-related CANDU Safety Issues. In particular, the ranking of CRA-1 and CRA-3 is the same as to the ranking obtained for the Low Void Reactivity Fuel option (CRA-4).

Since most of the various components of RCM-1 are ranked as “high” (a “3”) in terms of reducing the risk posed by the LBLOCA-related issues, it is considered that overall the Composite Analytical approach would also be ranked as a “3” (or high) in terms of its ability to address the LBLOCA-related issues.

The LBLOCA Working Group also assessed the merits of the various candidate risk activities against the evaluation criteria 4.1 (likelihood of completion), 4.2 (probability of success), 4.3 (timeframe for completion) and 6 (cost) that are presented in Table 8. The results for the RCM-1

57

and RCM-2 for these evaluation criteria are presented in Table 10. This information was taken from Appendix 7 of the LOCA Report 9.3.

As can be seen from Table 9 and Table 10 and as concluded by the LBLOCA Working Group, based on the selected evaluation criteria, it is considered that the two risk control measures, namely the Composite Analytical approach (RCM-1) and the LVRF option (RCM-2), are comparable in addressing the LBLOCA-related CANDU Safety Issues.

With the aim of providing to the decision makers additional information on the determination of a preferred resolution strategy for the LBLOCA issue, and consistent with its mandate, the Risk Informed Decision Making (RIDM) Issues Team performed an additional assessment of the two selected Risk Control Measures (RCM)s discussed above. The overall approach followed by the RIDM team to assess the two proposed Risk Control Measures (RCM)s was described in Section 1.20. The Expert Elicitation Process (EEP) assessment of the Large Break Loss of Coolant Accident (LBLOCA) proposed Risk Control Measures (RCM)s and its results are summarized below. More details on the process that was followed and the results from the Expert Elicitation Process (EEP) assessment are presented in 9.3.

An expert panel was selected to perform the Expert Elicitation Process (EEP) assessment of the proposed Large Break Loss of Coolant Accident (LBLOCA) proposed RCMs. The panel was composed of 4 CNSC staff and 4 Industry representatives. The panel members were all familiar with the work of the LBLOCA Working Group, and in fact many of the RIDM LBLOCA assessment panel experts were also part of the LBLOCA Working Group.

The evaluation criteria that were used by the panel were based on the criteria presented in Table8. However, the panel considered that there was not enough information to assess separately the ‘Benefit/Cost Ratio’ and the ‘Net present value’ for each option, and therefore these two criteria were combined into a single criterion referred to as ‘Cost consideration’.

The Expert Elicitation Process (EEP) assessment of the two proposed LBLOCA Risk Control Measures (RCM) was repeated for the four LBLOCA issues discussed in section 1.3. The results from the Expert Elicitation Process (EEP) assessment are discussed in detail in 9.3. The assessment shows that:

• For Negative Impact on Safety, which is the safety area where the risk significance level for a number of LBLOCA Category 3 issues was the highest, being in the unacceptable region (RSL= 3), both Risk Control Measures (RCM) provide some risk reduction. However, the LVRF approach is better in addressing the risks, in particular for AA9 (Positive void reactivity).

• The Composite Analytical approach (RCM-1) has essentially no impact on the Severe Accident Risk and the Radiological Risk to Public at Design Basis Accidents (DBA).

• The LVRF approach (RCM-2) slightly reduces the Severe Accident Risk and the Radiological Risk to Public at Design Basis Accidents (DBA).

• Both Risk Control Measures (RCM) have similar impact on Other Safety Areas

58

• The likelihood of completion and the probability of success of the Composite Analytical approach is considered to be medium

• The likelihood of completion and the probability of success of the LVRF approach is considered to be medium / high.

• Both Risk Control Measures (RCM) will require a relatively long time to implement

• The cost for implementing the Low Void Reactivity Fuel is higher than that for implementing the Composite Analytical approach.

The Composite Analytical approach does not affect the Severe Accident Risk and Radiological Risk to Public at Design Basis Accidents (DBA) safety areas as this approach does not modify the physical behavior of the plant. It is nevertheless to be pointed out that the Composite analytical approach is likely to reduce the estimated consequences of Large Break Loss of Coolant Accident (LBLOCA) by providing more realistic modeling of the event.

The LVRF approach on the other hand will reduce the power pulse for the various considered risk scenarios and therefore provides some improvements relative to these safety areas. The fact that these improvements are minor is considered to be a consequence that the Risk Significance Levels for these safety areas are RSL 2, as indicated in Table 4 the Risk Significance Level (RSL)s for the Safety Issues related to Large Break Loss of Coolant Accident (LBLOCA) for the Severe Accident Risk and Radiological Risk to Public at Design Basis Accidents (DBA).

The results of the survey were also compared to the assessments of the LBLOCA team 9.3, which are summarized in Table 10. The results related to the assessment criteria on Timeframe for Completion and Cost are comparable. However the results related to the Likelihood of Completion and the Probability of Success appear to be different.

There is, in fact, a range of opinions regarding the Likelihood of completion and Probability of success of the Composite Analytical approach. In particular there are concerns regarding the capability to complete the experimental program required to support this approach; in particular there have been some concerns expressed regarding the completion of the experimental program to support the proposed change to the Large Break Loss of Coolant Accident (LBLOCA) break opening time model. Providing the experimental data to support reclassification of some LBLOCA events is also considered to be challenging (see Appendix 4 of reference 9.3).

9.2.3 Conclusions from the Assessment of the Risk Control Measures (RCM) for the LBLOCA issues

In conclusion, taking into account that:

• for some scenarios for the LBLOCA-related Category 3 Safety Issues the Risk Significance Levels related to the Safety on Negative Impact on Safety are in the unacceptable region (RSLs = 3, see Figure 4);

59

• both Risk Control Measures (RCM) are considered to be capable of reducing the Risk of Negative Impact on Safety;

• the Risk Significance Levels related to the Safety areas on Severe Accident Risk and Radiological Risk at Design Basis Accidents (DBA) are in the tolerable region (RSLs = 2; see );

• both Risk Control Measures (RCM) have comparable impacts safety areas on Severe Accident Risk and Radiological Risk at Design Basis Accidents (DBA);

• the costs of implementation of the LVRF option is higher than the cost of the Composite Analytical approach; and

• both Risk Control Measures (RCM) are comparable in addressing the LBLOCA-related CANDU Safety Issues.



A program defining the detailed scope, tasks, success criteria for the elements of the Composite Analytical approach, and schedule will need to be prepared for development and implementation of the Composite Analytical approach. A Terms of Reference, with clear accountabilities for the CNSC and the Industry participants, will need to be developed as well.


• demonstrate that the level of confidence in the successful outcome of the Composite Analytical approach increases with time and




60

or

2. Implement Low Void Reactivity Fuel (RCM-2).


Work also needs to performed in two areas that are essential elements of any overall solution,. These areas are:


• Technical Area #2 (TA2): This technical area relates to the adequacy of the acceptance criteria for design basis Large Break Loss of Coolant Accident (LBLOCA), confidence in simulation models used in safety analysis including validation, and the relevant experimental basis for Large Break Loss of Coolant Accident (LBLOCA).

61

Table 9: Summary assessment of the LBLOCA Candidate Resolution Activities ( CRA)s against the Category 3 LBLOCA related Safety Issues

62

RIDM Issue

Description Candidate Resolution Activities ( CRA)5

Impact Impact Rating6

PF12

GAI-00G01 Channel voiding during large LOCA

Best Estimated and Uncertainty (BEAU)

The issue will necessarily be addressed as part of the scope of the Best Estimated and Uncertainty (BEAU) application itself (i.e. to address code applicability and code accuracy).

3

Reclassification Significant voiding accidents in BEYOND DESIGN BASIS ACCIDENT (BDBA) space.

2

Break Opening Time (BOT)

Significantly reduce amount of coolant voiding for all Loss of Coolant Accident (LOCA) scenarios.

3

LVRF The work scope can be reduced since the neutronic response is less sensitive to coolant voiding following large .

3

AA 09 Analysis for void reactivity


The issue will necessarily be addressed as part of the scope of the Best Estimated and Uncertainty (BEAU) application itself.

3

Reclassification Significant voiding accidents in BEYOND DESIGN BASIS ACCIDENT (BDBA) space.

2


Significantly reduce amount of coolant voiding for all LOCA scenarios.

3

LVRF LVRF directly addresses this Safety Issue. 3

PF 10 Fuel Behaviour in power pulse


The work scope can be reduced or eliminated due to the lower magnitude of the associated power pulse expected in Best Estimated and Uncertainty (BEAU) analysis results.

3

Reclassification Use of more realistic assumptions will reduce power pulse for large LOCA.

2


Reduced coolant voiding would reduce power pulse.

3

LVRF LVRF directly addresses this Safety Issue. 3

PF 09

Fuel Behaviour in high temperature transients


The work scope can be reduced or eliminated due to the lower temperature expected in Best Estimated and Uncertainty (BEAU) analysis results.

3

Reclassification Use of more realistic assumptions will reduce lower fuel temperatures for large LOCA.

2


Reduced coolant voiding would reduce peak fuel/sheath temperatures.

3

LVRF The work scope can be reduced (or eliminated all together) due to the lower magnitude of the associated power pulse.

3

5 BEAU = CRA-1; Reclassification = CRA-2; BOT = CRA-3; LFRF = CRA-4. In addition RCM-1 is composed of CRA-1, CRA-2 and CRA-3. RCM-2 corresponds to CRA-4.6 1 = little or no impact; 2 = medium or partial impact; 3 = high or significant impact

63

Table 10: Summary Assessment of the LBLOCA Candidate Resolution Activities ( CRA)s against Selected Evaluation Criteria

Criterion RCM Ranking Comment

Likelihood of successful outcome

RCM-1 medium/high

This is judged to be medium/high based on the recent positive response by both the Industry and the CNSC that LBLOCA reclassification is an acceptable and supportable way to proceed. The reclassification would be based on initiating event frequency and is consistent with modern International Atomic Energy Agency (IAEA) and Canadian regulations.

There has also been significantly progress in United State Nuclear Regulatory Commission rulemaking recently related to the advancement of risk informed revisions to 10CFR50.46. The revision (referred to as 10CFR50.46(a)), which is scheduled for publication in 2010, would require applicants to demonstrate that the applicable transition break size is applicable to their plants.

RCM-2 highThe likelihood of successful outcome is assessed as high, taking into account the Bruce Power activities in support of full core implementation of the Low Void Reactivity Fuel bundles.

Probability of success

RCM-1 medium From a regulatory perspective, the ranking is low, possibly medium. The lack of international precedence in the use of more realistic break-opening models in large LOCA analysis is perceived as a potential problem. The use of a more realistic break-opening model for the large LOCA scenario is different from the Best Estimated and Uncertainty (BEAU) initiative in that it changes the severity of the challenge posed by the Post Irradiation Examination (PIE) in a fundamental way. In particular, use of a more realistic break-opening model for the large LOCA scenario changes the speed of the voiding transient. The large LOCA scenario is included as a Post Irradiation Examination (PIE) in the design basis of CANDU plants to demonstrate the capability of the safety systems to mitigate rapid and large voiding transients. Thus, the speed of the voiding transient associated with the large LOCA scenario is a fundamental characteristic of this Post Irradiation Examination (PIE) as a Design Basis Accidents (DBA). A move to change a fundamental characteristic of a Post Irradiation Examination (PIE) in the design basis must be supported with overwhelming evidence. Otherwise, it can give rise to the perception that we are changing or bending the established analysis rules or practice for a well-established Design Basis Accidents (DBA) to accommodate a particular design weakness in a particular design. LBLOCA reclassification, and in particular the break-opening model, will need to be qualified based on adequate experimental data.

From a utility perspective, the ranking is high, possibly medium considering the uncertainty. The Industry’s preliminary studies into the use of more realistic break-opening models with Limit of Operation Envelope (LOE) analyses have demonstrated a significant restoration of margins for both the 100% RIH break and the critical (45%) RIH break, which are the limiting large LOCA scenarios

64

Criterion RCM Ranking Commentwith respect to margins to the derived acceptance criteria. The high confidence comes from the quality and abundance of the supporting pipe fracture data as well as conservatisms employed in establishing the break-opening model assumed. The lack of precedence for the use of more realistic break-opening models is attributable to differences in drivers/benefits in other jurisdictions and not to an inability to develop and apply a more realistic break-opening model. The use of more realistic break-opening models would likely have no significant benefit for large LOCA analysis in light water reactors to demonstrate effectiveness of special safety systems; the United State Nuclear Regulatory Commission has developed leak-before-break, best-estimate analysis methods, and alternative Emergency Core Cooling System (ECCS) evaluation requirements that allow the Licensees’ to resolve outstanding licensing issues for light water reactors associated with large LOCA events.

RCM-2 highThe likelihood of success is assessed as high, taking into account the current Bruce Power activities in support of full core implementation of the Low Void Reactivity Fuel bundles.

Timeframe for completion

RCM-1 medium/long

A considerable amount of analytical and R&D activity (including experimental work) will be required to support LBLOCA reclassification and this will take time. However, a significant amount of work has already been completed (e.g., all Licensees have complete Limit of Operation Envelope (LOE) analyses; Best Estimated and Uncertainty (BEAU) analyses have been or are being undertaken by several Licensees). Also, because the composite approach involves several re-enforcing methods rather than a single stand alone barrier, a lower level of analytical rigor is likely acceptable for each of the various methods used.

The United State Nuclear Regulatory Commission is the only regulatory body currently considering reclassifying the large LOCA event. It has taken the USA Nuclear Industry and the United State Nuclear Regulatory Commission about nine years (1999 to 2008) working together to risk-inform 10 CFR 50.46. This process is still not complete.

With the use of a more realistic break-opening model for large-breaks in Primary Heat Transport (PHT) piping it may be possible to re-establish large LOCA margins within the current licensing framework. However, the break-opening model will need to be qualified based on adequate experimental data.

RCM-2 longTime frame is assessed as long taking into account the experience with Bruce Power's effort in support of full core implementation of the LVRF bundles.

Cost RCM-1 medium/high

Although this approach involves a combination of the other candidate resolution activities, the total cost will be considerably less that the sum of the individual methods since not all aspects of the individual solution methods will be required. (As discussed above, a lower degree of rigor may be acceptable for individual methods combined in

65

Criterion RCM Ranking Commenta reinforcing manner and applied to Beyond Design Basis Accident (BDBA)s). This will significantly reduce the overall cost, making it medium/high.

RCM-2 very high

Cost is assessed as very high by only considering the high cost of manufacturing bundles containing enriched uranium. However, the net cost may not be as high given the potential for increase in burn up, reactor power, maximum channel and bundle power and reduced operational restriction such as large LOCA related power holds and improved Neutron Overpower Protection (NOP)margins. The net cost has not been assessed.

9.3. Risk Control Measures (RCM) for the non LBLOCA issues

The Risk Control Measures (RCM) for the non-LBLOCA Category 3 issues listed in Table 6 are described in 9.3. The process that was used to identify these Risk Control Measures (RCM) is described in section 1.20. It involved discussions between the CNSC staff and the Industry. These discussions have resulted in the agreement on, and development of high-level plans to address the remaining Category 3 issues. Table 11 provides a summary description of all the Risk Control Measures (RCM) for the current Category 3 issues.

Table 11: Summary of Risk Control Measures

Issue Risk Control MeasuresAA 3 Computer code and plant model validation

Update Technical Basis Document and Validation Matrices. Develop code accuracy and uncertainty analyses methodologies. Target date: December 31, 2009. In addition, a specific milestone to close this issue will be established to summarize the work on Safety Analysis Improvement. A Safety Analysis Improvement Project Plan is to be completed by December 31, 2009.

To address the issue in the short and medium term (i.e., until gaps are filled), additional measures should continue to be taken in the safety analysis performed in the meantime to account for any shortcomings that have been identified. Moreover, code validation is a continuous process and the Industry will continue code validation work and keep on-going discussions with the CNSC.


CI 1 Fuel channel integrity and effect on core internals

Document and implement an Integrated Fuel Channel Ageing Management Plan (FC AMP): Improve pressure tube ageing management program to ensure that the consequences of ageing on fuel channel integrity are adequately managed, and that the appropriate information is collected to support the safety analysis assumptions related to pre-accident pressure tubes characteristics. Target date: December 31, 2011

Successful completion of the proposed RCM is expected to result in fuel channel ageing management programs that ensure that the consequences of ageing on fuel channel integrity are adequately managed, and that the

66

Issue Risk Control Measuresappropriate information to continue to confirm safety analysis assumptions is collected.


Document and implement an Integrated Ageing Management Plan (AMP): Improve ageing management programs to ensure that the consequences of ageing on Systems Important to Safety are adequately managed, and that the appropriate information is collected to support safety analysis assumptions. Target date: December 31, 2011.

Complete condition assessment in the context of plant life extension projects.

Successful completion of the proposed RCM is expected to result in Integrated Ageing Management Programs that ensures that System Structure Component (SSC) ageing is understood and managed effectively, and that ageing effects of System Structure Component (SSC) are detected (through inspection, testing or surveillance programs) and corrective actions taken (operating limits, operation, maintenance, repair, replacement) before loss of System Structure Component (SSC) integrity or functional capability occurs. In addition, the program should ensure that the appropriate information is collected to support the safety analysis.


Complete a systematic assessment of high energy line break effects. Completion of the proposed RCM requires a systematic review of the dynamic and environmental effects of high energy piping breaks inside the containment and the consequences on plant safety, an assessment of the consequential damage associated with the postulated failure and identification of potential design improvements. Target date: Station specific – linked with Life Extension Project.


The closure document (COG-08-2054) summarizing the entire Molten Fuel/Moderator Interaction (MFMI) program conducted at Argonne National Laboratories and at AECL’s Chalk River Laboratories has been completed and submitted to the CNSC. Based, on information submitted to date, CNSC expects closure of this issue by December 2009.

Successful completion of the proposed RCM involves the acceptance by the CNSC that the consequences of molten fuel/moderator interaction are manageable.


As part of this work, the Licensees will produce:

• Experimental evidence to clarify the conditions for fuel deformation and for fuel sheath failure (i.e. dryout, fuel temperature, timing of failure), and for consequential failure of fuel channels.

• Establish firm acceptance criteria for Special Shutdown System (SDS) and Reactor Regulating System (RRS) trips to ensure their effectiveness.

This work is carried out through various Canadian Owner Group ( COG) work packages. Details are provided in Appendix E. The target date to complete the program is March 2013.

Successful completion of the proposed RCM is expected to result in an improved knowledge for post-dryout fuel, fuel bundle and pressure tube

67

Issue Risk Control Measuresbehaviour, in support of the current safety case.

PF 19 Impact of ageing on safe plant operation

Document and implement an Integrated Ageing Management Program (AMP) that ensures that plant ageing mechanisms are identified in all safe operating limits, and collects information appropriate to confirm safety analysis assumptions. Target date: December 31, 2011.

Successful implementation of the proposed RCM is expected to result in Integrated Ageing Management Programs that ensures that plant ageing mechanisms are identified, their impacts determined and addressed in an integrated manner, and are adequately accounted for in the shutdown system trip parameter setpoint adjustments, and other safe operating limits.

PF 20 Analysis methodology for NOP / ROP

The Industry NOP/ROP Working Group on new NOP/ROP methodology should continue to perform the activities that were identified in the Working Group Terms of Reference: WP23009 NOP Trip Effectiveness Methodology, and includes follow-up on the recommendation from the Independent Technical Panel's assessment of the proposed new NOP methodology. Bruce Power and OPG7 will provide a program plan to address these comments by August 31, 2009.

Successful completion of the proposed RCM is expected to result in improved confidence in preventing fuel dryout following a slow loss of regulation.

PSA 3 Open design of the balance of plant - steam protection

Perform a review of the PSA assumptions to determine if more realistic assumptions related to the assessment of the consequences of secondary side breaks, could be made. The possibility of improving the protection against steam/feedwater line breaks outside containment should be examined. This issue is only applicable to multi-unit stations; moreover it has already been addressed by Bruce Power stations. The target date to complete the review of the PSA models is December 31, 2010.

Successful implementation of the proposed RCM is expected to result in plant design models that better reflect plant design features currently present to protect against steam and feedwater line breaks outside containment. The RCM could also result in the identification of potential design changes that improve the protection against steam and feedwater line breaks outside containment.

SS 5 Hydrogen control measures during accidents

Install Passive Autocatalytic Recombiners (PARs) to improve hydrogen control during design basis accidents and assess the need for additional Passive Autocatalytic Recombiners (PARs)s to control hydrogen during beyond design basis accidents.

GAI 88 G02 was closed in 2009, however station specific action item have been opened. The target dates to complete the installation of the PARs are station specific and generally linked to Life Extension Projects.

Successful implementation of the proposed RCM is expected to result in identification of provision to mitigate the impact of hydrogen production during Design Basis Accidents (DBA)s.

7 Up to now, the CANDU 6’s have not modified there NOP/ROP methodology, even though they participate to this COG program.

68

Issue Risk Control MeasuresAA 8 Analysis for moderator temperature predictions &


Licensees addressed the GAI 95G05 “Moderator Temperature Predictions” closure criteria. The CNSC is planning to close this generic action item for the various Licensees in 2009. However, station-specific action items related to this issue will be raised.

Successful implementation of the proposed RCM is expected to result in improved confidence in moderator temperature predictions.

AA 9 Analysis for void reactivity coefficient &

PF 9 Fuel behaviour in high temperature transients &

PF 10 Fuel behaviour in power pulse transients &

PF 12 GAI 00G01 Channel voiding during a Large LOCA

Based on the results of the assessment of these RCMs by the RIDM Working Group, it was concluded that the Licensees need to determine which option they will pursue to address the LBLOCA-related CANDU Safety Issues for their facilities. A complete justification of the selected option, including the technical rationale, implementation timeline, and development and implementation costs needs to be provided. More precisely, the Licensees need to decide whether they will:

1. Implement the Composite Analytical approach (RCM-1). or2. Implement LVRF (RCM-2).

As a milestone an overall plan including information about cost, deliverables, milestones, resources (people and experts), schedule and the acceptance criteria for Composite Analytical Approach (RCM-1) should be developed before March 31, 2010. A high level schedule should also be prepared for LVRF (RCM-2) by March 31, 2010.

10. MONITORING THE IMPACT OF THE RCM

The last step of the RIDM process (see ) is related the monitoring of the implementation of the RCM at the different power plant station.

As indicated in 9.3, it is important to agree on how the effectiveness of the decision is going to be monitored over time (who does what and when). Monitoring provides an opportunity to identify new risks, or to assess the impact of changes in known risks. Documenting the impact of the actions taken will provide confirmation of the appropriateness of the decision(s) taken. Specifically, the purpose of monitoring the impact is to establish:

- whether the actions taken to ensure that the risks are adequately controlled resulted in what was intended,

- whether decisions previously reached need to be modified and, if so, how; for example, because of levels of protection that were considered at the time to be “good practice” may no longer be regarded as such as a result of new knowledge, advances in technology, or changes in the level of societal concern,

- how appropriate was the information gathered in the early stages of the Process, and what lessons could be learnt for future regulatory decisions (feedback).

69

The monitoring process for the implementation of the Risk Control Measures (RCM) discusses in this document will be included in the existing communication processes between the CNSC and the Industry.

11. CONCLUSION

This document describes the approach taken by staff of the CNSC and the Industry to assess the current status of outstanding design and analysis Safety Issues for Canadian CANDU reactors and to develop in a risk informed manner the path forward to address concerns on nuclear safety in relation to life extension projects and operating reactors.

The starting point for this work is the previous assessment that the CNSC staff has performed for these Safety Issues and which is documented in 9.3. The initial list of issues was developed using the IAEA TECDOC-1554 “Generic Safety Issues for Nuclear Power Plants with Pressurized Heavy Water Reactors and Measures for their Resolution” 9.3. Additional issues were identified through regulatory oversight of currently operating reactors, results of life extension assessments and Safety Issues identified in pre-licensing reviews of new CANDU designs. These Safety Issues were distributed into three broad categories according to the adequacy and effectiveness of the control measures implemented by the Licensees to maintain safety margins.

A total number of 73 Safety Issues pertaining to plant design and analysis were identified. Subsequently, the RIDM process was applied to the potentially risk-significant issues (Category 3) to identify, estimate and evaluate the risks associated with each of the Safety Issues, and to recommend measures to control these risks.

The application of the RIDM process by a joint CNSC/Industry Working Group has allowed getting a consensus on:

• The definition of the generic Safety Issues applicable to the nuclear power plants currently operating in Canada (see 9.3);

• The Risk Significance Levels of the issues relative to the various safety areas (see 9.3);

• The Risk Control Measures that are appropriate to address the issues, including high-level plans to implement these measures (see 9.3).

The feedback from this exercise has also been used to update the CNSC RIDM process (see reference 9.3).

In going through the process, based on updated information, four issues that were previously identified as Category 3, have been re-categorized as Category 1 or 2 issues:

• AA 7 Analysis for pressure tube failure with consequential loss of moderator 1

• CI 2 Deterioration of core internals 2

• GL 4 Inadequacy of reliability data 2

70

• SS 1 Emergency Core Cooling System (ECCS) sump screen adequacy1

After this revision of the categorization and the transfer of one issue from the LBLOCA group to the non-LBLOCA group (AA 3 Computer Code and Plant Model Validation ), the number of non-LBLOCA was reduced from twelve (12) to ten (10) and the number of LBLOCA issues was reduced from eight (8) to five (5) large LOCA issues.

When considering the safety areas related to public risks, namely Severe Accident Risks and Radiological Dose to Public at Design Basis Accidents (DBA), all the Risk Significance Levels for the various risk scenarios are all within the tolerable region (RSL equal to 1 or 2). Risk Significance Levels for “negative Impacts on Safety’ for some risk scenarios are in the unacceptable region (RSL 3). As described in reference 9.3 and illustrated by the safety matrices related to this safety areas that are presented in 9.3, the Risk of Negative Impact on Safety is intended to measure:

(i) Degradation/impairment of defence-in-depth, safety functions or safety systems,

(ii) Difficulties of assessing plant conditions when compliance verification is impossible.

As a consequence, the Risk Control Measures to reduce the risks in the ‘Negative Impacts on Safety’ safety areas are generally aimed at improving the understanding of the Safety Issue, and to address margins, and uncertainties associated with the Safety Issue. More specifically, the results of application of the Risk Informed Decision Making (RIDM) process indicate that most of the outstanding Safety Issues can be addressed by further work in the following areas:

• Validation of data, models and codes used in accident analyses (AA 3; AA 8; IH 6; PF 15; PF 20; PSA 3; SS 5; SS 8; LBLOCA issues: AA 9, PF 12, PF 9, PF 10);

• Acquisition of additional experimental data on fuel behavior under accident conditions (PF 18; LBLOCA issues: PF 9, PF 10);

• Management of ageing of System Structure Component (SSC) and assessment of the impact of ageing on plant response to accidents (CI 1, GL 3; PF 19);

• Implementation of design improvements where relevant (IH 6; PSA 3; SS 5; LBLOCA issues: AA 9, PF 12, PF 9, PF 10).

These results are used as the basis for developing high-level plans for addressing the various Category 3 issues. These high-level plans for the non-LBLOCA issues are presented in 9.3. For these issues only one RCM has been identified for each issue and there is a consensus between the CNSC staff and the Industry on the plans to implement these Risk Control Measures (RCM).

For the LBLOCA issues, AA 9 (Analysis for Void Reactivity Coefficient), PF 12 (Channel Voiding During Large LOCA), PF 9 (Fuel Behaviour in High Temperature Transients), PF 10 (Fuel Behaviour in Power Pulse Transients) two Risk Control Measures (RCM) have been identified:

• The Composite Analytical approach option (RCM-1) and

71

• The Low Void Reactivity Fuel (LVRF) option (RCM-2).

The Composite Analytical approach involves a partial reclassification of the classical Large Break Loss of Coolant Accident (LBLOCA) event considered in existing CANDU design to the BEYOND DESIGN BASIS ACCIDENT (BDBA) category and other analytical activities aimed at providing a more representative assessment of the consequences of this event, and confirmation that safety margins are adequate. This approach is expected to confirm the level of confidence in the adequacy of existing design provisions and the supporting safety case.

LVRF involves the implementation of fuel design changes to reduce the positive coolant void reactivity, and as such alleviates the root cause of the problem and therefore enhances the robustness of the Loss of Coolant Accident (LOCA) safety case.

Assessments of the merits of the Composite Analytical approach (RCM-1) and the LVRF option (RCM-2), based on the selected evaluation criteria, indicate that both Risk Control Measures (RCM) are comparable in addressing the Large Break Loss of Coolant Accident (LBLOCA)-related CANDU Safety Issues.





• demonstrate that the level of confidence in the successful outcome of the Composite Analytical approach increases with time and,



72


or



Work also needs to performed in two areas that are essential elements of any overall solution. These areas are:



Finally, the report provides dates for implementing the various Risk Control Measures that are proposed. These schedules and the monitoring process to verify the progress of the implementation of the Risk Control Measures (RCM) have to be agreed between the CNSC Executives and the CNUEF.

12. REFERENCES

[1] “Development of Risk-Informed Regulatory Positions for CANDU Safety Issues: Risk Significance of Category 3 Safety Issues”, Assessment report prepared by CNSC staff, RTD 07-69, September 21, 2007

[2] Letter from T. Viglasky to M. Désilets, “Risk Informed Regulatory Position on CANDU Safety Issues” September 21, 2007.

[3] “Development of Risk-Informed Regulatory Positions on CANDU Safety Issues: Risk Significance of Category 3 Safety Issues”, Assessment report prepared by CNSC Staff, RTD 07-64

[4] Terms Of Reference for the CNSC/Industry RIDM Working Group, approved by M. O’Neil and Greg Rzentkowski June 2008.

[5] “Risk-Informing CNSC Planning, Licensing and Compliance Activities”, Detailed Guidance Document, Revision 6, December, 2008.

73

[6] “Generic Safety Issues for Nuclear Power Plants with Pressurized Heavy Water Reactors and Measures for their Resolution”, IAEA TECDOC - 1554, June 2007.

[7] “Generic Safety Issues for Nuclear Power Plants with Light Water Reactors and Measures Taken for their Resolution”, IAEA TECDOC Series No. 1044, 1998.

[8] “Ranking of Safety Issues for WWER-440 Model 230 Nuclear Power Plants, Report of the IAEA Extra Budgetary Program on the Safety of WWER-440 Model 230 Nuclear Power Plants”, IAEA TECDOC Series No. 640, February 1992.

[9] “Risk Management - Guidelines for Decision Makers”, A National Standard of Canada CAN/CSA Q-850-97.

[10] “Risk-Informed Approach for the CNSC Power Reactor Regulatory Program - Basis Document with Examples of Actual and Potential Applications”; Revision 6; E-doc 3264949-1, prepared by the Power Reactor Regulation Program Working Group on Risk-Informed Approach in Power Reactor Regulation, revision 6 by A. Bujor, R. Gheorghe, D. Miller, G. Ishack, 6 December 2008.

[11] Saaty, T. L., (1980), The Analytic Hierarchy Process, McGraw-Hill Co.

[12] US Nuclear Regulatory Commission, (2003), Formal Methods of Decision Analysis Applied to Prioritization of Research and Other Topics – NUREG/CR-6833, Washington, DC 20555-0001.

[13] US Nuclear Regulatory Commission, (2003), Estimating Loss-of-Coolant Accident (LOCA) Frequencies Through the Elicitation Process Main Report – SR-1829, Washington, DC 20555-0001.

[14] Komljenovic, D., Chan, E., Ganguli, S., Wu, J., and Parmar, R., (2008), An Analysis to Determine Industry’s Preferred Option for an Initial Generic Reliability Database for CANDU, 29th Annual Conference of the Canadian Nuclear Society, Toronto.

[15] COG-JP-4290-V02, LBLOCA report.

[16] “Application of the RIDM process and tools for risk estimation and evaluation of CANDU Safety Issues”, BITS 1083121, A.Bujor, February 8, 2007.

[17] COG, Minutes of Workshop – COG Joint Project JP-SD-4290, ‘RIDM Pilot Project – Industry Workshop; Fuel Behaviour under Post-Dryout Conditions’, June 18 and 19, 2008.

13. GLOSSARY

Acceptance criteria (RD-360)Pre-established specific and clear statements or data package expressing the requirements and expectations found in legislative, regulatory, codes, or governing documents that must be

74

demonstrated to have been met before accepting a product, deliverable, application or submission.

Accident/Accident Condition (RD-337)An abnormal situation that may increase the risk of harm to the health and safety of persons or the environment.

Beyond Design Basis Accident (BDBA) (RD-337)An accident less frequent and more severe than a Design Basis Accident (DBA).

Closure Issues (LBLOCA Report)Collectively represent the minimum set of issues and concerns that would need to be resolved in order to obtain closure of the Technical Area.

Common cause (RD-310)A cause for a concurrent failure of two or more structures, systems or components, such as natural phenomena (earthquakes, tornadoes, floods, etc.), design deficiency, manufacturing flaws, operation and maintenance errors, human-induced destructive events and others.

Consequences (G-144)Within the nuclear industry, “consequences” suggests undesirable results or outcomes; e.g., the release of the radioactive fission products into the reactor building and/or escape of the radioactive products to the environment.

Design basis (RD-360)The range of conditions and events taken into account in the design of structures, systems and components of a facility, according to established criteria, such that the facility can withstand them without exceeding authorized limits for the planned operation of safety systems. The design basis includes the design description, design manuals, design drawings and the safety analysis report.

Design Basis Accident (DBA) (RD-310) Accident conditions against which a nuclear power plant is designed according to established design criteria, and for which the damage to the fuel and the release of radioactive material are kept within authorized limits.

Event (International Atomic Energy Agency (IAEA) Glossary) In the context of the reporting and analysis of events, an event is any occurrence unintended by the operator, including operating error, equipment failure or other mishap, and deliberate action on the part of others, the consequences or potential consequences of which are not negligible from the point of view of protection or safety.

Event category (RD-310)A group of events characterized by the same, or similar, cause and similarity in the governing phenomena.

75

Fuel deformation (G-144)Change in the geometry of the fuel bundle brought about by deformation of one or more elements in the bundle or deformation of the bundle as a whole.

Initiating event (S-99)(a) an event that initiates a sequence of events that could lead to a severe accident in the absence of action by a risk-significant system; or(b) an event involving a risk-significant system, that initiates a sequence of events that could have lead to a severe accident if other risk-significant systems had not acted.

Large Loss of Coolant Accidents (LLOCA) (G-144)This is part of a category of accident analyses that deals with reactor safety due to a loss of coolant from the primary heat transport system. A large loss of coolant accident results from a large size break in the primary heat transport system.

Limit of Operating Envelope (LOE) (G-144)This term is used for a deterministic safety analysis that assumes, prior to the postulated accident, that the plant was operating with some of the important plant operating parameters being at their safety limits, while some of the models used to describe the event may be conservative. The qualifier “deterministic” that is used as a prefix to the word analysis, means that the analysis is done using prescribed and what is perceived to be conservative assumptions to account for uncertainties in the models, codes, correlations, and initial and boundary conditions of the plant.

LOE does not necessarily mean an impossible plant operating state. However, depending on the number and nature of the conservative assumptions made in the analysis of the event, it may become a highly improbable, if not a physically impossible, event.

Mitigation Measures aimed at limiting the scale of core damage, preventing interaction of the molten material with containment structures, maintaining containment integrity, and minimizing off-site releases.

Nuclear Power Plant (RD-310)Also referred to as an NPP, a nuclear power plant is any fission-reactor installation that has been constructed to generate electricity on a commercial scale. A nuclear power plant is a Class IA nuclear facility, as defined in the Class I Nuclear Facilities Regulations.

Operational limits and conditions (RD-310)A set of rules setting forth parameter limits or conditions that ensures the functional capability and the performance levels of equipment for safe operation of an NPP.

Post-dryout (G-144)

76

Under plant upset or abnormal plant operating conditions, the fuel sheath may dryout. If the operator’s action(s) and/or the reactor regulating system are ineffective, the automatic shutdown system may shut the reactor down. Starting from the time of the first incipient of fuel sheath dryout until the time of reactor shutdown, continued high power operation is termed as post-dryout operation.

Scenario (International Atomic Energy Agency (IAEA) Glossary) A postulated or assumed set of conditions and/or events.

Severe accident (RD-337)A beyond design basis accident that involves significant core degradation.

Single-failure criterion (RD-310)The criterion used to determine whether a system is capable of performing its function in the presence of a single failure.

Technical Area (LBLOCA Report)One of five sub-divisions of the scope of work related to LBLOCA and positive Coolant Void Reactivity (CVR) that, based on today’s knowledge, operating experience, safety engineering principles and rules of practice, represent the technical cornerstones applied in design and operation.

Ultimate Heat Sink (RD-337)A medium to which the residual heat can always be transferred, even if all other means of removing the heat have been lost or are insufficient. This medium is normally a body of water or the atmosphere.

77

14. FIGURES

Figure 1: Process for Categorization of Outstanding Safety Issues Pertaining to Operating Reactors and Life Extension

78

Figure 2: The CNSC Risk-Informed Decision Making Process

79

Figure 3: Inputs for Risk-Informed Decision Making

80

RISK IMPACT

REGULATORY REQUIREMENTS,

CODES, STANDARDS

PROBABILISTIC ANALYSES

(PSA)

DETERMINISTIC SAFETY ANALYSES

RISK INFORMED DECISION

OPERATING EXPERIENCE

OTHER FACTORS- Costs-benefits (P-242)- Socio-economical implications- Legal aspects

Figure 4: Risk Significance versus Risk Tolerability

81

Increasing level of risk

IntolerableRegion

UnacceptableRegion

TolerableRegion

AcceptableRegion

Level 4 (RSL4)

Level 3 (RSL 3)

Level 2 (RSL 2)

Level 1 (RSL 1)

APPENDIX A. ISSUES DEFINITION FOR CATEGORY 3 CANDU SAFETY ISSUES

82

RIDM Issue Definition AA 3 - Computer Code and Plant Model Validation.

Issue ID AA 03

Title Computer Codes and Plant Model Validation

Background Information� Provide general information related to the issue. � Historical background.� How has it been identified?

Safety analysis is used to establish certain safety-related information about the design and behaviour of the reactor and the safety systems under various conditions including normal operation and certain postulated events such as loss-of-coolant accidents. Such information is provided in the Safety Report, and its updates, and is a primary definer of the station’s licensing basis and the bounds of the safe operating envelope. Analysis is also used to demonstrate that the station is being operated within the conditions of the operating licence. The credibility of this safety-related information depends to a great extent on the degree of conservatism incorporated into the safety analysis and on the qualification of the individual safety analysis activities and tools such as computer programs, analysis methods, and input information. Both Licensees and the Canadian Nuclear Safety Commission (CNSC) have recognized that computer program validation is essential to provide confidence in the safety analyses results.

In the past, CNSC staff undertook a number of assessments of Licensees’ computer programs and safety analysis methods and has identified a number of inadequate practices with respect to computer program validation. Examples of poor practices are lack of a managed process in performing validation of computer programs, poor documentation of computer program validation, poor applicability of validation due to the limited range of conditions in the validation experiments in comparison with the reactor analysis, inadequate assessment of the impact of dimensional scaling, and important phenomena for which adequate validation data does not exist. CNSC staff concluded that these inadequate practices are affecting the overall confidence in the safety analysis results.

The Industry has developed a generic framework for computer program validation and CNSC staff has been relying upon this generic approach to improve the computer program validation.

� Relationship to other Risk Informed Decision Making (RIDM) Issues and/or Technical Areas

Many of the other Category 3 issues are also related to code validation (see examples below). The AA 3 issue deals with the generic issue of code validation. In each area where code validation is considered a concern, a specific issue is defined.

83


AA8: Moderator temperature predictions. AA9: Analysis of Coolant Void Reactivity (CVR)PF09: Fuel behaviour in high temperature transientsPF 12: Channel voiding during a Large LOCA

Issue Description

Provide a description of the issue:

• What is the problem?

Inadequate code validation leads to lack of confidence in the results of safety analyses, the safety margins may be smaller than estimated and the consequences of design basis events may be worse than estimated.

• What is the harm (or harms)?

In an accident sequence that involves phenomena the prediction of which is recognized to involve significant uncertainty, it is desirable to apply a conservative approach to calculation of margins between analysis predictions and acceptance criteria. Lack of validation of models calls into question the ability to accurately predict safety margins and hence provide confidence that they are conservative.

• Which risk areas are affected?

The crux of the issue is the level of confidence that can be associated with code predictions. Although adverse findings could affect the “radiological risk to public at Design Basis Accidents (DBA)” and “severe accident risks” areas, the primary risk area affected is that of “risks of Negative Impact on Safety”.

• Under which plant conditions is the issue relevant? The issue is a potential concern for all plant conditions.

• Which event(s) are affected?

The issue is a potential concern for all events.

• What are the relevant regulatory requirements (regulation, regulatory requirement, Operating Licence)?

This issue is related to the generic action item 98G02 and to regulatory documents RD-310 and RD-337.

84


Knowledge Base



The Industry put in place an overall framework for computer program validation, which consists of a number of basic elements:

� The technical basis document, which provides the inter-relationships between the accident scenario, the overall technical disciplines, the type of safety analysis, the important safety limits to be met, and the validation;

� Validation matrices, which make the links between the important phenomena for which the computer programs need to be validated and the available experimental test facilities;

� Computer program specific validation plans; and� Computer program validation exercises.

CNSC accepted this as a reasonable, logical and systematic approach, providing an acceptable validation methodology for resolving this Generic Action Item (GAI). Substantial validation work was completed for the major computer codes as part of the Industry Standard Toolset (IST) initiative. The Generic Action Item (GAI) related to this issue is closed for all Licensees.

An ongoing Industry Standard Toolset (IST) Program has now been formed within the COG Research & Development Directorate to control future development and validation activities of Industry Standard Toolset computer codes.

In addition to the Industry Standard Toolset (IST) programs, the various Licensees and AECL have computer codes qualification programs to ensure that the non-IST codes that they are using for safety analysis also meet the applicable requirements.

Work ProgramsCOG-08-9505, Industry Standard Toolset Program, 2008/2009 Operational Plan

References:

1. IAEA-TECDOC-1554: Generic Safety Issues for Nuclear Power Plants with Pressurized Heavy Water Reactors and Measures for their Resolution, International Atomic Energy Agency, June 2007.

2. RTD-07-69: Development of Risk-Informed Regulatory Positions for CANDU Safety Issues: Risk Significance of Category 3 Safety Issues, Assessment Report prepared by CNSC, September 2007.

85


3. INFO-0770: Annual CNSC Staff Report for 2007 on the Safety Performance of the Canadian Nuclear Power Industry, Canadian Nuclear Safety Commission, August 2007.

4. Assessment Report - CNSC Review of the CATHENA 3.5c rev.0 Validation Work, File # 2.01, E-Docs # 3267586. July 16, 2008.

5. Assessment Report – CNSC Review of TUF Validation Work, File # 2.01, E-Docs # 3304174. November 19, 2008.

86

RIDM Issue Definition AA 7 - Analysis for Pressure Tube Failure with Consequential Loss of Moderator.

Issue ID : AA 7

Title Analysis for Pressure Tube Failure with Consequential Loss of Moderator.

Background Information� Provide general information related to the issue.

In CANDU reactors a rupture of a pressure tube could result in one or more of the following:a) a Loss of Coolant Accident (LOCA) inside or outside the reactor core, if the

corresponding calandria tube also fails;b) a breach of the moderator boundary leading to a loss of moderator heavy

water (LOM) in case of ejection of end-fitting(s) and calandria tube failure;c) damage to reactor systems, structures and components, including adjacent fuel

channels, reactivity control mechanisms, the calandria, and ejection of fuel bundles into the calandria and/or the reactor vault.

Tests and analysis have shown that channel failures will not lead to failure of other fuel channels and that damage to in-core components will prevent neither Shutdown System #1 nor Shutdown System #2 from performing its safety function. Analyses of such events are presented in the Safety Reports for each plant. However, tests have shown that in circumstances where the calandria tube fails after a pressure tube breaks, there is a possibility of ejecting the end fitting leading to a drain of moderator. Current Safety Reports do not include scenarios involving a Loss of Coolant Accident (LOCA) and a loss of moderator. The issue is relevant only to the dual failure in-core LOCA + LOECC, i.e. simultaneous, but not consequential loss of Emergency Core Cooling System, since the moderator is credited for fuel channel integrity and as the ultimate heat sink for the reactor.

� Historical background. � How has it been identified?� Relationship to other RIDM Issues and/or Technical Areas.

This issue was initially identified by Ontario Hydro in 1989, based on tests that had been performed as part of the COG Calandria Tube Integrity Program. In 1995, the CNSC raised Generic Action Item GAI 95G02 “Pressure Tube Failure with Consequential Loss of Moderator” to address the concern.

Following issuance of the Generic Action Item (GAI) and subsequent discussions with CNSC staff, two basic approaches were considered by the CANDU utilities to address the issue of in-core LOCA + LOECC with consequential loss of moderator: 1) reduce the probability of some or all of the events scenarios (by design modifications and/or operating procedure changes) such that the entire sequence can be categorized as a severe accident with low probability rather than a design basis accident, or 2) identify means to replace the moderator that could be lost from the calandria in the scenario, thus reliably maintaining a heat sink for the unaffected

87


channels.

The COG Regulatory Review Committee (now the Nuclear Safety Committee) established an industry task team in 2000 to prepare a common Industry response for this Generic Action Item (GAI), including benefit-cost analysis and consequence assessment. Work to address each aspect of the closure criteria was defined in a project execution plan.

The key activities defined in the plan were:- Identification of design options and investigation of their feasibility and cost;- Comprehensive assessment of the initiating event frequency, probability of loss of

moderator as a consequence of Pressure Tube (PT) rupture, probability of loss of emergency core cooling, and determination of consequences (including assessment of benefits due to potential design options);

- Perform a benefit-cost analysis to evaluate the relative merits of the design options.

Issue Description



Following a spontaneous pressure tube rupture, the calandria tube may also fail and there is a probability that end-fitting(s) may then eject leading to the consequential loss of moderator. The unavailability of the moderator as a backup heat sink and to maintain integrity of unaffected fuel channels, during an in-core Loss of Coolant Accident (LOCA) and Loss of Emergency Core Cooling (LOECC) event could lead to severe core damage.



• Under which plant conditions is the issue relevant?


Experiments suggest that it is possible for the moderator water to drain during the following postulated scenario: rupture of the pressure tube and calandria tube failure followed by end-fitting ejection and drainage of the moderator. This loss of moderator could result in severe damage to a large number of channels, with consequences in excess of those anticipated in the Safety Report for then in-core LOCA + LOECC event.

This issue has a potential to affect the “radiological risk to public at Design Basis Accidents (DBA)”, “severe accident risks” and “Negative Impact on Safety” risk areas.

88


The issue mainly affects power operation.

The event that is affected by this issue is the spontaneous pressure tube rupture, with simultaneous, but not consequential loss of ECC.


Industry has submitted the plans of actions to reduce the potential risk associated with this postulated event. CNSC staff has, in principle, agreed with the proposed administrative measures taken to mitigate the potential consequences of this event, and also agreed that implementation of any substantial design changes to reduce the likelihood of the event could be done during plant refurbishment and replacement of fuel channels.

Knowledge Base

• Provide the design basis for the issue.



• Existing Licensing Basis/Practices.



Based on Canadian Owner Group ( COG) R&D results involving pressure tube and calandria tube integrity, the Industry identified the concern that pressure tube rupture leading to a guillotine pressure tube failure could result in ejection of the end fitting. The consequential loss of moderator inventory could be problematic in conjunction with scenarios involving assumed loss of emergency core cooling. In early 2000, a joint industry team developed a basis for the proposed plans of action by each utility, based in part on an industry-developed Benefit-Cost Analysis methodology and the results of previous Canadian Owner Group ( COG) R&D on the consequences of Pressure Tube Failure. A number of design or procedural changes were evaluated.

89


Procedural changes were implemented for both the Bruce and Darlington stations to better identify the event scenario and update AIM procedures to mitigate its consequences. Moreover, taking the advantage of existing systems, an alternate means for emergency coolant make-up to the primary heat transport system was provided for Bruce A and B. No action was needed for Pickering A or B stations based on the original Benefit-Cost Assessment. As well, the severe core damage frequency was calculated in more detail using more realistic ECC impairment scenarios for Darlington, which showed that the residual risks are significantly smaller than the original Benefit-Cost Assessment. All utilities submitted requests for closure of the Generic Action Item (GAI) for all reactors.

In 2005 it became apparent that the qualification of seamless calandria tubes (the post-refurbishment option selected for Point Lepreau and Gentilly-2) would not be possible in time for upcoming plant refurbishments. Thus seam-welded calandria tubes would continue to be used. Currently, no utility considers seamless calandria tube as part of the future refurbishment activities.

NB Power submitted an alternative proposal to address GAI 95G02 involving a risk arguments supported by an analysis of a partial ECC impairment within the range of event frequencies characteristic of design basis accidents. CNSC has responded favourably and has recently closed this generic action item for Point Lepreau. Hydro Quebec is following a similar approach to that of NB Power for the Gentilly-2 refurbishment. The action item has also been closed for Bruce Power in 2008 with no further actions. The Generic Action Item (GAI) has been closed for OPG reactors as well, with a station specific action item for Darlington. OPG requested closure of that action item by submitting updated AIM procedure.

References:



90

RIDM Issue Definition CI 1 – Fuel Channel Integrity and Effect on Core Internals.

Issue ID : CI 1

Title Fuel Channel Integrity and Effect on Core Internals.


The coolant channels in CANDU reactors increase in length and diameter with the passage of time, due to creep, induced by temperature and irradiation.

� Historical background.� How has it been identified?� Relationship to other RIDM Issues and/or Technical Areas.

Several mechanisms have been identified as contributors to fuel channel degradation, which could lead to fuel channel failure. These mechanisms are the following:

• Deuterium ingress into, and embrittlement of, the pressure tube (PT) material;• Delayed Hydride Cracking;• Material property changes, e.g. changes in material tensile properties, fracture

toughness, and delayed hydride cracking velocity;• Spacer movement; and• Service-induced flaws.

These mechanisms can lead to:• Formation of blisters;• Pressure Tube (PT) deformation, e.g. elongation and sagging.

This issue is related to the issues GL 3 Ageing of Equipment and Structures, PF 20 Analysis Methodology for Neutron Overpower Protection / Regional Overpower Protection (aspects related to ageing), AA 3 Computer Code and Plant Model Validation, PF 19 Impact of Ageing on Safe Plant Operation and CI 2 Deterioration of Core Internals. For clarity all these issues are dealt with separately. The aspects addressed specifically under CI 1 are those related to the Impact of Ageing on the Structural Integrity of Fuel Channels.

Issue Description



It should be verified that fuel channel ageing is adequately monitored to ensure that the consequences of ageing on fuel channel integrity are adequately managed.


91




Although the CANDU reactor design has the capability to withstand the consequences of a pressure tube rupture, designers and operators must strive to reduce the probability of pressure tube failure. Fuel channel failure consequences are severe, particularly when taking into consideration the potential for damage to other channels and/or core internals.

The issue is that it should be ensured that an appropriate fuel channel inspection program is in place. Therefore the primary risk area related to this issue is “Negative Impact on Safety”.

The issue is mostly relevant to power operation.



The issue primarily affects pressure tube rupture including events with consequential loss of moderator.

This issue is related to the RD-337 expectation on ageing which indicates that:

7.17 Ageing and Wear

The design considers the effects of ageing and wear on SSCs. For SSCs important to safety, this consideration includes:

1. An assessment of design margins, taking into account all known ageing and wear mechanisms and potential degradation in normal operation, including the effects of testing and maintenance processes; and2. Provisions for monitoring, testing, sampling, and inspecting SSCs to assess ageing mechanisms, verify predictions, and identify unanticipated behaviours or degradation that may occur during operation as a result of ageing and wear.

8.2 Reactor Coolant System

The design provides the reactor coolant system and its associated components and auxiliary systems with sufficient margin to ensure that the appropriate design limits of the reactor coolant pressure boundary are not exceeded in

92


normal operation, Anticipated Operational Occurence (AOO)s, or Design Basis Accidents (DBA)s…

8.2.1 In-service Pressure Boundary Inspection

The components of the reactor coolant pressure boundary are designed, manufactured, and arranged in a manner that permits adequate inspections and tests of the boundary throughout the lifetime of the plant.

The design also facilitates surveillance in order to determine the metallurgical conditions of materials for which metallurgical changes are anticipated.

Knowledge Base


• What aspects of the analysis (e.g. methodology, assumptions, acceptance criteria, codes and their validation/experimental basis, etc) are related to the issue?





CSA N285.4 is the governing standard for both the regulatory authority and the Industry on Periodic Inspection of CANDU Nuclear Power Plant Components. At the regulator’s request, Licensees have issued Life Cycle Management Plans to describe their respective processes for managing fuel channel ageing. Moreover, Licensees rely on two sets of guidelines, documenting the technical bases for fitness of service evaluations of pressure tubes: a) COG-91-66 (1996 Edition); and b) CSA N285.8-05 “Technical Requirements for In-Service Evaluation of Zirconium Alloy Pressure Tubes in CANDU Reactors”.

Canadian Licensees currently identify trends in Pressure Tube (PT) degradation, and plan future inspection/maintenance activities using ageing management plans. They address PROL-requirements (i.e. N285.4) to inspect "PIP" (Periodic Inspection Program) channels, as well as additional channels through In-Service Inspection (ISI) program, and demonstrate continued structural integrity by meeting the acceptance criteria provided in either Fitness for Service Guidelines (FFSG) or CSA N285.8-05. From both the PIP and ISI programs, roughly 3% of the pressure tube population was inspected. It should be noted however, that PIP channels represent a very small fraction of the core (5 channels in a single-unit station; 14 channels across a 4-unit station). In fact, even when Licensees voluntarily implement an In-Service Inspection

93


("ISI") program, the fraction of FCs inspected over the life of a reactor is quite small.

Activities by the regulatory body:a) To address deuterium ingress, Licensees are required to:

• Periodically monitor pressure tube hydrogen levels in-situ, and• Periodically remove and examine surveillance tubes for deuterium and hydrogen concentration.

b) To address Delayed Hydride Cracking, Licensees are required to:• Establish shutdown procedures that avoid fast fracture,• Establish a Leak Detection System that is active at all times during operation,• Monitor hydrogen equivalent concentration by periodic removal and surveillance examination of rolled joints, • Monitor for incipient cracks through Periodic Inspection Programs (PIP). (At their discretion, Licensees may also implement In-Service Inspection (ISI) programs),• Determine the population of at risk by periodic inspection programs,• Observe operating restrictions based on flaw severity, and• For those flaws where there is a finite risk of initiating a crack, demonstrate Leak-Before-Break.

c) To address blister formation, Licensees are required to:• Ensure that reactors are not operated with a Pressure Tube (PT) which is in contact with its CT and which meets or exceeds the current threshold criterion for hydrogen concentration for blister formation under continuous operation; this is achieved by maintenance programs that consist of:

- Prediction and monitoring of Heq concentrations,- Predictions and monitoring of PT-to-CT contact, and- Removal of contact by repositioning garter springs before the blister

formation threshold is reached.

d) To address Pressure Tube (PT) deformation, the Licensees are required to:• Measure deformation through an in-service inspection program,• Ensure garter springs are at the right place to keep sagged tubes out-of-contact.

e) To address material property changes, Licensees are required to:• Periodically remove pressure tubes to permit measurements of material tensile properties, the stress intensity threshold for DHC initiation, fracture toughness, and delayed hydride cracking velocity.

Activities by the industry:

The Canadian Nuclear Industry has identified and is acting upon the following key elements of a “Pressure Tube Ageing Management Program”:

94


a) Understanding pressure tube ageing (material properties, operating conditions, ageing mechanisms, condition indicators, consequences of ageing-related degradation and failures, operating experience, research and development);

b) Definition of an ageing management program (coordinating activities, documentation, program optimization);

c) Managing ageing mechanisms (following procedures, chemistry control of water and annulus gas);

d) Inspection, monitoring and assessment (leak rates, fitness for service assessment); and

e) Maintenance/ replacement (mitigation of tube degradation, replacement).

References:



3. IAEA-TECDOC-1197: Assessment and management of ageing of major nuclear power plant components important to safety: CANDU reactor assemblies, International Atomic Energy Agency, February 2001.

4. IAEA Technical Reports Series No. 338: Methodology for the Management of Ageing of Nuclear Power Plant Components Important to Safety, International Atomic Energy Agency, Vienna 1992.

5. IAEA Safety Series No. 50-P-3: Data Collection and Record Keeping for the Management of Nuclear Power Plant Ageing, International Atomic Energy Agency, Vienna 1991.

6. IAEA Safety Reports Series No. 15: Implementation and Review of a Nuclear Power Plant Ageing Management Programme, International Atomic Energy Agency, Vienna 1999.

95

RIDM Issue Definition CI 2 - Deterioration of Core Internals.

Issue ID : CI 2

Title Deterioration of Core Internals


Ageing in nuclear power plants (NPPs) must be effectively managed to ensure that required safety margins are maintained throughout plant service life, including any extended life. CI 2 is addressing the concern related to the reactor core internal excluding the pressure tubes which are addressed in CI 1.

The reactor internals include the control rod guide tubes, liquid injection tubes, flux detector units, calandria tubes and pressure tubes/fuel channels, and moderator parts. The following ageing mechanisms have been observed:

• Calandria tubes have the potential to contact the liquid poison injection shutdown system nozzles (LISS nozzles) and/or the horizontal flux detector units, due to sag of fuel channel and horizontal unit assemblies during the design life.

• Guide tube tensioning has changed from nominal design values affecting the design basis margins for flow induced and seismic vibrations. The degradation mechanisms have been identified as radiation induced relaxation in spring and radiation induced creep and growth in guide tubes.

• Leak event under normal operation condition was found in a Calandria tube and the event was caused by an environmental assisted crack.

• Through wall cracks were discovered in the moderator cover gas relief duct caused by stress corrosion cracking.


This issue is related to the issues GL 3: Ageing of equipment and structures, PF 19: Impact of ageing on safe plant operation (such as Special Shutdown System (SDS) insertion time), PF 20 Analysis Methodology for Neutron Overpower Protection / Regional Overpower Protection (Pressure Tube (PT) and detector movement due to sag aspects related to ageing), and CI 1 Fuel channel integrity and effect on core internals (aspects related to ageing).

Issue Description



The issue is that Licensees currently do not have an Ageing Management

96


program for internal components.




The degradation mechanisms of the core internal could lead, if uncorrected, to operation outside design conditions. Deterioration of core internals could affect shutdown system capability and could cause other damage through loose parts. Such degradations are usually slow allowing time for detection and corrections.

The primary risk area related to this issue is “Risk of Negative Impact on Safety”.

The issue is relevant to all plant conditions.



In principle all the events that require the activation of the shutdown systems are affected by the issue.



1. An assessment of design margins, taking into account all known ageing and wear mechanisms and potential degradation in normal operation, including the effects of testing and maintenance processes; and2. Provisions for monitoring, testing, sampling, and inspecting SSCs to assess ageing mechanisms, verify predictions, and identify unanticipated behaviours or degradation that may occur during operation as a result of ageing and wear.

It is also acknowledged that the CNSC is currently preparing a regulatory document on the management of ageing.

Knowledge Base



97



• Existing Licensing Basis/Practices



Point Lepreau experience showed there is potential for LISS nozzle contact with sagging Calandria Tubes.

Gentilly-2 experienced embrittlement / failure of guide tube springs.

A through-wall crack which was identified as an environment assisted crack was observed in A13 Calandria tube in Pickering B Unit 7.

Through wall cracks were discovered in the moderator cover gas relief duct caused by SCC in Bruce Unit 7.

References:







98

RIDM Issue Definition GL 3 - Ageing of Equipment and Structures.

Issue ID : GL 3

Title Ageing of Equipment and Structures.


Ageing in nuclear power plants (NPPs) must be effectively managed to ensure that required safety margins are maintained throughout plant service life, including any extended life.


Operating experience has shown that ineffective control of degraded condition caused by physical ageing of the risk significant NPPs components can jeopardize plant safety and also plant life. From the safety perspective, this means that Licensees have to control within acceptable limits the ageing degradation and wear out of plant structures, systems and components (SSC) important to safety so that adequate safety margins remain, i.e. integrity and functional capability in excess of normal operating requirements.

A widely accepted Technical Report “Methodology for the Management of Ageing of Nuclear Power Plant (NPP)Components Important to Safety” [9.3] was issued by the International Atomic Energy Agency (IAEA) in 1992 to address the concern. Also, a Safety Practice “Data Collection and Record Keeping for the Management of Nuclear Power Plant Ageing” [9.3] was provided to give guidance on ageing management. Moreover, national and international regulatory and nuclear industry organizations, including the International Atomic Energy Agency (IAEA), OECD/NEA, WENRA, EPRI and INPO have recognized the importance of managing ageing in NPP, and many publications on the subject have been issued [9.3- 9.3]. The International Atomic Energy Agency (IAEA) has published a new safety guide [9.3].

This issue is related to the issues PF 19: Impact of Ageing on Safe Plant Operation, PF 20 Analysis Methodology for Neutron Overpower Protection / Regional Overpower Protection (aspects related to ageing), CI 1 Fuel Channel Integrity and Effect on Core Internals (aspects related to ageing) and CI 2 Deterioration of Core Internals. There is also some relationship with PF 18 Fuel Bundle/Element Behaviour under Post-Dryout Conditions. For clarity all the issues are dealt with separately. The issue GL 3 covers the programmatic concern related to the ageing management program, whereas the other issues cover more specific aspects.

99


Issue Description



To ensure that NPPs safety is maintained, System Structure Component (SSC) ageing must be understood and managed effectively; that is, ageing effects of System Structure Component (SSC) must be detected (i.e. through inspection, testing or surveillance programs) and corrective actions taken (i.e. operating limits, operation, maintenance, repair, replacement) before loss of System Structure Component (SSC) integrity or functional capability occurs.

Licensees have established Component Life Cycle Management Programs as well as Fitness-For-Service Guidelines for the Major Life Limiting Components for CANDU reactors (i.e., feeders, pressure tubes, steam generator tubes). However, Licensee programs for ageing management of other structures, systems and components (SSC) important to safety have not been as well established or systematically implemented as yet, and there are concerns that ageing degradation in passive components (e.g. calandria / reactor internals, concrete containment, etc.) is not as adequately managed. In addition, information to support the assumptions made in the safety analysis, and to support the Safe Operating Envelope has not been collected in a systematic manner.

• What is the harm (or harms)?Inadequate ageing management programs could lead to untimely detection and mitigation of ageing effects on components, which could reduce the effectiveness of safety functions, lead to challenges in plant safety or reduce defence-in-depth.

The potential harm associated with an ineffective ageing management program involves:

1. Loss of safety functions;2. Potential under-estimate of plant risks;3. Potential for forced outages;4. Potential damage to collateral equipment, or safety concerns for staff, if

equipment fails catastrophically; and 5. Loss of defence-in-depth and designed-in redundancies.



Safety-related functions in nuclear power plants must remain effective throughout the life of the plant, including any extended life. Licensees are expected to have a

100


proactive program in place to prevent, detect and correct significant degradation in the effectiveness of important safety-related functions.

The issue is that it is not well demonstrated that the existing ageing management programs include systematic assessment of the ageing mechanism and their implications on the safe operating envelop. This is a finding from some of the Integrated Safety Reviews (ISR) being conducted for life extension projects, which includes the safety factor on management of ageing. Therefore the primary risk area related to this issue is “Negative Impact on Safety”.




In principle all the events could be affected by this issue. Physical ageing degradations may reduce the ability of an SSCs to perform its design functions and to meet its performance requirements over time. Ageing effects may also increase the probability of common cause failures or lead to a reduction of defence in depth.

CNSC regulatory document S-210 “Maintenance Programs For Nuclear Power Plants” [17] requires that “the Licensee shall have a process to detect, assess, and manage deterioration of SSCs as a result of ageing effects such as irradiation, corrosion, erosion, fatigue, and other material degradation. The type and frequency of maintenance activities shall be modified to accommodate such effects”.

In the context of the implementation of CNSC S-98 [9.3] which is referenced in the PROL, the stations have also put in place programs to monitor the reliability of the Systems important to safety. Moreover, at stations that are currently involved in life extension programs, extensive condition assessments of all the SSCs important to safety have been performed.

RD-337 for new nuclear power plants [9.3] includes the following expectation on ageing:


1. An assessment of design margins, taking into account all known ageing and wear mechanisms and potential degradation in normal operation, including the effects of testing and maintenance processes; and

2. Provisions for monitoring, testing, sampling, and inspecting SSCs to assess

101


ageing mechanisms, verify predictions, and identify unanticipated behaviours or degradation that may occur during operation as a result of ageing and wear.

It is also acknowledged that the CNSC is currently preparing a regulatory document on the management of ageing.

Knowledge Base







Acceptable methods for addressing CNSC expectations are described in International Atomic Energy Agency (IAEA) documents No. 338 of the Technical Report Series “Methodology and Management of Ageing of Nuclear Power Plant Components Important to Safety”[9.3], and Safety Report Series No. 15 “Implementation and Review of Nuclear Power Plant Ageing Management Programme”[9.3], and the recent IAEA Safety Guide, NS-G-2.12, “Ageing Management for Nuclear Power Plants”.

The process for ageing management consists of the following basic steps:

• Selection and screening of safety important plant SSCs for which ageing should be evaluated;

• Understanding dominant ageing mechanisms in the selected components and identifying or developing effective and practical methods for monitoring and mitigating ageing of the components (ageing management studies);

• Development of SSCs specific ageing management practices and initiatives in surveillance, maintenance and operations (proper design, manufacturing, storage and installation are also significant in the management of ageing); and

• Implementation of ageing management programs, including establishment of appropriate program documentation, organizational arrangements, data collection and management systems. This should include processes for review of ageing management program effectiveness and improvement.

102


It is to be noted, that all the Licensees currently have in place ageing management programs. In the context of the implementation of S-98, the stations have also put in place programs to monitor the reliability of the Systems important to safety. Moreover, at stations that are currently involved in life extension programs, extensive condition assessments of all the SSCs important to safety have been performed.

CNSC and Canadian Industry (COG) have a large number of R&D initiatives closely related to ageing management of NPPs, including several through international organizations (IAEA, OECD/NEA) as well as cooperative projects with other nuclear regulatory agencies. Participation in these activities provides an opportunity to harmonize our regulatory guidance approach and documents with international best practices and recommendations.

References:

1. RTD-07-69: “Development of Risk-Informed Regulatory Positions for CANDU Safety Issues: Risk Significance of Category 3 Safety Issues”, Assessment Report prepared by CNSC, September 2007.

2. IAEA-TECDOC-1554: “Generic Safety Issues for Nuclear Power Plants with Pressurized Heavy Water Reactors and Measures for their Resolution”, International Atomic Energy Agency, June 2007.

3. IAEA-TECDOC-1197: “Assessment and Management of Ageing of Major Nuclear Power Plant Components Important to Safety: CANDU Reactor Assemblies”, International Atomic Energy Agency, February 2001.

4. IAEA Technical Reports Series No. 338: “Methodology for the Management of Ageing of Nuclear Power Plant Components Important to Safety”, International Atomic Energy Agency, Vienna 1992.

5. IAEA Safety Series No. 50-P-3: “Data Collection and Record Keeping for the Management of Nuclear Power Plant Ageing”, International Atomic Energy Agency, Vienna 1991.

6. IAEA Safety Reports Series No. 15: “Implementation and Review of a Nuclear Power Plant Ageing Management Programme”, International Atomic Energy Agency, Vienna 1999.

7. IAEA TECDOC 1197: “Assessment and Management of Ageing of Major Nuclear Power Plant Components Important to Safety: CANDU Reactor Assemblies”, February 2001

103


8. IAEA TECDOC 1188: “Assessment and Management of Ageing of Major Nuclear Power Plant Components Important to Safety: In-containment Instrumentation and Control cables”. Volumes I & II, November 2000

9. IAEA TECDOC 1025: “Assessment and Management of Ageing of Major Nuclear Power Plant Components Important to Safety: Concrete Containment Buildings”, June 1998

10. IAEA TECDOC 981: “Assessment and Management of Ageing of Major Nuclear Power Plant Components Important to Safety: Steam Generators”, November 1997

11. IAEA Safety Report (DS381) “Safe Long Term Operation of Nuclear Power Plants” in preparation, Vienna.

12. IAEA Safety Guide (NS-G-2.12) “Ageing Management for Nuclear Power Plants”, 2009..

13. US NRC NUREG-1801, “Generic Ageing Lessons Learned (GALL) Report”, Vol. 1 and 2, 2005

14. Institute of Nuclear Power Operations, “Equipment Reliability Process Description”, INPO AP-913 Revision 1, 2001.

15. Nuclear Energy Institute, “Guidelines for the management of materials issues”, NEI 03-08, 2003.

16. CNSC S-98 Rev. 1: “Reliability programs for Nuclear Power Plants”, Canadian Nuclear Safety Commission, July 2005.

17. CNSC regulatory document S-210 “Maintenance Programs For Nuclear Power Plants”, 2007

18. CNSC regulatory document RD-337 “Design Requirements for New Nuclear Power Plants”, 2008

104

RIDM Issue Definition GL 4- Inadequacy of Reliability Data.

Issue ID : GL 4

Title Inadequacy of Reliability Data.


Confidence on the results of Probabilistic Safety Assessment (PSA) and Reliability models is dependant on the correctness of components reliability data.

A component reliability database that is derived from actual plant experience is generally preferred for use in a plant Probabilistic Safety Assessment (PSA) or risk evaluation. However, this is not always possible.

For example, i) if the plant is new and not enough operational experience is available (a refurbished plant can be viewed as equivalent to new as many components are either replaced or refurbished), ii) if the component is highly reliable or belongs to a very small component population that it takes long plant operation time to collect statistically adequate data.

In these situations, use of a generic data base is the practical alternative with plant operational data updated using Bayesian methods.


Historically, the first CANDU components reliability database has been developed by Ontario-Hydro in 1986. This database has been used (and continue to be used) by several Licensees. In later years, all stations have started developing their own component reliability data base that includes experience specific to the stations. This was particularly so for the special safety systems, and more recently for Systems Important to Safety as defined by S-98 (Reliability Programs for Nuclear Power Plants). This is expected to be the trend in future with some utilities planning to encompass all systems within the Probabilistic Risk Assessment (PRA). One of the utilities claim that most of their component failures in the Probabilistic Risk Assessment (PRA) can be quantified based on station specific experience only.

The bottom line is that the reliability data used by the Licensees can be supported to be representative of their plants and the accuracy be commensurate with the intended application.

To a certain extent this issue is related to the issue on ageing (GL3). Nevertheless they will be treated independently.

105


Issue Description



When using quantitative tools (e.g. Probabilistic Safety Assessment (PSA)) to identify weaknesses and their prioritizations of issues, the lack of realistic component data may lead to inadequate decisions with respect to design or procedure modifications and regulatory requirements.





Global underestimation of component failure rates could result in incorrect Core Damage Frequency (CDF)/LRF estimates, which could allow the utility and the CNSC to make decisions that, in reality, could represent a higher-than-acceptable plant risk. It also decreases our level of confidence in estimation of the risks related to the operation of the plant.

This, however, is not likely as sensitivity assessments for most components show that the impact of wide variations in failure probabilities has little significant impact on the quantified results, and in particular on Safety Goals. Also, for those component failures that are shown to have significant impact, a focused assessment can be done to avoid or reduce inappropriate data by taking into account all available experience with these specific components (including related OPEX).

The primary risk area related to this issue is “Negative Impact on Safety”, due to the possibility to make wrong decisions.


The Regulatory Standard S-294 [9.3] requires that:• …’PSA models are developed using assumptions and data that are realistic

and practical’Knowledge Base


• What aspects of the analysis (e.g. methodology, assumptions, acceptance criteria,

106


codes and their validation/experimental basis, etc) are related to the issue?





Utilities are already collecting plant-specific data for many if not all components included in the Probabilistic Risk Assessment (PRA).

There is a recognition from Canadian Owner Group ( COG) partners that having a generic data base that can be used by all Utilities and can be justified to be applicable to CANDU is worth pursuing. In the long term, if conditions become favourable, Canadian Owner Group ( COG) partners can develop methodologies and processes to share CANDU reliability data.

References:

1. IAEA-TECDOC-1554: Generic Safety Issues for Nuclear Power Plants with Pressurized Heavy Water Reactors and Measures for their Resolution, International Atomic Energy Agency, June 2007


3. S-294: Probabilistic Safety Assessment (PSA) for Nuclear Power Plants, published by the Canadian Nuclear Safety Commission, April 2005.

107

RIDM Issue Definition IH 6 - Need for Systematic Assessment of High Energy Line Break Effects.

Issue ID : IH 6

Title Need for Systematic Assessment of High Energy Line Break Effects.


High energy pipes are those containing fluids with operating conditions exceeding certain limits of pressure or temperature, producing an energy release in the case of a break (or crack) which if unmitigated could damage safety systems or structures.


For primary side, Darlington Nuclear Power Plant (NPP)was the first station that explicitly and fully addressed the requirement for protecting SSCs from effects of postulated Primary Heat Transport (PHT) pipe rupture. By constructing isolation barriers/engineered restraints against jet impingement/pipe whip, or being satisfied with Leak Before Break (LBB) criteria, Darlington Nuclear Power Plant (NPP)has adequately protected the SSCs from the consequences associated with a postulated rupture of high-energy piping.

In other NPPs in Canada, the issue of high energy line break on the primary side was not fully addressed in the design stage. The layout of plant equipment applied the defence-in-depth philosophy and considered separation of special safety systems and separation between high-energy systems and special safety systems. However, assumption was used to minimize the number of locations of high concern. For example, use of low frequency failure of large-diameter Primary Heat Transport (PHT) piping.

The source of this issue is a combination of operational experience, deviation from current standards and practices and potential weakness identified by deterministic or probabilistic analyses.

This issue is also related to the issue PSA 3 Open design of the balance of plant - steam protection. The aspects related to steam protection following balance of plant high energy pipe breaks are therefore not considered under IH 6. The scope of IH 6 will focus only on high energy line break effects on the primary side, since the secondary side will be cover under PSA 3 issue.

108


Issue Description



The issue is that for certain plants there has not been a systematic review of the dynamic and environmental effects of high energy piping breaks inside the containment and the consequences on plant safety. Moreover, consequential damage associated with failure postulated is not systematically considered in probabilistic risk assessments or in the design basis accidents used for nuclear safety analyses in accordance with the licensing basis for the plants.





Dynamic effects at high energy pipe breaks (e.g. pipe whip, jet impingement) can cause consequential failure of Structures, Systems and Components (SSCs) and impair defence-in-depth. This raises concerns of increased radiological risks to public and of severe accident risks.

The possible consequences are:• Dynamic effects caused by the ruptured pipe;• Effects resulting from fluid flow, jet impingement, irradiation and contamination;• Variation in local ambient conditions (pressure, temperature, humidity, floods);• Debris generation and potential for blockage of emergency recirculation during

design basis accident.

Pipe ruptures may lead to safety systems, equipment, structures and containment being damaged and/or the accident mitigation being jeopardized.

Upon the review of IAEA Nuclear Safety Guide NS-G-1.11 and past Canadian practices, it is considered that it is necessary to assess and document the consequences associated with the postulated rupture of high-energy piping systems.

Also, IAEA NS-G-1.11 acknowledge that for existing plants some design oriented recommendations may not be practicably achievable. The objective of the subject systematic review should be to quantify consequences and subsequent work would be required to mitigate these consequences to the extent practicable.

The issue is primarily related to the fact that there has not been a fully documented

109


systematic review of the consequences of high energy pipe breaks. There are uncertainties in the existing safety assessments related to such breaks. Therefore the main risk area related to this issue is “Negative Impact on Safety”.

This issue is relevant for all operational states when the definition of high energy pipe is met (power and shutdown states).

The issue affects all events that involve high energy pipe breaks in the primary side of NPPs.

Difference in design of plants will have an impact on the consequence of postulated piping failures. Plant specific systematic reviews must be performed and those places an onus on assessing both core damage and large release frequencies associated with postulated piping ruptures.

For example:• Some containment designs have process equipment “sticking-out” of

containment and others have main steam lines penetrating containment. The potential for containment impairment due to the dynamic effects of postulated rupture will be different.

• Multi-unit stations have different scope of periodic inspection than single unit stations.

• The difference in containment designs can impact on the ability to detect leakage from the primary heat transport circuit.


The issue is related to the expectations in RD-337 that specify that:

The plant design takes into account the potential for internal hazards, such as flooding, missile generation, pipe whip, jet impact, fire, smoke, and combustion by-products, or release of fluid from failed systems or from other installations on the site. Appropriate preventive and mitigation measures are provided to ensure that nuclear safety is not compromised.and

Civil structures important to safety are designed and located so as to minimize the probabilities and effects of internal hazards such as fire, explosion, smoke, flooding, missile generation, pipe whip, jet impact, or release of fluid due to pipe breaks.

Knowledge Base

110




IAEA Nuclear Safety Guide NS-G-1.11 provides guidance relating to an assessment of the possible consequences of internal hazards in nuclear power plants. This Safety Guide provides interpretation of relevant requirements of IAEA NS-R-1 and makes recommendations on how to fulfill them. IAEA NS-G-1.11 provides guidance on the methods and procedure for analyses to support an assessment of the possible consequences of internal hazards. However, this Safety Guide does not include guidance on how to perform pipe-whip analyses, jet-impingement analyses, or leak-before-break analyses. American National Standard ANS-58.2 was written to document acceptable methods for complying with the United States of America General Design Criterion 4 for the design basis for environmental and dynamic effects associated with postulate rupture of piping. In spite of the fact that the ANS-58.2 standard has been withdrawn, it remains a pragmatic standard with respect to providing procedures for the assessment of pipe whip, jet impingement, and leak-before-break, and such, its use in conjunction with IAEA NS-G-1.11 is encouraged.





The pipe-whip and jet-impingement analyses will be used to identify those postulated rupture locations that are candidates for further consideration. The purpose of these further considerations is to disposition any potential non-compliance with modern standards and practices. This further consideration may involve one or more of the following:

• Perform more advanced analysis of consequences of the postulated rupture (i.e. pipe whip and jet impingement); • Perform more advanced safety analysis to demonstrate that the consequences of the postulated rupture are acceptable;• Introduce design modification(s) to minimize the consequences of the dynamic effects associated with the postulated rupture;• Compensatory measures to ensure low probability of occurrence so that the postulated rupture location may be exempt as a postulated initiating event.

111


Internationally, leak-before-break (LBB) principles have been widely accepted as the technical justification for relaxing the requirement for pipe-whip restraints whose sole purpose is to mitigate the consequences of the dynamic effects associated with the postulated ruptures of high-energy nuclear piping systems. The application of Leak Before Break (LBB) principle for main circuit piping will be used as the principal element for the disposition of problematic postulated pipe ruptures in main circuit piping.

Although some information is available, assessing the adequacy of the design requires a large amount of work, given all the possible locations where the breaks and subsequent pipe whip could happen. Lack of systematic assessments of these effects makes it difficult to estimate and evaluate these effects and the ensuing risks. It is therefore recommended requesting the Licensees to identify plant vulnerabilities and implement practicable measures.

In general, variation in local ambient conditions from steam/feedwater line breaks outside containment resulting in high pressure steam in turbine hall and, with the failure of other SSCs, consequential core damage and containment failure due to loss of support systems (pressure, temperature, humidity, floods) has been addressed in the Safety Issue PSA 3.

Harsh environment conditions due to high energy line breaks inside containment are not considered here as we have accepted that SSCs are environmentally qualified.

It is to be noted that Bruce Power has already addressed 2 important issues due to pipe whip and jet impingement.

1.0 LBLOCA disables the ECI injection paths.

2.0 In-core Loss of Coolant Accident (LOCA) disables the shut off rods and Mechanical Control Absorbers.

References:

1. IAEA-TECDOC-1554: Generic Safety Issues for Nuclear Power Plants with Pressurized Heavy Water Reactors and Measures for their Resolution, International Atomic Energy Agency, June 2007


3. International Atomic Energy Agency; Safety Assessment and Verification for Nuclear Power Plants, Safety Standards Series No. NS-G-1.2, IAEA, Vienna, 2003

112


4. International Atomic Energy Agency; Protection against Internal Hazards other than Fires and Explosions in the Design of Nuclear Power Plants, Safety Guide No. NS-G-1.11, IAEA, Vienna, 2004.

5. M.J. Kozluk, Review of Bruce Units 1 & 2 Against Modern Safety Standards – Methodology for the Assessment of Pipe Whip and Jet Impingement,

6. AECL Assessment Document 21-03600-ASD-001, Revision 0, 2008 May,alternative document number Bruce Power Report Number NK21-REP-03600-00022.

7. International Atomic Energy Agency Safety Standards, Protection against Internal Hazards other than Fires and Explosions in the Design of Nuclear Power Plants, Nuclear Safety Guide number NS-G-1.11, 2004.

8. American Nuclear Society, Design Basis for Protection of Light Water Nuclear Power Plants against the effects of Postulated Pipe Rupture, American National Standard ANSI/ANS-58.2-1988, 1988 October 6.

113

RIDM Issue Definition PF 15 - Molten Fuel/Moderator Interaction.

Issue ID : PF 15

Title Molten Fuel/Moderator Interaction


A severe flow blockage in a fuel channel, or an inlet feeder stagnation break, could potentially lead to fuel melting, channel rupture and ejection of molten fuel into the moderator.

� Historical background. � How has it been identified?� Relationship to other RIDM Issues and/or Technical Areas.

There has been a long-standing difference of opinion between CNSC staff and Licensees and their respective consultants on the severity of the molten fuel/moderator interaction. Starting the first quarter of 2000, however, Licensees initiated an experimental program to resolve this matter. A panel of three independent fuel-coolant interaction experts was set up to review the experimental program and the resolution criteria proposed by the industry.

Issue Description



Severe flow blockage in a fuel channel, or flow stagnation, could potentially lead to fuel melting and ejection of molten fuel into the moderator. The primary concerns of this Generic Action Item (GAI) are the ejection mechanism, and the subsequent interaction of the molten fuel with the moderator. There are uncertainties in the nature of the interaction between the molten material and the D2O in the moderator (forced interaction vs free interaction). The extent of the damage to the shutoff rods, fuel channels, other core internal and the calandria itself depends on the nature of this interaction.




High-pressure ejection of molten fuel into the subcooled moderator may occur during an in-core Loss of Coolant Accident (LOCA) that follows a stagnation feeder break or

114


severe flow blockage, possibly leading to a steam explosion. The additional loads due to molten fuel/metal interaction may cause impairment of the shutdown function (failure of Special Shutdown System (SDS)1 rods guide tubes). In addition, the fuel cooling function may be impaired if several channels consequentially fail due to loads generated during the molten fuel/metal interaction.

The issue is that there are uncertainties in the nature of the interaction between molten material and the moderator fluid. Therefore the primary risk area related to this issue is “Negative Impact on Safety”. If the shutdown function or the cooling function fails, there is a significant likelihood that design basis accidents may propagate to severe core damage. As the containment integrity is not expected to be challenged, the public doses are not expected to be significant.


The events affected by this issue are severe flow blockage in a single channel and feeder stagnation break.


There is no specific regulatory requirement directly related to the issue. The issue is nevertheless indirectly related to the requirements in the Siting Guide, and in the Regulatory Documents C-6, RD-310 and RD-337 that apply to design basis events.

The CNSC raised the Generic Action Item GAI 95G01 “Molten fuel-moderator interaction” to address the concern.

Knowledge Base







Analyses submitted by the Licensees for severe flow blockage accidents have been based on the assumption that the mode of fuel-moderator interaction would be

115


forced interaction as opposed to free interaction. The forced interaction model postulates that the melt is ejected from the channel at sufficiently high velocity to be fragmented and rapidly quenched within milliseconds. The free interaction model postulates that the ejected melt first accumulates outside the channel as a coarse mixture of melt and water. This coarse mixture is then triggered by a shock wave dispersing the coarse mixture into fine fragments which quench coherently and rapidly, causing a more severe pressure pulse (and threat to calandria integrity) than that generated by forced interaction.

In the early 1990’s, an Industry task group examined the modelling of energetic fuel-coolant interactions and the available data that supports the models. This group concluded that both the theory and the available CANDU-specific test data supported the conclusion that forced fuel coolant interaction will always occur following a CANDU single channel event. However, CNSC staff took the position that free interaction, and the potential for steam explosions, cannot be ruled out when relatively large amounts of molten material are ejected into the moderator. The Industry concluded that the most effective way to address CNSC staff concerns was to undertake experimental work on molten material/moderator interaction. The Molten Fuel Moderator Interaction (MFMI) experimental program was initiated as part of the COG R&D program. These experiments were aimed at validating the models used in the analyses involving Molten Fuel/Moderator Interaction (MFMI) and quantify important parameters. The intent of the test program is to represent full-scale CANDU conditions to the extent possible given the facility limitations, such that the results can be directly applied to the reactor case.

As part of the process of defining an acceptable test program, the Canadian Industry and the CNSC jointly convened an Independent Expert Advisory Panel of three internationally-renowned fuel-coolant-interaction experts to review the proposed test program. The expert panel endorsed the final experimental program as well as the success criteria 9.3. These were communicated to CNSC in reference 9.3. The CNSC staff agreed that if the tests were performed as proposed and the results meet the success criteria, GAI 95G01 can be closed 9.3.

In the event that the primary success criteria had not been successful in interpreting the results of the Molten Fuel/Moderator Interaction (MFMI) tests or if the tests did not confirm forced interaction as expected, work was undertaken as part of the COG R&D Program to develop and apply alternative success criteria. For the alternative success criteria, the measured pressure transient following pressure tube rupture would have served as the primary tool to evaluate safety margin or potential for calandria damage resulting from the observed interaction, regardless of its mode.

An Industry task team has been formed by the R&D S&L Technical Committee to oversee the COG R&D program on Molten Fuel/Moderator Interaction (MFMI) and interface with CNSC to achieve closure. Several experiments were commissioned under COG work packages 21301 and 21302, involving experiments at both Argonne

116


National Laboratories and at AECL.

Completed tests have demonstrated the ability to produce and measure corium melts in the range of 2400°C; a thermite mixture that can auto-ignite at 400ºC was developed to generate the molten corium at 2400°C for these studies in partnership with Argonne National Laboratory. Construction of the test facilities were completed and a set of two non-corium commissioning tests, a corium commissioning test, and three MFMI tests were completed. These tests ejected between 4.75 kg and 22 kg of CANDU-typical corium from a simulated CANDU fuel channel at pressure-tube pressures ranging between 0.55 MPa and 11.5 MPa into subcooled water between 34.9ºC and 40.9ºC. The measured peak dynamic pressures within the subcooled water tank were between 0.08 MPa and 4.36 MPa for all four tests and the average diameter of the quenched molten debris particles collected after the test ranged between 0.013 and 0.686 mm. The molten corium consisted of 73.0 UO2/11.0 Zr/6.0 ZrO2/10.0 Cr (wt%). The mode of interaction in the completed tests was assessed using the success criteria 9.3.

From the four MFMI experiments completed, it can be deduced that for ejection pressure of 3.35 MPa or higher, the dominant mode of interaction between the molten corium and water is forced interaction. At very low ejection pressures, between 0.55 MPa and 0.9 MPa, there is clear evidence of forced interaction as well as weak free interactions. Based on these results it can be concluded that during a severe flow blockage accident scenario the dominant mode of interaction will be forced interaction.

Another experimental program, the Flow Blockage Channel Rupture Experiments (FBCR), assessed the minimum amount of melt mass required to fail a fuel channel at full system pressure. From these experiments, ~130 g of molten material was found to be sufficient to cause an early failure of the fuel channel at full system pressure and any molten material >300 g relocating to the pressure tube at pressures ≥8 MPa is likely to rupture the fuel channel within 2 s. The implication of this experimental evidence is that the melt masses used in the Molten Fuel/Moderator Interaction (MFMI) experiments were very conservative and thus the peak fuel coolant interaction pressure within the calandria vessel would be significantly less than the measured interaction pressures in the Molten Fuel/Moderator Interaction (MFMI)program.

The experimental results indicate that the magnitude of the damage and its likelihood are low. The planned sets of experiments have been completed to improve the confidence in the adequacy of understanding of molten fuel/metal interaction phenomena.

The successful Molten Fuel/Moderator Interaction (MFMI) experiments are expected to lead to the closure of this GAI in 2009.

117


R&D ReportsCOG-00-188 Molten Fuel Moderator Interaction Facility - Design Requirements Document.COG-00-254 Detailed Work Plan for Molten-Fuel Moderator-Interaction Experimental Program.COG-00-253 The Ejection of Molten Corium From a Pressure Tube Into a Dry Containment at Low Driving Pressures - TEST 1.COG-01-165 Proposed Design and Test Procedure to Eject up to 25 kg of Molten Corium from a Pressure Tube at 10 MPa Pressure into a Dry Tank.COG-02-2057 The Ejection of Molten Corium from a CANDU Pressure Tube into a Dry Containment - Test 2.COG-03-2009 The Steam-Driven Ejection of Molten Corium From A CANDU Pressure Tube Into A Dry Containment – Test 3.COG-03-2010 Proposed Design and Procedures for the 5 kg and 25 kg Corium Ejection Tests at Chalk River.COG-04-2015 The Summary of 5 kg Corium Commissioning Test Completed in the Molten-Fuel Moderator-Interaction Facility.COG-04-2016 Development of Alternate Success Methodology for MFMI Experiments.COG-05-2072 The Annual Progress Report of Molten Fuel Moderator Interaction Program -Fiscal Year 2004/2005.COG-05-2143 The Summary of Non-Corium Commissioning Tests Completed in the Molten Fuel Moderator Interaction Facility.COG-05-2008 The Summary of the First 25-kg Corium test completed in the Molten-Fuel Moderator-Interaction Facility.COG-06-2022 The Summary of the Second 25 kg Corium Test Completed in the Molten-Fuel Moderator-Interaction Facility.COG-07-2031 An assessment of molten fuel moderator interaction phenomenon following single channel events.

Work ProgramsWP21301 Development Work on Molten Core Injection by Argonne labs.WP21302 Molten Fuel Moderator Interaction Experiments.WP21303 Fuel Channel Failure Mechanisms under Severe Flow Blockage Conditions.WP21304 Independent Review of the MFMI Experimental Facility.WP21305 Development of Alternate Success Methodology for MFMI Experiments.

118


WP21306 Expert Review of Alternate Success Methodology for MFMI Experiments Report.

Working GroupsFuel and Fuel Channels Working Group (Sponsored by Safety and Licensing R&D Technical Committee).

References:

[1] IAEA-TECDOC-1554: Generic Safety Issues for Nuclear Power Plants with Pressurized Heavy Water Reactors and Measures for their Resolution, International Atomic Energy Agency, June 2007.

[2] RTD-07-69: Development of Risk-Informed Regulatory Positions for CANDU Safety Issues: Risk Significance of Category 3 Safety Issues, Assessment Report prepared by CNSC, September 2007.

[3] INFO-0770: Annual CNSC Staff Report for 2007 on the Safety Performance of the Canadian Nuclear Power Industry, Canadian Nuclear Safety Commission, August 2007.

[4] T. Nitheanandan, G. Kyle, R. O’Connor R. and D.B. Sanderson; “Molten Fuel Moderator Interaction Program at Chalk River Laboratories”, Chalk River Laboratories, Atomic Energy of Canada Limited, Chalk River, Ontario, 2006.

[5] D.B. Sanderson et.al.: “Molten Fuel Moderator Interaction Experiments Relevant to CANDU Reactor Systems: Preliminary Design of an Experimental Facility”, AECL Report TTR-693, Rev. 1, January 2000.

[6] Letter, V.G. Snell to P.H. Wigfull: “Resolution of Generic Action Item GAI 95G01: Molten Fuel Moderator Interaction”; March 2, 2000; CNSC File # 26-1-0-0-0.

[7] Letter, P.H. Wigfull to V.G. Snell:“Resolution of Generic Action Item (GAI) 95G01”;March 14, 2000; CNSC File # 26-1-0-0-0; 26-6-10192-0; 26-6-11947-0.

119

RIDM Issue Definition PF 18 - Fuel Behaviour under Post dryout Conditions.

Issue ID : PF 18

Title Fuel Bundle/Element Behaviour under Post-dryout ConditionsBackground Information Provide general information related to the issue.

• Historical background.• How has it been identified?• Relationship to other RIDM Issues and/or Technical Areas.

Fuel and fuel bundle deformation under post-dryout heat transfer regime, i.e., between dryout and higher temperatures of up to around 1000°C, is not adequately modelled in safety analysis. There exists no validated model for fuel bundle deformation. Some aspects of fuel element deformation are modelled using the code ELOCA-IST, which is also used by the Industry to predict fuel sheath failure. The TUF and CATHENA codes do not have thermal-hydraulic models accounting for subchannel variations, and there is no feedback between thermal-hydraulics and fuel bundle deformation behaviour. As well, fully prototypical in-reactor tests studying fuel bundle deformation do not exist for the accident conditions covered under G-144.

Concerns during post-dryout operation of fuel arise from:

1. Fuel cooling deterioration leading to fuel element and fuel bundle deformation that could aggravate the fuel cooling deterioration;2. Potential for pressure tube rupture as a result of severe fuel bundle deformation in which hot outer ring elements contact the pressure tube.

Existing safety analysis predictions of no fuel failure or no pressure tube failure lack confidence, since the models do not account for fuel bundle deformation that could affect heat transfer from fuel elements or cause fuel-element/pressure-tube contact that might lead to consequential pressure tube rupture or for feedback between thermal-hydraulics and fuel bundle behaviour.

For those design basis events covered under R-8 (and G-144), the following acceptance criteria apply:

• No fuel failure (with the exception of those breaks at or above the header);• No fuel channel failure.

The design basis events include Loss of Flow, Small Loss of Coolant Accident (LOCA), Loss of Reactivity Control, secondary side events, etc. The above criteria do not apply to the fuel/channel in the initiating channel for single channel events, e.g., feeder flow blockage, end-fitting ejection.

120


G-144, a regulatory document used by CNSC to assess Licensee safety analysis submissions for compliance with Regulatory Document R-8, imposes two separate derived trip effectiveness criteria for each shutdown system: a defence in depth criterion (i.e., trip before dryout for the primary trip), and acceptable margin to deformation leading to Pressure Tube (PT) failure (600°C fuel sheath temperature and 60 sec post-dryout operation for the back-up trip).

Issue Description

Provide a description of the issue: • What is the problem?

The knowledge base for post-dryout fuel, fuel bundle and pressure tube behaviour, in support of the current safety case may be inadequate.


Accident conditions covered under G-144. These generally involve high Heat Transport System (HTS) pressure, relatively high channel flows and relatively mild temperature.

• What is the frequency of the event(s) affected by the issue?

Relatively high such that most of the events considered here are Anticipated Operational Occurence (AOO)’s under RD-310 event categorization.

• What are the consequences of the issue? The best estimate consequences should be considered. Consequences based on more conservative approaches are also presented to allow the assessment of the safety margins.

Lack of models (fuel bundle deformation) or lack of rigour/confidence in the models (fuel element behaviour) causes lack of confidence in safety analysis predictions that there is no fuel element or fuel channel failure. Licensees have traditionally used a conservative Limit of Operation Envelope (LOE) methodology. Some better estimate models are reported in the Darlington Safety Report, which show improved results, i.e., larger margins. A statistically-based best-estimate model is under development by OPG and BP, which will demonstrate larger margins. G-144 acceptance criterion for the first trip is sufficient but not necessary for fuel or fuel channel integrity. This criterion may be difficult to meet especially using Limit of Operation Envelope (LOE) methodology and aged reactor conditions.

Fuel element failure would lead to loss of a barrier to fission product release from containment. This would not necessarily lead to fission product release to containment if Heat Transport System (HTS) remains intact. The importance of fuel

121


failure depends whether the Heat Transport System (HTS) is breached due to initiating event itself (such as small break Loss of Coolant Accident (LOCA)) or whether it also results in consequential fuel channel failure.

Consequential pressure tube failure may lead to loss of a barrier to fission product release (if not already breached due to the initiating event), lead to severe core damage and loss of coolable geometry. Maintenance of a coolable geometry is a fundamental safety principle.

• Is the issue directly related to a regulatory requirement (regulation, regulatory requirement, Operating Licence)?

Maintenance of fuel channel integrity is an explicit requirement for the events considered here in both the Regulatory documents and the Safety Reports. Maintenance of fuel sheath integrity is considered a requirement in the current regulations (e.g., R-8), but not in some Safety Reports.

• What is the analysis methodology related to the issue?

Generally the conservative Limit of Operation Envelope (LOE) methodology is used. A statistically-based best-estimate methodology, using the same codes and models, is under development to demonstrate larger margins.

• Under which plant operating states is the issue relevant?

Shutdown and normal power operation

• Which risk matrices are applicable?

Radiological Risk to the public at Design Basis Accidents (DBA)Severe accidentsNegative Impact on Safety

Knowledge Base





A large amount of experimental data on CHF and post-dryout temperatures, and drypatch spreading has been previously obtained with single-element test section, 28-

122


element and 37-element bundles at BWR and Pressurized Heavy Water Reactor (PHWR) conditions. These tests covered reference geometric configuration and abnormal configuration including a deformed element bowed toward the pressure tube. At high pressure, high flow and low quality conditions (typical Pressurized Heavy Water Reactor (PHWR) conditions for Loss of Flow, Small Break Loss of Coolant Accident (LOCA), and Loss of Reactivity Control), element bowing affects mainly the localized CHF (Channel Heat Flow??) at the bowed element but in general has relatively little impact on bundle dryout power. A reduction of about 10% in dryout power has been observed when an outer-ring element of the 37-element bundle was bowed toward the flow tube. An increase in dryout power from the minimum value has been observed as the bowed element further approached the flow tube (i.e., gap size between bowed element and flow tube approaching zero). This is attributed to the cooling effect as the bowed element contacted the liquid film at the flow tube.

The circumferential location of peak post-dryout temperature has been observed mostly at the gap between elements in the same ring or at the subchannel for reference geometric configuration. It shifted to the gap between the bowed element and the flow tube as the gap size reduced. The current post-dryout correlation has been shown to over predict the sheath temperature in actual bowed fuel element because the conjugation heat transfer (i.e., conduction heat transfer through the fuel from the high temperature location to low temperature location of the element) is small in the hollow fuel-element simulator. Accounting for the conjugation heat transfer would reduce the temperature gradient between the two opposing surfaces in the bowed element reducing the risk of further aggravating the bow.

The effect of element bowing on CHF and post-dryout heat transfer appears to be stronger at BWR normal reactor operating conditions than Pressurized Heavy Water Reactor (PHWR) normal reactor operating conditions. The difference is attributed to the change in flow conditions (i.e., lower pressure, lower mass flux, and higher quality for the BWR than Pressurized Heavy Water Reactor (PHWR)). Therefore, the effect may be more noticeable for SBLOCA than Loss of Regulation (LOR)C in Pressurized Heavy Water Reactor (PHWR).

All previous experiments were performed with the bundle simulators (reference and bowed element configurations) installed inside the reference (or uncrept) flow tube. Experiment data for a bowed-element bundle inside crept channels are unavailable.


Leung, L.K.H., Rudzinski, K.F. and Sutradhar, S.C., (2003), “Critical Heat Flux and

123


Post-Dryout Heat Transfer in 37-Element and CANFLEX Mk-IV Bundles (A State-of-the-Art Report)”, AECL Report Submitted to the CANDU Owners Group, COG-01-194 (also FFC-FCT-404).

Groeneveld, D.C., Joober, K.;Leung, L.K.H.;Doerffer, S.;Rudzinski, K.F.;Wong, W., (1992), “Effect Of Flow Geometry On Critical Heat Flux: Phase I: Observed Effects And Preliminary Prediction Method For Subchannels”, COG-91-286.

Rudzinski, K.F.;Snoek, C.W., (1989), “Review Of The Recent Test Done On The Pressure Tube - Bowed Fuel Element Test Section And Proposal For Test Section Modification”, COG-88-87.

Rudzinski, K.F., (1992), “Effect Of Element To Pressure-Tube Gap On CHF And Heat Transfer: Review Of Relevant Literature”, COG-91-120.

Groeneveld, D.C.;Huang, X.C.;Sutradhar, S.C. (1997), “A Method To Predict CHF And PDO Temperature Distribution On A Bowed Element” COG-95-390.


Ongoing COG S&L R&D Work Packages:

WP-20943 – “State-Of-The-Art Report on the Impact of Bundle and Bundle-Component Geometry Variation on Critical Heat-Flux and Post-Dryout Heat Transfer in 28-Element and 37-Element Bundles”.

WP-21022 – “Feasibility Study for In-Reactor Tests to Assess the Impact of Dryout on Bundles in Loss of Flow (LOF) and ROP/NOP Scenarios”.

WP-21430 – “Assessment of the ASSERT Prediction Capability for Deformed CANDU Fuel Bundles”.

WP 20306 Fuel Bundle Behaviour Experiments.

WP 20324 Fuel Pin Rigidity Model in Support of Bundle Deformation Models.

WP 20943 State-Of-The-Art Report on the Impact of Bundle and Bundle-Component Geometry Variation on Critical Heat-Flux and Post-Dryout Heat Transfer in 28-Element and 37-Element Bundles.

WP 22224 Assess and document Stern Lab Element Bow Tests.

WP 22225 Assess Different Tools for Bundle Deformation Simulations Under NOC.

Proposed Work Packages for COG 2009/10 fiscal year:

TH2 Acceptance Criteria for Compliance with Reg Doc R-8: PIRT Panel.

TH15 Development of Databases on CHF and PDO Heat Transfer for Element Bowing in Annuli and Bundles.

124


F&FC1 Development of Methodology for Bundle Deformation Simulations under Post-Dryout Conditions.

F&FC5 Fuel Element to Pressure Tube Contact Heat Transfer Experiments.

125

RIDM Issue Definition PF 19 - Impact of Ageing on Safe Plant Operation.

Issue ID : PF 19

Title Impact of Ageing on Safe Plant Operation.


Safety-related functions in nuclear power plants must remain effective throughout the life of the plant. Licensees are expected to have a programme in place to prevent, detect and correct significant degradation in the effectiveness of important safety-related functions.

Plant ageing affects several systems in a variety of ways. In contrast, to concerns regarding the analytical tools, this particular concern is related directly to the adverse impact of ageing of safety related instrumentation on the shutdown system effectiveness.

The shutdown systems rely on the measurements taken from these instruments. Specially, the trip computer makes trip / no-trip decisions based on these measurements.


Operating experience has shown that ineffective control of the ageing degradation of the major NPPs components (e.g. caused by unanticipated phenomena and by operating, maintenance, design or manufacturing errors) can jeopardize plant safety and also plant life. From the safety perspective, this means that Licensees have to control within acceptable limits the ageing degradation and wear out of plant components important to safety so that adequate safety margins remain, i.e. integrity and functional capability in excess of normal operating requirements.

This issue is related to the issues GL 3 Ageing of Equipment and Structures, PF 20 Analysis Methodology for Neutron Overpower Protection / Regional Overpower Protection (aspects related to ageing), CI 1 Fuel Channel Integrity and Effect on Core Internals (aspects related to ageing) and CI 2 Deterioration of Core Internals. There is also some relationship with PF 18 Fuel Bundle/Element Behaviour under Post-Dryout Conditions. For clarity all these issues are dealt with separately.

Issue Description



Plant ageing related issues are varied and complex and there are several issues

126


associated with the impact of plant ageing. One such issue is the adverse impact of plant ageing on safety and safety related systems to prevent or mitigate accidents. In particular, the concern is whether all the plant ageing mechanisms are identified and their impact are determined, addressed in an integrated manner and adequately accounted for in the shutdown system trip parameter setpoint adjustments.

Therefore, the above concerns are related to the adequacy of monitoring, collecting and analysing data from the ageing parameters to verify that the assumptions and requirements from safety analysis are modified and analyzed. If the SOE must be modified adequate guidance to help to translate those modifications into operational documentation should be available.




The issue is that there is a concern that existing ageing management programs do not include a complete assessment of all the implications of plant ageing on the safe operating envelop. Therefore the primary risk area related to this issue is “Negative Impact on Safety”. Licensees need to make sure that ageing effects are taken into account when establishing appropriate operating limits and conditions.




In principle all the events could be affected by this issue. Due to the very nature of Neutron Overpower Protection / Regional Overpower Protection trips measuring neutron flux as a measure of reactor power, it is one of the first design basis events (slow loss of reactivity control) that would be affected the most and directly. There are other Design Basis Accidents (DBA)s that are affected by the ageing of the plants, such Loss of Flow (LOF), Electrical Failures, Small Loss of Coolant Accident (LOCA), Slow Loss of Regulation (SLOR), Fast Loss of Regulation (FLOR). The impact of ageing on these events is mainly related to the potential changes on critical channel power. The impact of ageing on the behaviour of fuel channels following high temperature/pressure fuel channel transients also has to be taken into account.

The instruments that are prone to ageing are flow orifices, RTDs, NOP detectors, pressure transducer impulse lines, etc. It should be noted that some instruments need

127


to be calibrated for the intended range of operation. However, instruments such as orifices cannot be re-calibrated because it is not possible to take them out of the PHTS. Although there are other means to confirm the measurements of some instruments (such as ultrasonic flow measurements), these are taken at steady state, normal operating conditions and not under the conditions of accidents. The safety system still relies on the aged instruments to perform as designed under accident conditions.



1. An assessment of design margins, taking into account all known ageing and wear mechanisms and potential degradation in normal operation, including the effects of testing and maintenance processes; and

2. Provisions for monitoring, testing, sampling, and inspecting SSCs to assess ageing mechanisms, verify predictions, and identify unanticipated behaviours or degradation that may occur during operation as a result of ageing and wear.

It is also acknowledged that the CNSC is currently preparing an RD document on the management of ageing.

Knowledge Base







Hydro Quebec was requested to look into the impact of ageing on all the other Design Basis Accidents (DBA)s after they complete an elaborate program for the Regional Overpower Protection (ROP) event (a slow loss of reactivity control). Following the Regional Overpower Protection (ROP) Design Basis Accidents (DBA) assessment, Hydro Quebec plans to update their safety analysis for the impact of ageing on other postulated events, e.g. electrical failures.

Point Lepreau has looked into ageing in detail and relatively close during the integrated safety review conducted for the PLGS refurbishment (Safety Factor: Management of Ageing).

128


Bruce Power (BP) recognizes that Heat Transport System (HTS) ageing can affect safety margins before end of plant life. BP explicitly addresses ageing through compliance processes, such as corrections to detector calibration factor to address high reactor inlet temperatures, and through physical plant changes, such as SG (Steam Generator) ID clean, SG chemical cleaning, and SG pressure set point reduction. BP had a meeting on Heat Transport System (HTS) ageing with the CNSC (on September 26, 2008) to informally present the various activities currently underway in support of Heat Transport System (HTS) ageing for both the Bruce A and B stations. BP informed the CNSC that a formal submission will be made in December 2009 to document all the analyses performed in this area and that all analyses addressing ageing (NOP, Loss of Flow (LOF), SBLOCA) will be included in the Analysis of Record and incorporated in the SR by 2011/2012.

The Safety Report update initiative in which all the Licensees are involved also explicitly considers the effect of ageing on the shutdown system effectiveness.

Several industry efforts are underway, through Canadian Owner Group ( COG), that will input to Heat Transport System (HTS) ageing management, such as revision of the post-dryout (PDO) methodology to better reflect experimental data (including data representative of aged Heat Transport System (HTS) conditions). The revised PDO methodology will be adopted as an industry tool and utilized in upcoming analyses, in particular to assess fuel and fuel sheath temperatures where required to meet the safety analysis acceptance criteria and assess the extent to which expectations in G-144 are met. Another initiative is examination of fuel bundle deformation under high temperature conditions.

Finally, the impact of ageing on reactor physics has been assessed in the last few years through Canadian Owner Group ( COG) programs. A list of the reports and activities related to the impact of core ageing on reactor physics is provided below.

Report

COG-02-2014 Estimate of the Influence of Bundle Eccentricity on the Coolant-Density, Coolant Temperature, and Fuel-Temperature Reactivity Effects for a Crept Pressure Tube, using WIMS-IST.COG-02-2125 Effect of Pressure-Tube Elongation on the Physics of CANDU Reactors.COG-03-2048 Effect of Core Ageing on Reactivity-Device Properties.OP-03-2049 Summary of Workshop on the Reactor Physics Effects of CANDU Core Ageing.TN-03-2013 MCNP Assessment of Reactor Physics Effects Related to Core Ageing.COG-06-2040 MCNP Investigation of Core-Ageing Reactor Physics Effects.

Work ProgramsWP 22420 Reactor Physics Effects of Core Ageing.

129


WP 22421 Treatment of Channel Ageing in RFSP.

Working GroupReactor Physics Working Group (Sponsored by Safety and Licensing R&D Technical Committee).

References:







130

RIDM Issue Definition PF 20 Analysis Methodology for NOP / ROP

Issue ID : PF 20

Title Analysis Methodology for Neutron Overpower Protection / Regional Overpower Protection

Background Information Provide general information related to the issue.

The Regional Overpower Protection, also referred to as Neutron Overpower Protection, (Neutron/Regional Overpower Protection (NOP/ROP)) trip setpoint function is to provide the reactor trip for loss of regulation accidents prior to fuel dryout. The trip setpoint confidence level is designed to prevent any potential fuel damage, primarily for slow loss of regulation events.


Issues have been raised by CNSC staff in association with the NOP/ROP analysis methodology and its assumptions. In the COG report COG-04-9008, these are being currently addressed by the Industry in the context of the development of the new (improved) NOP/ROP analysis method. Both the original and new methodologies address Heat Transport System (HTS) ageing issues; the new method provides additional margins and uses advanced statistical calculation. The new method is under review by the Independent Technical Panel actioned by CNSC. Continued effort is needed to identify the appropriate Neutron Overpower Protection (NOP)trip setpoint methodology such that the confidence level in preventing dryout ensures that the likelihood of consequential fuel channel failure is negligible.

There have been considerable discussions in the past with CNSC on the ROP/NOP methodology. The CNSC initiated Research Program R122-1 with the objective of reviewing the ROP/NOP analysis methodologies in use by the Canadian Nuclear Industry, to examine the applicability of the Code Scaling Applicability and Uncertainty (CSAU) methodology as an alternative to the existing statistical methodology. Although the CNSC report [9.3] does not advocate the use of the CSAU methodology in CANDU Neutron Overpower Protection (NOP)analysis, several areas were raised during the review by the CNSC that required further study or improvement by the CANDU utilities. The report also mentions that there are some conservatisms in the old methodology. Some of these issues have been identified in station-specific Action Items.

This issue is related to the issues GL 3 Ageing of Equipment and Structures and PF 19 Impact of Ageing on Safe Plant Operation. The issues related to ageing that specifically affect Neutron/Regional Overpower Protection (NOP/ROP) are covered under PF 20.

131


Issue Description


• What is the problem?The general issue is that, due to concerns on new NOP/ROP methodology, the confidence level in preventing fuel dryout following a slow loss of regulation may be eroded. Detailed issues are (irrespective of importance):

Completeness of selected core states/flux shapes set: ROP/NOP system design is based on information derived from simulations of certain reference and perturbed flux shapes in the reactor core. Trip setpoints are established from these simulations to prevent any channel reaching its critical power limit in case of a bulk loss of regulation. One key component in the analysis is the relationship between flux values at detector locations and channel powers for various flux shapes. The analyses assume that the ratios of changes in fluxes and channel powers due to perturbation, called simulation ratios, are invariant with respect to the reference flux shape; this assumption is based on the superposition principle. On this basis a limited number of combinations of credible perturbed flux shapes and an untilted reference flux shape are analysed to derive trip setpoint values. Furthermore, these trip setpoint values provide coverage for different plant states. Differences in the reference flux shape used in the analyses and actual flux shapes are accounted for by regular detector calibration. There are limits on acceptable flux tilt limits such that the existing analysis is applicable to initial tilted states.

Statistical treatment of uncertainty categories (true value and simulation) Assessment of the impact on NOP/ROP analysis of not including the

xenon free effects due to refueling - fresh fuel, initially, has no xenon causing changes in local Neutron Overpower Protection (NOP)detector readings, temporary changes in the axial flux distribution, and changes in the instantaneous channel power distribution. All these affect the trip setpoint.

Channel and detector uncertainties and their impact on the NOP/ROP analysis.

Improved basis for abnormal NOP/ROP handswitch setpoints. Quasi steady-state Neutron Overpower Protection (NOP)analysis method

may not be realistic for some core states (especially for slow Loss of Regulation (LOR)s) because it does not capture the impact of the void feedback on flux shape or Neutron Overpower Protection (NOP)detectors response (the current BP/OPG position is that the existing slow Loss of Regulation (LOR) method is conservative due to the assumption that the neutronic and thermal power lag is neglected). A realistic, dynamic study of a Loss of Regulation (LOR) transient has been provided as part of 2005 submission.

132


Impact of ageing on NOP/ROP analysis. o Point Lepreau and Gentilly-2 have dealt with the plant ageing and

its impact on the Regional Overpower Protection (ROP) trip coverage.

o OPG/BP have developed advanced and detailed uncertainty assessment methodology. Neutron Overpower Protection (NOP)analysis was the first instance of incorporating Heat Transport System (HTS) ageing effects into safety analysis in an integrated manner with Bruce B Neutron Overpower Protection (NOP)analysis submitted to the CNSC in 2005. CNSC is in the process of reviewing the Bruce Power/OPG Neutron Overpower Protection (NOP)analysis and the associated methodology through an Independent Expert Panel. CNSC has requested Bruce Power to participate in the conduct of the Independent Expert Panel.




An inadequate Neutron/Regional Overpower Protection (NOP/ROP) trip may lead to fuel failures or fuel bundle deformation in LORA, affecting margins to fuel channel failures prior to reactor shutdown on other trips.

Since the new methodology is currently under review by the CNSC, the issue is that there are uncertainties in the new methodology that could lead to the eroded trip effectiveness. Therefore the primary risk area related to this issue is “Negative Impact on Safety”. Nevertheless, considering that it is acknowledged that the analysis methodology also contains certain inherent conservative assumptions, it is considered that these uncertainties do not affect the other risk areas.

Finally, this issue is also relevant to power operation.


The issue affects the prediction of the consequences of slow loss of regulations.


There is no specific regulatory requirement directly related to the issue. The issue is nevertheless indirectly related to the requirements in the Siting Guide, R-8, C-6, RD-

133


310 and RD-337 that apply to design basis events.

Knowledge Base







The Special Shutdown System (SDS)1 and Special Shutdown System (SDS)2 ROP/NOP systems are intended to provide protection for any accident that causes an unacceptable increase in the power produced in the fuel. The design basis accident that has traditionally placed the most stringent requirement on the Neutron Overpower Protection (NOP)trip setpoint is the slow Loss of Regulation (LOR).

CNSC staff have raised concerns with a number of aspects of the methodology and assumptions used to establish NOP/ROP trip setpoints. In order to avoid unnecessary restrictions on NOP/ROP trip setpoints, and the potential for additional deratings as the plants age and margins decrease, a common approach should be established wherever possible to address the issues raised by the CNSC in a manner that avoids unnecessary conservatism.

The results of the methodology improvement initiative being jointly sponsored by OPG and BP were communicated to the CNSC in 2004, and Bruce Power submitted an Neutron Overpower Protection (NOP)analysis based on this methodology in 2005. OPG submitted an NOP analysis with the enhanced methodology for Darlington in mid-2006.

In parallel to these Utility initiatives, the Canadian industry formed an NOP/ROP Methodology Improvement task team in 2004, with the following objectives:

1. To achieve consistency in the industry approach, and to establish the industry position with the CNSC, particularly in addressing the NOP/ROP issues raised by the CNSC;

2. To achieve common NOP/ROP analysis methodology and consistent toolsets to perform Neutron/Regional Overpower Protection (NOP/ROP) trip setpoint calculations in the short term, to achieve a common toolset for inclusion in the Industry Standard Toolset (IST) in the long term;

3. To facilitate the collaborative effort on NOP/ROP-related Safety Issues and provide a means of communicating experience on both short and long term work; and

134


4. To identify opportunities to improve Neutron/Regional Overpower Protection (NOP/ROP) operating margins while ensuring safety margins

A Canadian Owner Group ( COG) report (COG-04-9008) has been prepared, documenting all known issues related to Neutron/Regional Overpower Protection (NOP/ROP). These issues have been or will be addressed by the industry team on NOP/ROP methodology. This report was submitted to the CNSC in July 2006 together with an industry roadmap linking the issues identified with utility specific plans. The industry team is also developing an Industry Principles and Guidelines document discussing the basis of NOP/ROP methodology.

During the course of its development and implementation, the enhanced Neutron Overpower Protection (NOP)methodology has been communicated to CNSC staff in several informal meetings and workshops. The intent of these meetings was to raise CNSC awareness of the ageing project and to present the enhancements made to the Neutron Overpower Protection (NOP)methodology. In parallel there has been extensive industry consultation, independent expert review (by experts in statistical analysis, NOP design and operation) and industry endorsement.

CNSC provided a high level response to the Bruce B Neutron Overpower Protection (NOP)submission in late 2005 mainly requesting additional information. BP responded to the CNSC comments and provided the requested information in mid-2006. The CNSC provided a further response in October 2006. CNSC has had similar communication with OPG.

In their letters, CNSC staff indicated that:� It is premature to address NOP issues and HT ageing with enhanced methodology

until the CNSC has accepted it;� It will take CNSC a significant period of time to review/accept the enhanced

methodology due to a number of outstanding concerns; and� The Licensee needs to provide CNSC with information on the estimated period of

adequacy of current installed NOP trip setpoints under the currently established design and licensing methodology when HT ageing, migration to modern reactor physics codes, and other specified issues are taken into account.

BP has provided some of the information requested by CNSC staff in the most recent October 2006 letter and is working with OPG to determine a path forward on some of the remaining items. BP and OPG continue to maintain its technical position that the NOP methodology enhancements represent defendable improvements to the historical statistical methodology that refines the statistical treatment of uncertainties while incorporating operational experience, and does not represent an entirely new methodology. BP and OPG maintain that the use of historical licensing analysis methodology is unsuitable for addressing Heat Transport System (HTS) ageing and other NOP issues and to do so would exert unwarranted downward pressure on NOP setpoints and reactor power.

135


OPG and BP held additional meetings and technical workshops with CNSC staff to advance regulatory understanding and acceptance of the enhanced NOP methodology and ageing analysis; concerns were raised on the appropriateness of using the new methodology to compensate for ageing. An Independent Technical Panel did a review of the new methodology. Furthermore, industry wide initiatives are underway with the goal of further standardizing the implementation of this methodology across the Canadian CANDU Industry, as it potentially provides a significant benefit to all parties. This industry common approach provides the best possible path for ensuring successful adoption of the methodology, and subsequently for ensuring long-term high power operation without de-rating.

Finally, the aspects of this issue that are related to ageing, are as much as possible, not included in this issue but are part of GL-03 “Ageing of Equipment and Structure”.

ReportCOG-04-9008 Neutron/Regional Overpower Protection Industry Issues List (Rev 1)

Work ProgramWP23009 NOP Trip Effectiveness Methodology

Working GroupNOP/ROP Methodology Working Group (Sponsored by COG Nuclear Safety Committee)

References:



3. P. Akhtar to P. Charlebois, “CNSC Project R122-1: Application of CSAU to CANDU Overpower Analysis” Ontario Power Generation File N-CORR-00531-02169, July 19, 2002.

4. Industry Team on NOP/ROP Methodology, “Neutron/Regional Overpower Protection Industry Issues List”, COG-04-9008R1, November 2005.

136

RIDM Issue Definition PSA 3 - Open design of the BOP - steam protection

Issue ID : PSA 3

Title Open Design of the Balance of Plant - Steam Protection


As have been shown in Bruce B PSA (BBRA) and Pickering B PSA (PBRA), high energy breaks like steam line break or feedwater line break lead to widespread damage to many systems which are not protected enough (no pressure retaining walls for instance) or simply open, as the turbine generators of all units are in the same hall.


This issue has recently been raised in the context of performing Probabilistic Risk Assessment (PRA)s for Bruce B and Pickering B stations. Nevertheless, the issue of protecting mitigating systems following secondary side breaks has been recognized in the mid 80s.

This issue is related to the issue IH 6 “Need for Systematic Assessment of High Energy Line Break Effects”. The issue PSA 3 focuses on secondary side breaks whereas the issue IH 6 addresses primary side breaks.

Issue Description



In Bruce A/B, Pickering B and Darlington, the steam line break and feedwater line breaks are the largest contributors to the Core Damage Frequency (CDF) and the Large Release Frequency (LRF). Safety Goals are met, but the results indicate a highly unbalanced design or conservatively simplified modelling. These results suggest that improvements should be considered; conversely, the model could be reviewed to determine if more realistic assumptions would reduce the contributions from those events.




A steam line break impacts the entire turbine hall and many electrical cabinets, and instrument air could fail; more detailed and realistic assessment could nevertheless show that even equipment that are not environmentally qualified could survive or be

137


recovered in ‘mild’ environments associated with such events. The turbine hall is an open design with very little steam protection. The installation of the Powerhouse Emergency Venting System (PEVS) in Bruce and Darlington, however, can help reduce the degree of harshness of steam conditions for small to intermediate steam line breaks (specially for locations far from steam line break) which can improve survival or potential recovery of exposed components in the powerhouse.

Licensees need to consider practicable measures to reduce the probability of consequential failures of support systems to control, cool, and contain (e.g., instrument air, electrical, Heating Ventilation Air Conditioning (HVAC)) and ensure adequate reliability of powerhouse venting to mitigate the consequences of a steam line break.

This is not an Environmental Qualification issue, as the electrical components cannot be fully qualified for steam conditions. Barriers (enclosures, shields) will be needed to protect electrical equipment. The existing provisions for steam protection are not considered as fully effective in the Licensees Probabilistic Safety Assessment (PSA)s.

This issue is considered to have potential impact on all risk areas.

Finally, this issue is mostly relevant at power operation. There could also be an impact on a shutdown unit from a steam line break in an operating unit.


This issue affects primarily secondary side breaks in the balance of plant.


The issue is related to the expectations in RD-337 that states that:

Severe Accidents

The design should be balanced such that no particular design feature or event makes a dominant contribution to the frequency of severe accidents, taking uncertainties into account.

Knowledge Base


138







Breaks outside the reactor building are considered in the design basis. The consequences of these breaks on equipment located in areas that are affected by the breaks were not originally systematically considered. In particular, the consequences on support systems, credited to mitigate the consequences of these events were not fully taken into account. As part of the licensing basis, deterministic analyses crediting only those equipments that are either environmentally qualified or adequately protected, have demonstrated acceptable risk.

BP has installed baffle walls in several parts of the turbine hall to protect electrical rooms, and other multi-units stations need to address the status of steam protection. At Pickering B, the essential equipment is located in the Reactor Auxiliary Bay (RAB) which is separated from the turbine hall by the H-wall. The H-wall has been tested for leak tightness and strength following a sudden pressure rise in the turbine hall. Darlington design relies more on steam protected rooms than any other plant; however, it has been found that the rooms were not properly sealed during construction. Hence, the Probabilistic Risk Assessment (PRA) models are expected to incorporate some factors to account for non-zero or non-unity probabilities in modelling.

This issue was also identified previously for the CANDU 6 design and design improvements have been implemented in the 90s. The Point Lepreau Probabilistic Safety Assessment (PSA) that has just been completed did not identify these breaks as dominant contributors to severe core damage or large releases.

One of the reasons that the Core Damage Frequency (CDF) and LRF frequencies are skewed to MSLB/FWLB is due to some of the inherent conservatisms built into the PSA models. Examples are:

1. Components/systems if not EQed, would fail for certain (failure rate =1) if exposed to harsh conditions (e.g. >50ºC and condensing environment). Following the Environmental Qualification (EQ) rules in such a restrictive manner is extremely conservative in the context of Probabilistic Safety Assessment (PSA). In reality, it is likely some of the systems would survive or can be recovered, especially if the surrounding conditions are only mildly harsh. In conjunction with (2) below, it is quite possible to claim a lower failure rate. It is possible that such claims may have to

139


be supported by R&D.

2. These models assumed global harsh conditions within the powerhouse regardless of break location and size. In reality, areas farther away from the break will be less affected by the breaks. For some breaks, it is quite possible that the conditions at some areas could be mild or mildly harsh. It is likely that the mitigation systems if located at such areas could survive or can be recovered following MSLB/FWLB.

If the mitigation functions are systematically considered in conjunction with (1) and (2) above, there is a good chance that a lower Core Damage Frequency (CDF) and LRF could be demonstrated. A common approach would help the Industry, particularly those with multi-unit design.

References:



140

RIDM Issue Definition SS 1 - ECC Sump Screen Adequacy

Issue ID : SS 1

Title ECC Sump Screen Adequacy


The containment is equipped with sumps to collect the water lost from the primary circuit after a Loss-of-Coolant-Accident (LOCA) in order to recirculate the water in the ECC recovery phase of the accident. The sumps are covered with a screen which is intended to prevent debris penetration to the suction of the Emergency Core Cooling System (ECCS) pumps.

The thermal insulation used inside the containment and the total area of the screen above the sump together with dust and dirt that occur in containments form a combination that raises safety concerns regarding the possibility of maintaining Emergency Core Cooling System (ECCS) circulation after a medium or large LOCA. Along with entrained debris components, the formation of secondary precipitates has the potential to impede the performance of Emergency Core Cooling System (ECCS) pumps or other components downstream of the sump strainer when Emergency Core Cooling System (ECCS) action is required.


Operational experience based on recent events in Sweden and in the USA has demonstrated that even a relatively small amount of similar fibres can effectively block a large portion of the screen area. Sump screens must be designed and installed to ensure that the screening function is maintained.

The issue as described in the IAEA TECDOC has been closed. However, a related Generic Safety Issue has been identified in US research into chemical effects in sump water (GSI-191, Assessment of [Effect of] Debris Accumulation on Pressurized-Water Reactor (PWR) Sump Performance). The CNSC raised Generic Action Item 06G01 “ECC Strainer Deposits” to address the concern.

Issue Description



A postulated Loss of Coolant Accident (LOCA) would dislodge significant quantities of insulation material (fibrous and particulate) which could potentially lead to partial blockage of the strainers and small debris may also

141


clog the plant’s downstream components located in the Emergency Core Cooling System (ECCS) and Containment Spray System (CSS) thereby impairing ECCS recirculation.

Break-up of thermal insulation around equipment and pipes inside the containment can, under Loss of Coolant Accident (LOCA) conditions, lead to an impairment of ECC recirculation by clogging the sump screens and/or the Emergency Core Cooling System (ECCS) heat exchangers.

The U.S. Integrated Chemical Effects Test (ICET) program has found that certain chemicals could cause a thin impervious layer to be formed on ECC strainers causing a large enough pressure drop that recovery pump Net Positive Suction Head (NPSH) requirements would not be met and ECC recirculation would be impaired.




The debris in the sump was considered to be generated in one of five ways – dislodgement of insulation and other material due to direct impingement by the jet of reactor coolant from the failed piping, transportation of pre-existing debris from on or near the floor in the flow path from the break discharge to the strainer, peeling of coatings from walls, floors or equipment, which could be carried by the flow of the condensate to the sump, or chemical effect leading to precipitation of dissolved materials over long term ECC recovery operation.

Affected downstream components may include: heat exchangers, orifices, containment spray nozzles, reactor internals and fuel assemblies (core flow).

The main concern is that even though there have been recent improvements made to CANDU ECC strainers and debris reduction programs these initiatives did not fully consider chemical effects in the building sumps. The primary risk area related to this issue is “Negative Impact on Safety”. The uncertainties on safety margins lead to impact on the other risk areas, mainly radiological risk to public at Design Basis Accidents (DBA) and severe accident risks.

Finally, this issue is mostly relevant to power operation.


142


The only events that may be significantly affected by the issue are Loss of Coolant Accident (LOCA)s, since they are the only events where Emergency Core Cooling System (ECCS) recirculation is credited.

The severity of Loss of Coolant Accident (LOCA) with consequential loss of recirculation (with or without containment failure) depends on the degree of strainer fouling, and the time at which Emergency Core Cooling System (ECCS) begins to be impaired.


The regulatory requirements that are the most directly affected by the issue are the requirements on the ECC system (R-9 and RD-337). More specifically, RD-337 states that:

“The ECCS recovery flow path is such that impediment to the recovery of coolant following a loss of coolant accident by debris or other material is avoided.”

The Generic Action Item GAI 06G01 states that Licensees are to evaluate the Integrated Chemical Effet Test (ICET) tests and demonstrate that CANDU ECC strainers are not vulnerable to deposits such as those identified in the Integrated Chemical Effet Test (ICET) and take additional actions if they can not show that this is the case.

Knowledge Base







Licensees have demonstrated that serious chemical effects that have been identified for other reactor designs do not occur with CANDU reactors. However the possibility of other chemical effects specific to CANDU could not be eliminated; and therefore there remains some uncertainty in assessing the likelihood of this impairment. To

143


address this risk, Licensees initiated a COG R&D program. This R&D program has provided sufficient information to estimate the risks to the public with a higher confidence and recommend design changes, if needed.

Licensees have submitted information giving confidence that the chemical environment in CANDU reactors does not include the features that led to possibly harmful deposits in additional Integrated Chemical Effects Tests (ICET). In particular, the ICET showed that addition of Tri-Sodium Phosphate (TSP) to the water in LWR sumps led to accelerated aluminium corrosion and the formation of deposits. CANDU reactors operating in Canada do not make use of TSP to raise sump pH after a Loss of Coolant Accident (LOCA). However, Licensees cannot completely exclude chemical effects under CANDU sump conditions. Therefore an experimental program was established to close this gap in knowledge. The experimental program provided the information required by Licensees to estimate the quantity of deposits expected from aluminium corrosion. The amount of deposit was then compared to the loading margin for the ECC strainer.

Three of the four Canadian utilities have demonstrated that sufficient strainer margin exists and have had GAI 06G01 closed by CNSC. The fourth utility is continuing to work on their assessment and expect that the results will be favourable.

An R&D program has been performed to assess the potential for paints and coatings to fail under post-LOCA conditions and thus become an additional source of debris. Canadian Owner Group ( COG) work indicated that debris generation was not an issue. Various Canadian Owner Group ( COG) activities are related to this issue:

ReportsCOG-06-9011: ECC Strainer Chemical Effects - Project Execution Plan October 2006.COG-06-4036: An Assessment of Possible Chemical Effects on ECC Strainer Performance under CANDU Post-LOCA Sump Water Conditions.COG-07-4046: Review of Physical Phenomena Important to ECC Recovery Operation.COG-06-4038: Aluminum Release and Precipitation under CANDU Post-LOCA Sump Water Conditions- Experiments and Modelling.

Work ProgramsWP 40408 “Additional Testing to Assess Performance of Paints & Coatings Outside ZOI under post-LOCA Conditions”.

Work GroupsIndustry Team on ECI Strainer Chemical Effects Issue.

144


These activities are currently all completed.

References:




4. NUREG-CR6912: GSI-191, PWR Sump Screen Blockage Chemical Effects Tests: Thermodynamic Simulations, U.S. Nuclear Regulatory Commission, December 2006.

5. NUREG-CR6874; GSI-191: Experimental Studies of Loss-of-Coolant-Accident-Generated Debris Accumulation and Head Loss with Emphasis on the Effects of Calcium Silicate Insulation, U.S. Nuclear Regulatory Commission, May 2005.

145

RIDM Issue Definition SS 5 - Hydrogen Control Measures during Accidents

Issue ID : SS 5

Title Hydrogen Control Measures during Accidents


Following a design basis accident event such as Loss of Coolant Accident (LOCA) or credible LOCA+LOECI, combustible gases, principally hydrogen, may accumulate inside the reactor containment. The hydrogen generation can lead to combustible gas mixtures. Inadvertent, random ignitions occurring in such a process may cause deflagrations, which may have some effects on the containment structures. Such effects may only occur in case of hydrogen concentrations greater than 4 % by volume in the containment atmosphere and without high steam content (steam-inerting).


The CNSC raised Generic Action Item GAI 88G02 “Hydrogen Behaviour in CANDU Nuclear Generating Stations” to address the concern of hydrogen control during accidents.

In the Commission Member Document (CMD) 99-121, CNSC staff expressed concerns about the completeness of the assessments of the transient hydrogen distributions induced by the short term hydrogen releases in containment. Detailed plans and schedules for resolution of all hydrogen safety related issues, including those related to the long term releases, were requested of the Licensees.

GAI 88G02 is closed by CNSC for all Licensees (see References [9.3, 9.3, 9.3 and 8]), and station-specific action items have been raised.

Issue Description



Hydrogen released in Pressurized Heavy Water Reactor (PHWR) Nuclear Generating Stations during certain accident sequences may produce flammable gas mixtures in some regions of containment. The mechanical and thermal loads generated by the ignition of these gas mixtures may challenge the integrity of the containment envelope, supporting internal walls and required safety-related equipment.

146





Insufficient hydrogen mitigation during accident scenarios may impair the containment or confinement function.

Generic Action item GAI 88G02 addresses the extent and depth of analysis concerning hydrogen mixing in containment and the capability of hydrogen mitigation systems. In the past, CNSC staff has indicated that more work was needed to reduce uncertainties related to: hydrogen concentration, standing flames, flame acceleration, flame propagation between compartments, and transition from deflagration to detonation. Therefore the primary risk area related to this issue is “Negative Impact on Safety”. The uncertainties on safety margins lead to impact on the other risk areas, mainly radiological risk to public at Design Basis Accidents (DBA) and severe accident risks.

Finally, this issue is mostly relevant to high power operation coincident with a Loss of Coolant Accident (LOCA) and impairments to ECC. The likelihood of impairment to containment function from hydrogen “slow burns” is extremely low.


The event associated with generation of hydrogen is the Loss of Coolant Accident (LOCA) and the credible dual-failure case of Loss of Coolant Accident (LOCA) and Loss of Emergency Coolant Injection (LOECI). Following a Loss of Coolant Accident (LOCA), combustible gases, principally hydrogen, may accumulate inside the reactor containment as a result of:

− The metal-water reaction involving the fuel element cladding;

− The radiolytic decomposition of the water in the reactor core and the containment sump;

− The corrosion of certain construction materials;

− Any synergistic chemical, thermal and radiolytic effects of post-accident environmental conditions on containment protective coatings and electric cable insulation.

Highly stylized sensitivity studies of post-blow-down steam flows through the core have indicated escalation of the hydrogen and radionuclide production for flows larger than zero but less than 100 g/s per channel. The dual failure events with critical steam flow in the channels are assessed to be of very low probability (with source

147


terms more representative of severe accident scenarios) and, as such, would be classified as beyond design basis under modern regulatory requirements such as RD-310 and RD-337.


GAI 88G02 requires implementation of adequate hydrogen mitigation for design basis accidents.

R-7, Requirements for Containment Systems for CANDU Nuclear Power Plants (applicable to reactors licensed for construction after January 1, 1981).

Knowledge base







As expressed in Reference 9.3, the CNSC was encouraged by the Industry’s progress on various aspects of GAI 88G02. The Industry and the CNSC then became aware of early field trials of Passive Autocatalytic Recombiners (PARs) at the Point Lepreau Generating Station, where there appeared to be some negative impact of the environment on the Passive Autocatalytic Recombiners (PARs) performance. The Industry task team met with CNSC staff on July 11 and 12, 2002, to discuss the early field results and various aspects of Passive Autocatalytic Recombiners (PARs) applications.

Since the July 2002 CNSC/Industry meeting, significant progress has been made in the assessment of hydrogen production, transport, and combustion in containment and in our understanding of Passive Autocatalytic Recombiners (PARs) behaviour (notably, the characteristic of an eventual delayed Passive Autocatalytic Recombiners (PARs) self-start under non-flammable conditions with degraded catalyst plates). The testing of Passive Autocatalytic Recombiners (PARs) plates from Pickering A Unit 4 has been completed, and various other Passive Autocatalytic Recombiners (PARs) testing has been conducted using plates exposed to other CANDU containment and

148


laboratory conditions (with results shared amongst domestic Canadian Owner Group ( COG) members). A consolidation report on the qualification testing of the AECL Passive Autocatalytic Recombiners (PARs) design has been published as Canadian Owner Group ( COG) report COG-00-217. A Passive Autocatalytic Recombiners (PARs) technical basis document has been published as COG report COG-03-2066 in which general requirements are described for Passive Autocatalytic Recombiners (PARs) implementation in CANDU stations. Long-term hydrogen mixing analyses have been performed for various stations, enabling a preliminary determination of the number and locations of Passive Autocatalytic Recombiners (PARs) in containment.

Knowledge of hydrogen phenomena has matured, culminating in the publication of various reports, including a state-of-the-art report on Flame Acceleration and Deflagration-to-Detonation Transition (COG report COG-00-246), a summary report on Gas Mixing (COG report COG-04-2069), and consolidation reports on Hydrogen Combustion (COG reports COG-00-244 and COG-00-215) and Diffusion Flames (COG report COG-00-245). In addition, a state-of-the-art report on (GAI 88G02) Hydrogen Behaviour in CANDU Reactor Accidents is being published by COG.

Based on the collection of information to date, there is a reasonably high level of confidence that Passive Autocatalytic Recombiners (PARs) are robust and would enhance the effectiveness of hydrogen mitigation as well as reduce the potential threat of hydrogen burns. Evaluations of the AECL Passive Autocatalytic Recombiners (PARs) performance with respect to effectiveness under post-accident containment conditions have been conducted, taking into account the delayed self-start characteristics of Passive Autocatalytic Recombiners (PARs) with potentially degraded catalyst plates.

The results to date from the industry testing of Passive Autocatalytic Recombiners (PARs) exposed to different CANDU stations and laboratory conditions are positive. There are limited station-specific data on Passive Autocatalytic Recombiners (PARs) at present, and therefore some uncertainty exists as to the timeliness of initial Passive Autocatalytic Recombiners (PARs) self-start. Consequently, one or a limited series of slow burns near the lower flammability limit of hydrogen may not be conclusively precluded for some station containment areas. Although the preclusion of deflagrations is not required per GAI 88G02, the likelihood of repeated slow burns is small, given the analysis over-conservatisms such as the predicted rate of radiolytic hydrogen production. Furthermore, no consequential impact is expected on the survivability of required safety-related equipment and containment integrity, if repeated slow burns do occur in containment. It is important to note that, when Passive Autocatalytic Recombiners (PARs) eventually self-start (whether promptly or by delay), they regenerate and return to an as-new state, thereafter capable of promptly self-starting under nonflammable conditions.

CNSC staff met with the Industry on July 13, 2007, to discuss the path forward for closure of GAI 88G02. The CNSC agreed in principle with the industry approach, which includes Passive Autocatalytic Recombiners (PARs) installations to address

149


design basis accidents.

In summary, although this has been a long-standing issue, the Industry has developed a sufficient understanding of hydrogen behaviour during accidents, and has developed technology to effectively manage both short- and long-term hydrogen production during accidents. As part of the basis for closure of GAI 88G02, Licensees have agreed to install Passive Autocatalytic Recombiners (PARs) to improve hydrogen control during accidents. The number and location of Passive Autocatalytic Recombiners (PARs) are to be determined based on practical considerations and engineering judgement supported by hydrogen mixing analyses to demonstrate sufficient coverage for design basis accidents, using source terms derived for credible Loss of Coolant Accident (LOCA) and LOECI design basis accident events.

As part of Pickering A restart, Ontario Power Generation (OPG) installed Passive Autocatalytic Recombiners (PARs) in Unit 4 on a trial basis, for testing purposes only, to address GAI 88G02. Bruce Power (BP) fulfilled a similar commitment for a trial at Bruce A. Passive Autocatalytic Recombiners (PARs) are included in the refurbishment scopes for Hydro Quebec (HQ), New Brunswick Power, and Bruce Power. OPG also proposed (and CNSC agreed with) a staged approach to Passive Autocatalytic Recombiners (PARs) installation at Darlington and Pickering A/B, subject to confirmation of PARs installation feasibility and maintainability and decisions around plant life extensions.

Based on detailed plans and proposals presented by the various Licensees to install PARs, GAI88G02 was closed in 2008.

References:



3. INFO-0770: Annual CNSC Staff Report for 2007 on the Safety Performance of the Canadian Nuclear Power Industry, published by CNSC, August 2008.

4. Letter, T.E. Schaubel and P.A. Webster to T.N. Mitchell, “Closure of GAI 88G02: Hydrogen Behaviour in Containment Darlington - New Action Item 20081308 ; Pickering A -New Action Item 2008-4-09 ; Pickering B -New Action Item 2008-8-09”, ;July 17, 2008, EDOCS #3267920 File 4.01.03.

150


5. Letter, K. Lafrenière to D. Parker, “Closure of GAI 88G02: Hydrogen Behaviour in Containment - Action Item 081214”, July 23, 2008, EDOCS #3248085 File 4.01.02.

6. Letter, P. Elder to F. Saunders, “Closure of GAI 88G02: Hydrogen Behaviour in Containment New Action Item 080714”, July, 10, 2008, E-DOCS#3258354, File 4.01.03.

7. CNSC letter, P.H. Wigfull to G. Preston, “GAI 88G02: Hydrogen Behaviour in Containment”, January 11, 2002, CD# N-CORR-00531-01895.

8. Lettre de la CCSN de F. Rinfret à N. Sawyer, “Fermeture du dossier générique 88G02, Comportement de l’hydrogène dans le confinement – Sujet 091002”, 5 février 2009.

151

RIDM Issue Definition AA 08 - Analysis for Moderator Temperature Predictions

Issue ID : AA 8

Title Analysis for Moderator Temperature Predictions

Background InformationProvide general information related to the issue.

� Historical background.In certain loss-of-coolant accidents (LOCA) events, the integrity of some fuel channels depends on the capability of the moderator to serve as a heat sink to cool down the PT/CT and arrest further deformation of the fuel channel until ECI water cools the channel. As fuel channels heat up, pressure tubes expand and some may contact their respective calandria tubes. Fuel channels where contact has occurred will likely fail if the outside of the calandria tubes is dried out for a sustained period of time. One of the important parameters that determine calandria tube dry-out is the degree of subcooling available in the moderator. An accurate prediction of moderator temperature distribution is therefore required to demonstrate fuel channel integrity under accident conditions.

An integral scaled 3-D Moderator Test Facility (MTF), having the key characteristics of a fullscale CANDU calandria vessel, was built at Chalk River Laboratories to investigate moderator behaviour. As part of code validation, three-dimensional fluid flow and temperature distributions within the MTF vessel are compared with the experimental data, which represent a range of moderator operating conditions. In the MTF tests, measured values of three-dimensional water temperature distribution in the MTF vessel are obtained for both steady state and transient conditions. In addition to integrated tests, separate effect, and component testing over a broad range of parameters relevant to reactor were conducted.

The Canadian Nuclear Industry has validated the MODTURC_CLAS-IST code as part of the Industry Standard Toolset. Code validation against experimental measurements has been completed and the Industry has requested closure of the Generic Action Item (GAI). In December 2003, a plan to complete the validation program for the code MODTURC_CLAS-IST, making use of the MTF tests, was presented to CNSC staff. While the early test program involved only OPG, and subsequently BP, HQ and NBP have, as of 2003, been participating in the activities of the validation program presented to CNSC staff by OPG. Key elements of both the testing and validation programs are now part of the COG R&D Programs.

In opening GAI 95G05, CNSC staff wanted the Licensees to obtain 3-D test data for code validation. Such data would be more representative of reactor conditions, and better suited for comprehensive code validation. CNSC staff also requested that test results be analyzed for any 3-D effects. Validation results were to be used to determine the uncertainty in code predictions.

CNSC staff requested HQ and NBP to identify any testing that may be needed in

152


addition to the planned OPG/BP tests, to represent CANDU-6 conditions. HQ and NBP provided information linking moderator flow conditions of the CANDU-6 to those of the OPG reactors. CNSC staff reviewed the information submitted, and concluded that CANDU-6 conditions would be adequately covered by the OPG tests planned to address OPG reactors. CNSC staff indicated that Licensees would, however, need to watch for the sensitivity of key test results to flow conditions in view of the small differences in Archimedes and Reynolds numbers that exist between the two reactor designs.

• How has it been identified?• Relationship to other RIDM Issues and/or Technical Areas.

The issue is related to AA3: Computer Codes and Plant Model Validation – Prediction of Pressure Tube Ballooning and SS 8: Availability of The Moderator as a Heat Sink.

Issue Description


• What is the problem?During some Loss of Coolant Accident (LOCA)s, the integrity of fuel channels depends on the capability of the moderator to temporarily provide cooling and arrest deformation of the Pressure Tube (PT) and CT until ECI flow is established. A channel will likely fail if sustained dry-out on the calandria tube surface occurs. Calculations done to show that pressure tube integrity will be maintained depend on several computer codes. CNSC staff believes that moderator temperatures predicted have not been adequately validated, given the tight safety margins that exist currently.


Insufficient moderator sub-cooling increases the likelihood of channel failure, following a Loss of Coolant Accident (LOCA), due to sustained calandria surface dryout.

• Which risk areas are affected

Considering that the issue is the accuracy of code prediction, the primary risk area is “Negative Impact on Safety”. Because the consequence of this issue is that the integrity of a significant number of pressure tubes can be lost, this has the potential to affect the “public dose” and “severe core damage” risk areas.


153


The issue is primarily relevant for power operation.


The only event for which the issue is relevant is Large Break Loss of Coolant Accident (LBLOCA).


To bring this generic action item to closure, the Licensees are required to carry out:

A 3-D integrated test program under simulated reactor conditions; test results are to be analyzed and the underlying phenomena identified; and

Code validation against the integral test data carried out in line with the expectations of GAI 98G02; pre-predictions should be carried out as part of code validation; validation results should be used to determine code uncertainties for reactor applications.

Knowledge Base


Moderator temperature predictions are required for accident sequences in which PT/CT contact is predicted. Specific events in safety analysis that can cause this are related to (i) Large Break Loss of Coolant Accident (LBLOCA) (pressure tube ballooning under high pressure channel conditions during the early phase of the transient), and (ii) subsequently, if ECC fails, due to bundle and channel deformation at low pressure. It is required to show that channel integrity will be maintained for such conditions.




Tests at the 3-D Moderator Test Facility have been successfully completed. The test program has produced a large amount of high quality data. The tests reproduce the expected and observed moderator behaviour in the reactor as well as the local

154


temperature fluctuations arising from the delicate balance of forced and buoyancy-induced flow. Data analysis for the entire set of steady state integrated tests has been performed, including extensive statistical analysis. No unexpected phenomena were uncovered and the tests provided significant insight into moderator flow behaviour. The separate effects tests helped to significantly improve the understanding of key components, resulting in a number of modelling improvements (e.g., in the behaviour at the nozzle inlets).

Significant validation work has already been completed. The MODTURC CLAS validation results have been acceptable, with no adverse impacts on the reactor safety case. Reactor moderator temperature measurements at Bruce A and Pickering B have also been used for code validation. The Industry has completed all the remaining validation exercises under COG programs.

Generic Action Item (GAI) closure request was made in January 2006 and CNSC reply was received in November 2007. Further industry response to CNSC comments was submitted in September 2008. Closure of this Generic Action Item (GAI) is expected in 2009.


Code accuracy has been quantified and the Validation and Tool Qualification Manual submitted to the CNSC as part of the Closure Request. Some confirmatory R&D activities are under way as planned.


R&D ReportsISTO-06-5051 R00, “Validation Exercise Report for MODTURC_CLAS-IST - Inlet Diffuser Flow Modeling Based on ½-Scale Diffuser Measurements, October 2006.

ISTO-07-5043 R00, “Methodology Description for MODTURC_CLAS Modeling of Calandria Flow with Inlet Diffusers Modeled, August 2007.

ISTO-08-5115, “GAI95G05: Moderator Temperature Predictions – Response to CNSC Review Comments” was issued in September 2008.

Work Programs20212 Analysis of Fuel Element / Pressure Tube Contact Conductance Experiments.

20213 Application of the New Moderator Subcooling Methodology to Moderator Temperature Fluctuations.

155


20223 Impact of Pressure Tube and Calandria Tube Contact on the Moderator Subcooling of Fuel Channels at a Higher Elevation.

20224 High Temperature Measurement Techniques.

20225 Analysis of Rewet and Boiling Experimental Data.

20226 Analysis of Pressure Tube Flaw Tests.

20227 Improvement of the New Moderator Subcooling Methodology.

20228 A Bibliography of Publications on High-Temperature Fuel-Channel Research.

Working GroupsIndustry Team GAI 95G05 (Sponsored by COG Nuclear Safety Committee).

References:




156

RIDM Issue Definition AA 09 - Analysis for Void Reactivity Coefficient

Issue ID : AA 09Title Analysis for Void Reactivity CoefficientBackground InformationProvide general information related to the issue.

� Historical background.The POWDERPUFS code was traditionally used by the Canadian Nuclear Industry for generating lattice parameters for use in fuel management (core follow) calculations. The code was also used to undertake accident analysis. Early validation experiments performed in ZED-2 indicated that POWDERPUFS underestimated the full-core Coolant Void Reactivity (CVR) by approximately 1.4 mk. Further experimental evidence lead to increase to the POWEDERPUFS-V underestimate to 5.4mk (1999).

This so-called Void Reactivity Error Allowance (VREA) was accounted for in safety analysis by suitably adjusting the Coolant Void Reactivity (CVR) predicted by POWDERPUFS. The value of VREA described above was based on a relatively limited number of experiments undertaken with unirradiated fuel in the 1970’s. In the early 1990’s, the CNSC began to question the application of a Void Reactivity Error Allowance (VREA) which was based on limited testing in fresh fuel. Both the CNSC and the Industry concurred that a more comprehensive understanding of Void Reactivity Error Allowance (VREA) over a broader range of conditions and, in particular, for mid-burnup fuel, was needed.

The need for more comprehensive information, including an understanding of the uncertainties in Coolant Void Reactivity (CVR) and their effect in safety analysis, became even more apparent with the discovery of Fuel String Relocation Reactivity (FSRR) IN 1993. FSSR is a phenomenon resulting from the relocation of the fuel string towards the upstream end of the fuel channels during a Loss of Coolant Accident (LOCA) in a reactor which is fuelled against the flow (e.g., Bruce and Darlington). The phenomenon of FSSR led to the deratings of the Bruce Reactors followed by an extended period during which significant changes to the design of the reactor cores and supporting re-analyses were undertaken8. In response to these concerns, a multi-year experimental program was launched by the Industry aimed at improving the state of knowledge concerning the magnitude of the Coolant Void Reactivity (CVR) at mid-burnup conditions and to address the

8 The Bruce A reactors were converted to Fuelling-With-Flow through a design change involving the reorienting the fuel bundles in the channels, changes to the fuel handling systems, and extensive supporting safety analysis. The initial solution at Bruce B was to use a combination of long and regular length fuel bundles to reduce the average size of the axial gap. This had the added advantage of addressing the issue of pressure tube fretting by repositioning the 13th bundle away from the rolled joint burnish mark. However, the need to reduce the length of the average axial gap length led to concerns associated with the potential for constrained thermal expansion of the fuel string in the event of a LBLOCA. This led to a complex “gap management” system to ensure compliance with FSSR and minimum gap limits. However, it was subsequently decided that the Bruce B reactors would also be converted to fuelling with flow, and efforts to do so continue today.

The Darlington reactors continue to rely on gap management to control FSSR and margin to constraint.157


residual code validation issues associated with the use of POWDERPUFS for Coolant Void Reactivity (CVR) predictions in accident analysis. The CNSC opened Generic Action Item 95G04 to track this issue.

While there has been very significant progress made by the Canadian Nuclear Industry in the qualification and understanding of reactor physics codes, particularly as they pertain to reactivity feedback effects and reactor kinetics parameters, some gaps still remain.

• How has it been identified?

The Industry has retired the original reactor physics computer codes and replaced them with more adequate Industry Standard Toolset (IST) codes. The objective of the industry void reactivity program has also been shifted to validation of the new reactor physics toolset, especially of the lattice cell code and nuclear data library. Other key physics parameters -- such as delayed neutron fraction, neutron lifetime, and fuel temperature reactivity effect -- have also been reassessed under industry void reactivity program.

Comparison of results from the Industry Standard Toolset (IST) codes against original predictions indicates that:

The full core void reactivity has increased; The delayed neutron fraction has decreased; The neutron lifetime has decreased slightly; The fuel temperature reactivity effect has gone from slightly negative to

slightly positive; and The power coefficient of reactivity has gone from approximately zero to

slightly positive.

• Relationship to other RIDM Issues and/or Technical Areas

Any Risk Control Measure (RCM) that resulted in a significant reduction in coolant voiding and Coolant Void Reactivity (CVR) would reduce or eliminate concerns associated with other LBLOCA-related issues, viz:

AA8: Moderator temperature predictions. PF9: Fuel behaviour in high temperature transients. PF10: Fuel behaviour in power pulse transients. PF12: Channel voiding in LLOCA transients.



The safety analyses in support of the acceptability of the safety system performance to ensure meeting the fuel and fuel channel integrity acceptance

158


criteria are based, to a large extent, on numerical simulations of the power pulse. It is therefore important that safety analyses account for the positive void coefficient of reactivity in a conservative manner, which requires the assessment of the accuracy in determination of this coefficient. However, the current validation of the theoretical models and computer codes used by the CANDU industry are such that errors associated with void reactivity calculations are not well defined due to a lack of specific experimental data at in-reactor operating conditions and fuel burnup.


Inadequate knowledge of the uncertainties in models and data used to predict the key phenomena increases the risk that consequences of a limiting Large Break Loss of Coolant Accident (LBLOCA) could be greater than those currently estimated in plant Safety Reports.


The crux of the issue is the level of confidence that can be associated with code predictions of Coolant Void Reactivity (CVR) and the lack of experimental support in the range of concern. Although adverse findings could affect the “radiological risk to public at Design Basis Accidents (DBA)” and “severe accident risks” areas, the primary risk area affected is that of “risks of Negative Impact on Safety”.


The issue is primarily relevant to power operation.


LBLOCA is of interest because it is the design basis event for shutdown systems and Emergency Core Cooling System (ECCS). However, the increased magnitude of void reactivity is potentially of concern for predicted consequences of other relatively high frequency events, such as Loss of Regulation (LOR) or Loss of Flow (LOF), to beyond design event sequences, such as Loss of Regulation (LOR) or small Loss of Coolant Accident (LOCA) with failure to shutdown.


Canadian PracticesCurrently, the relevant industry design requirements and practices are stated in Regulatory Document R-8 and CSA standard CAN3-N290.1-80, “Requirements for the Shutdown Systems of CANDU Nuclear Power Plants”. This standard is focused on:

159


Ensuring that the Shutdown System operates as intended when required; and Minimizing Shutdown System operation when no potentially hazardous

situation exists.

Any aspects of the design that fail to comply with the application requirements contained in this standard shall be identified. The standard provides additional supporting requirements primarily focused on Shutdown System design requirements.

The CSA set of standards for CANDU reactor Shutdown Systems contains a comprehensive set of high-level requirements that establish a firm foundation for high assurance that these systems will perform their safety functions, from a reliability standpoint. Although the high-level requirements are exceptionally clear (two independent and diverse systems, maximum unavailability of 10-3 years per year, independence from process system failure), the guidance on how the unavailability requirement and expected effectiveness are to be met appears limited.

A key requirement in the standard CAN3-N290.1-80 (Requirements for the Shutdown Systems of CANDU Nuclear Power Plants) is to address the analytical failure mode. The analytical failure mode is essentially related to treatment of epistemic (knowledge) uncertainties.

International Regulations and PracticeThe US and other countries have formally coded requirements and standards for reactivity coefficients although there are no explicit requirements for limits on reactivity coefficients. In most cases, these stipulate that, over the power operating range, the net effect of the prompt inherent nuclear feedback characteristics tends to compensate for a rapid increase in reactivity (10CFR50-GDC11).

In the US and elsewhere, there are also explicit requirements for mandatory measurements for confirmation of calculated values, especially in case of positive reactivity coefficients, and the use of conservative values in analysis.

International Atomic Energy Agency (IAEA) Requirements and GuidelinesThe relevant International Atomic Energy Agency (IAEA) requirements (NSR-1) contain general requirements regarding the ability to compensate for increases in core reactivity, but stop short of a specific requirement for having inherent negative reactivity feedback coefficients. IAEA Safety Guide NS-G-1.12 further states that the design of the reactor core should be such that the feedback characteristics of the core rapidly compensate for an increase in reactivity, however, it further adds that this includes a combination of inherent neutronic and thermal hydraulic characteristics of the reactor core, as well as the capability of the control and Shutdown Systems to actuate for all operational states and in design basis accident conditions.

Knowledge Base Provide the design basis for the issue.

160


In the postulated event of a large Loss of Coolant Accident (LOCA) there is an increase in core power, due to positive void reactivity feedback. CANDU reactors have specific engineered features designed to limit the voiding rate in the core and mitigate the power pulse. The Regulatory Document R-10 stipulates the regulatory design requirements for currently operating CANDU reactors licensed for construction in Canada after January 1, 1977. Hence, the regulatory document R-10 requires that the CANDU reactor with a positive void reactivity shall be designed with two fast acting, independent, diverse, and highly reliable, and fully effective Shutdown Systems. Specific requirements for design, performance, and testing of the two Shutdown Systems are provided in the regulatory document R-8. Essentially, R-10 states that if two fully effective shutdown systems are employed in the design, the regulator would accept that at least one of the two Shutdown Systems could be credited for all accidents, the credited system being the one which was the least effective of the two for any specific accident scenario. This engineered design solution is based upon an inherent feature of CANDU heavy water-natural uranium lattice: a long prompt neutron life time. The timing and rundown characteristics of each Shutdown System are expected to limit the magnitude and duration of the power pulse, and to ensure that the energy deposition in the fuel will not jeopardize the fuel and fuel channel integrity.


Experiments were undertaken in the ZED-reactor at Chalk River between 1993 and 1998. The effect of mid-burnup fuel was simulated by using a limited number of Mixed Oxide (MOX) fuel bundles. Because the number of bundles was limited, a “substitution method” was used whereby the central portion of the ZED-2 driver fuel was replaced by MOX bundles. Criticality was achieved by adjusting the moderator level and coolant voiding was achieved by removing the coolant from the vertical channels. The buckling change on voiding was used to compute the change in keff between the fully cooled and fully voided core.

As the MOX experiments progressed, preliminary, unverified estimates of the Void Reactivity Error Allowance (VREA) gradually became available. These preliminary experimental results indicated that the Void Reactivity Error Allowance (VREA) measured under simulated mid-burnup conditions was significantly higher than used in previous accident analyses. The conservative response by the Canadian Nuclear Industry was to undertake Large Break Loss of Coolant Accident (LBLOCA) analysis using the higher value of Void Reactivity Error Allowance (VREA) and to tighten operational and safety system limits to offset the effect of the higher Loss of Coolant Accident (LOCA) power transient.

There are several areas where specific actions are needed to ensure a high confidence level of results of large LOCA analyses. These areas are:

161


The accuracy and validation of current reactor physics licensing methods and computer codes used for power pulse analyses;

The suitability of the experimental program to support the validation of reactor physics codes and data for conditions specific to power reactors and anticipated accident conditions;

The acceptability of results of power pulse calculations performed with more accurate and validated methods, and adequate allowances, in support of safety system performance; and

Improvement of the experimental data of CANDU fuels to better understand the fuel behaviour subjected to a power pulse.

• Describe the complete current knowledge base for the issue.• Existing Licensing Basis/Practices.

Transition to WIMS/DRAGON/RFSP Code SuiteIn 1998, the Industry decided to abandon the reactor physics code suite consisting of POWDERPUFS/MULTICELL/RFSP in favor of the more modern and rigorous WIMS/DRAGON/RFSP code suite. The focus of the validation efforts shifted to the validation of WIMS and the determination of the Coolant Void Reactivity (CVR) uncertainty in terms of the WIMS bias and uncertainty. The analytical efforts shifted to the implementation of the WIMS code and the execution of LBLOCA analysis with the new physics code suite. LBLOCA analysis using the new code suite was completed in early 2000’s. The resulting Loss of Coolant Accident (LOCA) power pulse was found be significantly larger than expected resulting in the need for further tightening of operating limits.

Independent Expert PanelIn 2002, the Canadian Nuclear Industry and the CNSC agreed to jointly sponsor an Independent Expert Panel (IEP) to review the current state of knowledge with respect to the adequacy and completeness of reactor physics code validation in Canada. The focus of the IEP efforts was on Coolant Void Reactivity (CVR) uncertainty and bias in WIMS, the fuel temperature coefficient of reactivity, and the delayed neutron data. At the end of the review, the IEP concluded:

Buckling measurements are correct to within ±0.7 mk; Not clear that MOX represents mid-burnup fuel; Quality and quantity of the MCNP calculations are insufficient; MCNP's bias with temperature has not been considered; Concerns expressed for experimental bias for 28-element fuel (Subsequent

follow up since 2001); Deficiencies noted in the resonance treatment in WIMS; There is no proper analysis of uncertainties and the bias variation; and Though not well-founded, the Industry's biases and uncertainties may be

correct.

The IEP findings and recommendations led to various additional experiments and

162


follow up investigations including:

Further ZED-2 Coolant Void Reactivity (CVR) experiments simulating bi-directional fuelling and presence of absorber; and

Further ZED-2 Coolant Void Reactivity (CVR) experiments for 28 element fuel providing additional confirmation of 28 element fuel Coolant Void Reactivity (CVR).

Plus ongoing R&D activities listed below.


COG-01-144; S.R. Douglas, H.C.Chow, R.E. Donders, R.T. Jones, “System Validation Manual for WIMS-IST/DRAGON-IST/RFSP-IST Reactor Physics Code Suite”, 2001.


Ongoing activities:

Upgrades to WIMS-AECL and MCNP data libraries; Improved resonance treatment in WIMS; Further validation of MCNP against ZED-2 measurements; Further confirmation of WIMS validation against MCNP; and Use of MCNP to analyze ZED-2 experiment (rather than CONIFERS).

With respect to validation of physics code under power reactor conditions, there is an ongoing COG work package (WP 51014 - Validation of reactivity coefficients using station start-up data) to evaluate the feasibility and uncertainty in the use of full scale reactor data for validation.

The following work programs are planned for 2009-10:

Validation of MCNP-Based Substitution Method for CANDU Design and Application of the Method to 37-Element Fresh Natural Uranium and Mixed-Oxide (MOX) Fuel-Bundle Designs; and

Determination of Feasibility of Station Validation of Physics Phenomena and Parameters.

R&D ReportsCOG-07-2091, H.C. Chow , “Recent Contributions to the Current State of Knowledge on Coolant Void Reactivity Error”, 2008.

This report presents a summary of recent (since 2001) contributions to the current state of knowledge relating to coolant void reactivity and validation of Coolant Void

163


Reactivity (CVR) calculations against experiments. A total of 21 documents have been reviewed and summarized. These documents cover MCNP and WIMS-AECL nuclear data library upgrades, ZED-2 experiments to provide data to address certain previously identified validation gaps, MCNP and WIMS-IST validation against experimental data, codes and method developments that addressed “methodology of validation” issues such as substitution experiment data analysis techniques and domain of applicability.

References:




164

RIDM Issue Definition PF 09 - Fuel Behaviour in High Temperature Transients

Issue ID : PF 09Title Fuel Behaviour in High Temperature TransientsBackground Information Provide general information related to the issue.

The codes used for modeling of fuel bundle behaviour in the high fuel temperature range lack models and/or adequate validation, and therefore the credibility of code predictions under these conditions is low. Furthermore, the increasing power pulse sizes that have been predicted over the last several years in LLOCA safety analyses, combined with the absence of adequate experimental data to qualify fuel codes in those regimes, puts into question our current understanding of the level of expected fuel damage, the adequacy of the LLOCA acceptance criteria used in LLOCA safety analyses, and the accuracy with which safety margins can be established.

• Historical background.

High temperatures are predicted to occur in several design basis accidents such as Loss of Coolant Accidents (LOCA), flow channel flow blockage and others. If the energy stored and added during the accident cannot be effectively removed from the fuel, fuel bundles may heat up to high temperatures (close to the UO2 melting point, in some events). Significant increase in fuel bundle temperatures may lead to serious safety consequences, including:

Multiple fuel sheath failures with accompanying releases of radioactive products;

An additional source of energy due to exothermal oxidation of Zr; Loss of bundle geometry; Fuel fragmentation on quench by the ECI coolant; and Formation of liquid phases.

It is well recognized that under high temperature conditions the fuel assembly could experience significant thermo-mechanical stresses and deform from its original geometry and fail due to a variety of mechanisms. The deformed geometry can impose cooling conditions quite different from those existing in normal operation and which are assumed in the safety analysis. Under certain scenarios (Reactivity Initiated Accidents) fuel can fragment, thus creating safety challenges not accounted for in the current safety analyses. If the Zircaloy of the fuel cladding experiences a heat-up above the alpha-beta phase transition and oxidizes beyond a certain level, under some conditions the material loses its ductility and sheath becomes brittle and susceptible to fragmentation upon quenching.

CNSC staff is concerned that in certain high temperature accidents fuel coolability cannot be assured even upon initiation of the Emergency Core Cooling System (ECCS) due to the fuel geometry changes and changes in material properties.

165

RIDM Issue Definition PF 09 - Fuel behaviour in high temperature transients

• How has it been identified?• Relationship to other RIDM Issues and/or Technical Areas.

There is a close relationship to PF10 - Fuel Behaviour in Power Pulse Transients, but PF10 is primarily concerned with Fuel Pellet Behaviour.



In certain LBLOCA transients, there could be significant mismatch between the energy deposited in the fuel and the rate of heat removal from the fuel. If the fuel heatup is excessive, it could lead to fuel bundle deformation (sagging, slumping, settling, melting, etc), resulting in loss of a “coolable geometry” and the possibility of consequential fuel and/or fuel channel failure.


At sufficiently high temperatures a bundle would lose its structural rigidity and would start deforming. In addition, after heating up and subsequent cool-down, the bundle materials could undergo a change in properties and lose their ductility, e.g., would become brittle and susceptible to fragmentation due to thermo-mechanical stresses. If, as a consequence of bundle deformation, the coolable geometry is lost then the Emergency Core Cooling System (ECCS) may not be able to re-establish fuel cooling, and this special safety system would not be effective. In addition, fuel deformation may lead to pressure tube failure prior to contact with the calandria tube.

The off-site doses to the public can be higher than those estimated in the Safety Report for LBLOCA. However, the doses are expected to remain within the single failure dose limits because there is significant margin available between the presently calculated off-site doses and the allowable dose limit.


The issue revolves around whether there is sufficient confidence to support the current industry assessments of accidents involving high fuel temperature. Although adverse findings could affect the “radiological risk to public at Design Basis Accidents (DBA)” and “severe accident risks” areas, the primary risk area affected is that of “risks of Negative Impact on Safety”.


Most accidents involve deteriorated cooling conditions, resulting in elevated fuel temperatures which in some events may reach very high values, such as in some LBLOCA transients. In stylized single channel events, such as stagnation break or

166


flow blockage, several bundles in a single channel are predicted to experience melting.


LBLOCA, channel flow blockage, stagnation feeder break, etc.


R-9 ECI Effectiveness



In CANDU reactors, of particular concern is the adequacy of modelling of fuel bundle behaviour under LBLOCA conditions. Currently, the bundle is assumed to preserve its original geometry throughout the transient. The Industry continues to apply the prevention of sheath melting as an acceptance criterion for demonstration of the bundle coolable geometry. The safety analysis of Large Break Loss of Coolant Accident (LBLOCA) shows that fuel experience temperature transients in the range for which no significant CANDU-prototypical experimental corroboration exists. The CNSC staff position is that the modelling of fuel bundle behaviour in the high fuel temperature range is lacking adequate validation and the credibility of code predictions under such conditions is low.

• Describe the complete current knowledge base for the issue.• Existing Licensing Basis/Practices.• Include in particular reference to State of the Art Documents, Technical Basis

Documents, Code Documentation including Validation Matrices, Test reports etc. • Describe ongoing R&D or other activities related to the issue resolution.

A CNSC letter that was issued to all utilities & AECL requested a plan for a PKPIRT (Phenomenon & Key Parameter Identification & Ranking Table) style examination of fuel code validation for high temperature fuel behaviour, and development of plans to address any validation gaps found. The Utilities agreed on a program through COG (WP20305) to convene a Phenomenon Identification & Ranking Table (PIRT) Industry expert panel as an input to examination of code validation and development of plans to address gaps, and submission of the validation examination and gap plans. In a June 2005 response, CNSC staff indicated acceptance of the proposed industry program and a desire to be involved in development of the process.

A series of PIRT panels (composed of internationally recognized CANDU & PWR

167


experts) was completed on January 22, 2006 and the final report was provided by COG to CNSC staff in April, 2006. A report documenting the comparison between the Industry Validation Technical Basis Document and the PIRT identified phenomena was prepared and issued in October 2006. A report on the compilation of a set of all available experimental information on fuel behaviour and comparison to existing validation matrix was issued in June 2007. Regular updates on status of the industry program are provided to the CNSC, the most recent being in November 2008.

The documentation of the knowledge base for the relevant subset of PIRT phenomena, and identification of knowledge gaps (if any) for the fuel bundle and its immediate surroundings is complete. All information collected and generated has been summarized in a comprehensive report entitled “Fundamental Aspects of High Temperature CANDU Fuel Bundle Behaviour” which is currently being reviewed by the Industry.

The following COG research work related to Fuel Bundle Behaviour under Low Temperature Conditions (Non-LBLOCA: e.g. NOP, Loss of Flow (LOF)) include:

Definition of Post-Discharge Bundle Geometry Variability (22223); Assessment and Documentation of Stern Lab Fuel Element Bow Tests

(22224); Assessment of Different Tools for Bundle Deformation Simulations Uuder

Normal Operating Conditions (NOC) (22225) State of the Art Report on the Impact of Bundle and Bundle-Component

Geometry Variation on Critical Heat Flux and Post-Dryout Heat Transfer in 28-Element and 37-Element Bundles (20943);

Assessment of the ASSERT Prediction Capability for Deformed CANDU Fuel Bundles (21430); and

Fuel Return to Service after IBIF (WP 22320).

A comprehensive strategy is presently being formulated to determine the R&D strategic direction to address the fuel bundle deformation behaviour issues under normal operating Anticipated Operational Occurence (AOO) and Design Basis Accidents (DBA) conditions. This effort will provide overall direction for all R&D activities for the short, medium, and long-term. Also, all relevant COG R&D and Industry Standard Toolset (IST) work packages are being reviewed to determine if their current scope of work and schedule supports the strategy. Potential gaps identified in the strategy will be addressed by proposing additional activities and new work packages

Recent COG R&D ReportsCOG-05-2114 “Review of Survey of CANDU Fuel Bundle Experiments Under High Temperature Conditions”.OP-05-2147 “Darlington NGS Phenomena Identification and Ranking Table for a Critical Break Large LOCA”.

168


OP-06-2079 “Review of Experimental Data on High-Temperature Fuel Behaviour”. OP-06-2080 “Comparison Between PIRT Phenomena Importance Ranking and Code-Validation TBD Phenomena Ranking”.COG-07-2070 Assessment Of Experimental Information on High Temperature Fuel Bundle Behaviour.COG-07-2075 State Of The Art Report on Fuel Sheath Oxidation and Embrittlement In LBLOCA (SOTAR).COG-08-2013 “Fundamental Aspects of High Temperature Fuel Bundle Behaviour”. Draft report under review by the Industry (contents informally communicated to CNSC staff in November 2008).

Work Packages(WP 20306) High-temperature fuel bundle behaviour experiment.(WP 20321) Assessment of existing experimental data on fuel bundle deformation under accident conditions.(WP 20322) Assessment of fuel sheath failure mechanisms for accident analysis. (WP 20323) Fuel sheath embrittlement in Large Break Loss of Coolant Accident (LBLOCA). (WP 20324) Fuel pin rigidity model in support of bundle deformation models. (WP 20325) Participation in the Pitesti (Romania) power pulse fuel behaviour tests Scaling assessment for applicability of LWR RIA experiments to CANDU analysis (included under WP 20325).(WP 20943 )State of the art report on the impact of bundle and bundle-component geometry variation on critical heat flux and post-dryout heat transfer in 28-element and 37-element bundles. (WP 21430).Assessment of the ASSERT code prediction capability for deformed CANDU fuel bundles. (WP 22224) Assessment and documentation of Stern Lab fuel element bow tests. (WP 22225) Assessment of different tools for bundle deformation simulations under normal operating conditions. (WP 22320) Fuel return to service after IBIF. (WP 50605) The extended validation and assessment of model uncertainties for ELOCA 2.2.(WP 50607) Validation of ELOCA for LB LOCA power pulse conditions. (WP 50610) ELOCA Validation against the IBIF Experiments. (WP 59907) Modelling of fuel bundle deformation during accident conditions.

Working GroupsFuel and Fuel Channels Working Group (Sponsored by COG Safety and Licensing R&D Technical Committee).

References:

169





170

RIDM Issue Definition PF 10 - Fuel Behaviour in Power Pulse Transients

Issue ID : PF 10Title Fuel Behaviour in Power Pulse TransientsBackground Information Provide general information related to the issue.

In CANDU reactors, of particular concern is the adequacy of modelling of fuel bundle behaviour under LBLOCA conditions. Currently, the bundle is assumed to preserve its original geometry throughout the transient. The Industry applies the prevention of fuel centre line and sheath melting as derived safety criteria sufficient to ensure fuel channel integrity and, consequentially, fuel coolable geometry. Conservative analysis of Large Break Loss of Coolant Accident (LBLOCA), using the Limit-of Operating Envelope analysis methodology, shows that fuel experiences temperature transients in the range for which limited CANDU-prototypical experimental tests exist. The CNSC staff position is that the modelling of fuel bundle behaviour in the high fuel temperature range is lacking adequate validation and the credibility of code predictions under such conditions is low.

• Historical background.

The Industry has analyzed all aspects of this issue in a comprehensive way concluding that the performance of the fuel bundles, with the as-fabricated geometry, was consistent with the assumptions in the Safety Reports [5]. After receiving this report the CNSC asked a group of external experts for its review. These external experts agreed with the conclusions of the report [6]. Recently, the Industry (through Canadian Owner Group ( COG)) had initiated efforts to review high temperature fuel and fuel channel phenomena and computer code validation [4]. The Industry also undertook a review of experimental data from a wide range of Reactivity Initiated Accident (RIA) tests, based on previous work such as Reference [7]. The experimental data were predominantly from Light Water Reactor Fuel; however, the data were analyzed for relevance to CANDU fuel behaviour during a LBLOCA power pulse. This analysis is important to determine the usefulness of the RIA data for code validation and to assess the need for CANDU specific power pulse tests. The preliminary conclusions from the industry review indicate that the available RIA data may provide wide enough range of results for fuel code validation for the power pulse phase. The Industry also reviewed the option to perform CANDU specific power pulse tests. Currently, no known facility is available for experimentation on CANDU fuel conditions. Furthermore, such tests may not be sufficiently prototypical to CANDU performance and behaviour (e.g. due to the need to use atypical fuel geometries and enriched fuel) to add materially to the information that is currently available.

Based on these considerations, the Industry concluded that the most effective way to address CNSC staff concerns was to undertake a program through Canadian Owner Group ( COG) to conduct a Phenomenon Identification & Ranking Table (PIRT) Industry expert panel as an input to examination of code validation and development of plans to address gaps. The goal is to produce, through Canadian Owner Group

171

RIDM Issue Definition PF 10 - Fuel behaviour in power pulse transients

( COG), a “comprehensive report” on fuel behaviour that will examine relevant data for high temperature fuel behaviour under LBLOCA power pulse conditions and high temperature conditions following Large Break Loss of Coolant Accident (LBLOCA).

The Industry, in conjunction with the CNSC, agreed on the specific techniques and methodology for the PIRT process. The PIRT methodology was developed from the United State Nuclear Regulatory Commission Code Scaling Applicability and Uncertainty (CSAU) process. One of the most important elements of the PIRT process is to identify key parameters, components, phenomena, and physical processes in order to evaluate event behaviour. Another key element of the PIRT process is the ranking of these parameters. Each phenomenon is ranked relative to a Figure of Merit (FOM) or an evaluation criterion. This is especially useful because during accident scenarios not all processes and phenomena equally impact the behaviour of the plant. By ranking each phenomenon with respect to the FOM, a clear picture of the relative importance of each phenomenon can be obtained. The knowledge component of the PIRT process assesses the current level of knowledge for each system, component, and phenomenon, relative to the impact of each phenomenon on the FOM during each phase. The first round of the PIRT panel meetings was held in November 2005. The panel was comprised of both American and Canadian experts. The scenario put forth to the PIRT panel was a LBLOCA for a Darlington NGS reactor with Emergency Coolant Injection (ECI) system available. In the scenario, a critical 40% break in the northwest (NW) Reactor Inlet Header (RIH) occurred when the reactor was operating at 100% full power. The FOM was maximum fuel average temperature during each phase of the scenario.

According to the Industry, the objectives of the PIRT were to (Reference [4]): Possibly improve and/or confirm industry understanding of high temperature

fuel behaviour post accident; Identify and rank the important phenomena, processes, and mechanisms that

impact post-accident fuel behaviour and assess the state of knowledge with respect to modelling and supporting data;

Assess the importance rankings given in the CANDU Technical Basis Document and the Best Estimated and Uncertainty (BEAU) analysis for Darlington Nuclear Generating Station (DNGS) Large Break Loss of Coolant Accident (LBLOCA);

Identify gaps in the Industry’s database and modelling with respect to the primary

phenomena; Assess applicability and adequacy of Industry’s analysis tools; and, Support resolution of licensing issues related to post-accident, high-

temperature fuel and fuel channel behaviour.

• How has it been identified?• Relationship to other RIDM Issues and/or Technical Areas

There is a close relationship to PF09 - Fuel Behaviour in High Temperature

172


Transients, but PF09 is primarily concerned with fuel bundle behaviour, whereas PF10 is concerned with fuel pellet behaviour and its interaction with the fuel sheath.



Deposition of significant energy in the fuel matrix over a short period of time gives rise to safety concerns. It is known that at high levels of energy deposition fuel cladding would fail; at higher levels of energy deposition, both fuel matrix and cladding can be fragmented. There are no available CANDU fuel experimental results for the currently predicted range of power pulse parameters obtained using conservative analysis of LBLOCA. CNSC staff is concerned that in power pulse transients CANDU fuel can experience failures due to mechanisms which are not accounted for in safety analyses.


Inadequate knowledge of the impact of bundle deformation behaviour and the sparse data available to predict some phenomena may increase the risk that consequences of a limiting Large Break Loss of Coolant Accident (LBLOCA) could be different than those currently estimated in plant Safety Reports.


The issue revolves around whether there is sufficient confidence to support the current industry assessments of accidents involving high fuel temperature. Although adverse findings could affect the “radiological risk to public at Design Basis Accidents (DBA)” and “severe accident risks” areas, the primary risk area affected is that of “risks of Negative Impact on Safety”.


Reactivity transients could occur from any plant operating state but those occurring from full power are likely to be most limiting.


Large Break Loss of Coolant Accident (LBLOCA).


1. R-9 ECI Effectiveness, which requires fuel channel integrity be maintained2. High temperature fuel bundle behaviour; fast reactivity transients

173


(LBLOCA with ECI available): o No fuel channel failures (fuel failures are allowed);o No constrained fuel string expansion. This is to prevent fuel bundle

deformation resulting in contact between the fuel element (FE) and the pressure tube (PT), and consequent Pressure Tube (PT) failure;

o No fuel melting;o No fuel sheath melting; o No sustained calandria tube (CT) dryout.


In CANDU reactors, the power pulse in Large Break Loss of Coolant Accident (LBLOCA) is approximately 1 s and must be terminated by Shutdown Systems because the positive coolant density reactivity feedback would only exacerbate the power transient.


Deposition of significant energy in the fuel matrix over a short period of time gives rise to safety concerns. It is known that at a certain level of energy deposition fuel cladding would fail; at higher levels of energy deposition, both fuel matrix and cladding can be fragmented. As the fuel burn-up increases, such failures can occur at lower levels of the deposited energy. While CANDU fuel has lower burn-up, there are features which can potentially make CANDU fuel more susceptible to failures in reactivity transients, namely the thinner sheath, absence of the pellet to sheath gap, absence of the gas plenum in fuel elements. There currently are not enough data to understand the influence of these parameters on CANDU fuel behaviour in power pulses.

• Describe the complete current knowledge base for the issue• Existing Licensing Basis/Practices• Include in particular reference to State of the Art Documents, Technical Basis

Documents, Code Documentation including Validation Matrices, Test reports etc. • Describe ongoing R&D or other activities related to the issue resolution.

There are several industry initiatives underway to investigate the many aspects of modelling of the CANDU fuel bundle behaviour under high temperature accident conditions. The main COG project, WP 20305 was initiated in 2005, and has been executed according to the detailed industry work plan that has been completed and updated in consultation with the CNSC. The main activities that have been recently completed or are presently underway are listed below.

A comprehensive PIRT (Phenomenon Identification and Ranking Table)

174


exercise was completed in 2006 to identify, rank, and review the knowledge base for all phenomenon/factors which have an impact on fuel temperature following a Large Break Loss of Coolant Accident (LBLOCA). The PIRT panel consisted of seven international and national experts in this area. This ‘table’ or comprehensive ranking of phenomenon is being used to compare against existing, experimental data, models, and code validation (e.g., code technical basis documents and code validation manuals to identify any gaps in these areas).

The investigative process of gap identification was recently completed in a pilot concept study based on a single chosen phenomenon and the results presented to the CNSC by the Industry in a meeting held on February 1, 2008. This pilot study was requested by the CNSC staff in order to demonstrate the entire process being applied to this work.

A Canadian Owner Group ( COG) report documenting the knowledge base for the relevant subset of PIRT phenomena, and identification of knowledge gaps for the fuel bundle behaviour and its immediate surroundings has been completed.

An assessment of the phenomena coverage in the validation manuals and theory manuals of the safety analysis fuel behaviour codes and identification of the validation or modelling gaps (if any) was performed under Canadian Owner Group ( COG) WP 20305. The full assessment of code validation gaps is dependent on separate effects model validation work currently being performed for ELOCA 2.2. The separate effects model validation work is being performed in a project sponsored by OPG as part of the code applicability assessment in support of the Pickering B Large Break Loss of Coolant Accident (LBLOCA) Best Estimated and Uncertainty (BEAU), and a Canadian Owner Group ( COG) project (WP 50605) on the extended validation and assessment of model uncertainties for ELOCA 2.2. Therefore, until the separate effects validation reports are available, the code assessment is currently focusing on the modelling aspects of the key phenomena.

A report on the compilation of a set of new experimental information on fuel bundle behaviour at high temperatures has been compiled, and all existing experiments (including the ones listed in the Industry’s fuel and fuel channel validation matrix) have been mapped to the major phenomena identified in the PIRT exercise. This Canadian Owner Group ( COG) document, OP-06-2079, was issued in April 2007.

All information collected and generated in this Canadian Owner Group ( COG) project (WP 20305) has been summarized in a comprehensive Canadian Owner Group ( COG) report (COG-08-2013) which is currently being reviewed by the Industry.

R&D ReportsISTO-06-5031 Industry Response to the CNSC Commissioned Report: Martec Technical Report #TR-06-14, “Fuel Failure Mechanisms Under Accident Conditions”.

175


OP-06-2079 Review of Experimental Data on High-Temperature Fuel Behaviour. OP-06-2080 “Comparison Between PIRT Phenomena Importance Ranking and Code-Validation TBD Phenomena Ranking”.COG-08-2013 “Fundamental Aspects of High Temperature Fuel Bundle Behaviour”. Draft report under review by the Industry (contents informally communicated to CNSC staff).

Work ProgramsThe work being performed under Canadian Owner Group ( COG) WP 20305 Fundamental Aspects of High Temperature CANDU Fuel Bundle Behaviour covers the conditions and fuel behaviour under a power pulse. Therefore, the work described in issue PF9 applies to issue PF10, i.e., the phenomena have been identified using a PIRT process, existing experimental data has been compiled, comparisons have been made to the Technical Basis Document, knowledge base is being documented and assessed, and the code validation of the key phenomena is also being assessed.

Specifically relevant to the power pulse behaviour are also the following projects: (WP20322). Assessment of fuel sheath failure mechanisms for accident analysis.(WP 20323) Fuel sheath embrittlement in Large Break Loss of Coolant Accident (LBLOCA). (WP 20324) Fuel pin rigidity model in support of bundle deformation models. (WP 50605) The extended validation and assessment of model uncertainties for ELOCA 2.2.(WP50607) Validation of ELOCA for LB LOCA Power Pulse Conditions. (WP 20325) Participation in the Pitesti power pulse experiments (Romania) to ensure that the conditions and instrumentation of these experiments meet the requirements for validating our safety analysis codes, and ensure that Canadian Owner Group ( COG) has access to the data.Scaling assessment for applicability of LWR RIA experiments to CANDU analysis (also included under WP 20325).

References:




176


4. Letter, P. R. Charlebois to G. Schwarz and T. Schaubel, “Modelling of Fuel Bundle Behaviour under High Temperature Accident Conditions,” April 29, 2005, CD# N-CORR-00531-03279.

5. “CANDU Fuel Behaviour During Large Break LOCA Overpower Transients”, F. Iglesias, H. Sills, Y. Liu, V. Langman and M. Notley, Ontario Hydro Report, August 1993.

6. “A Reassessment of CANDU Fuel Behaviour During Large Break LOCA Power Transients”, T.J. Haste, D.G. MacInnes, D.G. Matin, J.R. Matthews and P.W Winter; AECB Project N° 2.317.1, March 1995.

7. Technical Paper, “Fuel Behaviour During a Power Pulse: A Review and Assessment of Reactivity Initiated Accident (RIA) Test Data,” J.C. Luxat, Proceedings CNS Annual Conference, June 2002.

177

RIDM Issue Definition PF 12 – Channel Voiding during a Large LOCA

Issue ID : PF 12Title Channel Voiding During a Large LOCABackground InformationProvide general information related to the issue.

� Historical background .

CNSC staff has a concern that the computer codes used for prediction of overpower transients for CANDU reactors with a positive coolant void reactivity coefficient have not been adequately validated. This Generic Action Item (GAI) requires the Licensees to carry out direct void fraction measurements, provide an assessment of the scaling of the results to the phenomena expected in the reactor, perform validation exercises using these data and complete an impact assessment on the safety margins.

Tests with void fraction measurements in AECL’s RD-14M facility have been completed, and data analysis reports have been submitted to the CNSC. The Industry has provided information on the computer code validation exercises and the scaling assessment.

� How has it been identified?� Relationship to other RIDM Issues and/or Technical Areas.

The predictions of voiding are a key input into calculations of coolant void reactivity and hence are closely related to:

AA8: Moderator temperature predictions; AA9: Analysis of Coolant Void Reactivity (CVR); PF09: Fuel behaviour in high temperature transients; PF10: Fuel behaviour in power pulse transients.



The voiding transient in a large LOCA is calculated by system thermal-hydraulics codes, CATHENA and TUF. Experimental uncertainties, scaling effects and code uncertainties need to be considered to ensure that a conservative estimate of the void fraction is used in the physics codes for prediction of the magnitude of the large LOCA power pulse. CNSC staff has a concern that the computer codes used for prediction of overpower transients for CANDU reactors with a positive coolant void reactivity coefficient have not been adequately validated.


A lack of validation of models calls into question the ability to predict safety margins and hence provide confidence that they are conservative. There is a risk that the consequences of a Large Break Loss of Coolant Accident (LBLOCA) may be more

178


severe than currently estimated in Safety Reports.


The crux of the issue is the level of confidence that can be associated with code predictions of coolant voiding. Although adverse findings could affect the “radiological risk to public at Design Basis Accidents (DBA)” and “severe accident risks” areas, the primary risk area affected is that of “risks of Negative Impact on Safety”.


The issue is a concern only for Large Break Loss of Coolant Accident (LBLOCA) occurring at high reactor power.


The initiating event of interest is the Large Break Loss of Coolant Accident (LBLOCA).


As per Reference [1], to bring this generic action item to closure, the Licensees are expected to carry out:

1. Channel void measurements during large LOCAs relevant to reactor conditions; the effects of heat transfer rate and scaling on channel voiding should also be quantified;

2. Validation exercises with the relevant safety analysis computer codes against the channel void data - these activities should be carried out in line with GAI 98G02 expectations; in particular, there should be sufficient information to demonstrate the claimed accuracy of the code for the given application; and

3. An impact assessment of the safety margins in the Safety Report.





The Canadian utilities have progressed towards addressing the closure criteria that

179


were specified in Reference [1], through the following activities: Completion of a COG R&D program for transient void fraction measurements

in a RD-14M heated channel. The development of appropriate instrumentation has been a significant challenge;

COG R&D Program to Analyze the RD 14M Phase I and Phase II test data; Scaling assessment of the RD 14M facility for LLOCA; and Validation reports demonstrating adequacy of the TUF and CATHENA codes

for predicting channel void during large loss of coolant accidents.

On the issue of scaling, CNSC engaged a consultant, with whom an industry workshop was held in May 2003. The consultant report (Reference [2]) had a number of criticisms of the original industry methodology. The scaling methodology was modified in the second half of 2003. In July 2004, CNSC staff specified [3] the following remaining activities for closure of GAI 00G01:

1. Perform scaling analysis of RD-14M to demonstrate the relevance of channel voiding measurements to the reactor situation;

2. Provide confirmation that the TUF and CATHENA codes are used in the same way for validation and accident analysis;

3. Provide estimates of the simulation uncertainty of the TUF and CATHENA codes for predicting the channel void fraction during the power pulse period; and,

4. Perform single parameter sensitivity calculations to examine the effect of uncertainty in void prediction on key safety parameters.

Scaling between the RD14M facility and the reactor has been a major issue. A scaling report was submitted to the CNSC in June 2006. Results indicate that there is no significant scaling distortion. CNSC staff provided comments on the scaling methodology in the above report in February 2008. CNSC comments on the final reports are being addressed and the Industry expects to close the scaling issue in 2009.

The following work is being used to address requirements for closure of GAI 00G01 “Channel Voiding During Large LOCA”:• Experimental

o Channel voiding measurements were completed under a COG R&D program at the RD-14M test facility.

• Code Validationo An industry team has coordinated preparation and submission of computer

code validation exercises.• Scaling

o Industry submitted the RD14M – CANDU 6 scaling analysis using the CNSC consultant’s recommended methodology (FSA) in June 2006 – showed that RD-14M was well scaled.

o CNSC recommended RSA scaling methodology was applied, leading to a closer scaling criteria between RD-14M and the reactor for the power- pulse scenario compared to applying FSA.

180


• Computer code accuracy and uncertainty understanding and methodologyo Definition/Terminology of code applicability, accuracy, uncertainty

established.o TH code modeling uncertainty in channel void predictions has been

established.o Sensitivity of key safety parameters to uncertainty in channel void

predictions has been established.LLOCA Modelling

o It has been confirmed that system TH codes used the same way inboth validation exercises and Safety Analysis.Impact on Safety Analysis

o Identified through Pickering B LLOCA Best Estimated and Uncertainty (BEAU) Analysis.

R&D ReportsCOG-01-168 RD-14M LOCA Tests with Channel Void Measurement: Phase I Tests, B0102- B0110.COG-01-169 RD-14M Power-Pulse LOCA Tests with Channel Void Measurement: Phase II Tests, B0111-B0118.COG-03-2051 A Scaling Assessment of RD-14M for Channel Coolant Voiding During the Power Pulse Phase of a Postulated Large-Break LOCA Scenario: Application to a 20% RIH Break in the Point Lepreau Reactor.COG-04-2023 Analysis of RD-14M B03XX LOCA Tests with Local Channel Void and Temperature Measurements.COG-06-2053 Reduction of the Uncertainty of the Channel Void Fraction from the RD-14M Neutron Scatterometer.

Work ProgramsWP20104 RD-14M Large LOCA Experiments and Analysis.WP20105 Non-Linearity and Flow Regime Uncertainties for RD14 m Neutron Scatterometer Measurements.WP20106 Impact of Scaling distortions RD-14M.WP20110 Derivation of LLOCA Channel Voiding Modelling Uncertainty using RD14m Experimental Data.WP 20124 Simulation Accuracy of CATHENA for Void Fraction During LB LOCA.WP 20125 LBLOCA Break-Opening Characteristics: State-of-the-Art Report for CANDU Reactors.

Working GroupsIndustry Team GAI 00G01 (Sponsored by COG Nuclear Safety Committee)Thermal hydraulics Working Group (Sponsored by Safety and Licensing R&D Technical Committee).

References:

181


1. Generic Action Item 00G01 “Channel Voiding During a Large LOCA,” CNSC Position Statement PS-00G01, Rev. 0, February 2001.

2. “Scaling of Coolant Voiding During Early Blowdown: Application to Power Reactors: Generic Action Item GAI 00G01”, Wolfgang Wulff, Consultant to Canadian Nuclear Safety Commission, March 2003.

3. Letter, P.A. Webster to F. Saunders, “GAI 00G01 Channel Voiding During Large Loss-of-Coolant-Accident”, August 26, 2004, NK21-CORR-00531-03002/NK29-CORR-00531-04687. (Similar letters were sent to other Licensees).

4. Terms of Reference for the COG S&L Working Group on Thermalhydraulics, August 2002.

182

Risk Significance Level Assessment

APPENDIX B. RISK ESTIMATIONS AND RISK EVALUATIONS FOR CATEGORY 3 CANDU SAFETY ISSUES

The results of the risk estimations and risk evaluations for all Category 3 Safety Issues are provided in this document. The process used to determine the risk significance levels is described in Reference 9.3 and the various risk matrixes used to achieve the Risk Significance Level categorization are presented in Appendix A.

The scenarios link with the risk area related to the Risk of Negative Impact on Safety are evaluated against two sets of criteria. The table 5, 6 and 7 form the first set and apply a detailed evaluation of consequence and frequency.

It is important to note that the consequences of a scenario represent the consequences related with the Safety Issue and not the response of the plant following the initiating event. Also, the likelihood is the probability that the consequences will occur and not the frequency of the initiation event.

The Risk Significance Level (RSL) is given by the magnitude of the impact on the risk. Four risk significance levels are employed. To ensure consistency, these levels are used for any risk evaluation in any risk area. The risks evaluated to be tolerable only if reduction in risk is impracticable or its cost is greatly disproportionate to the improvement gained are RSL 3. Significantly higher risks that can’t be justified except under extraordinary circumstances are RSL 4. When the Safety Issue brings no additional risks or a negligible one, the Risk Significance Level (RSL) is 1. A RSL 2 is assigned when the risk increases due to the Safety Issue, but is still well within the tolerable region. Reference 9.3 provides more details on the definition of the risk significance levels.

183


Non-Large LOCA

AA 3 Computer Code and Plant Model Validation

Risk Area Scenario Consequences Likelihood9 Risk Significance LevelCategory Comments Category Comments Category Comments

Risk of Negative Impact on Safety.

(Tables A5, A6, A7)


C1 Inadequate confidence in codes used in assessing plant conditions when compliance verification is not possible

L3 3 Code validation status is not known for many codes.


C2 Impairment of safety functions or barriers

L2 3

9 This issue has been reassigned as a non LBLOCA issue.

184


AA 7 Analysis for Pressure Tube Failure with Consequential Loss of Moderator

Based on the following assessment and taking into account current information, it is recommended to move this issue to a category 1.

Risk Area Scenario Consequences Likelihood Risk Significance LevelDescription Category Description Category Category Comments


(Tables A5, A6, A7)

Consequential moderator drain due to end-fitting ejection at in-core LOCA with single channel failure. (ECC available)

The consequences of a pressure tube and calandria rupture, with ECC available, are similar to the consequences of a small LOCA. In this case, the consequential drainage of the moderator does not significantly affect the consequences of the event.

C1 The likelihood that the moderator is required as a back up heat sink.

L1 1 -

Consequential moderator drain due to end-fitting ejection at in-core LOCA with LOECC and multiple fuel channel failure.

Following a LOCA with LOECC, the moderator is normally credited as providing the heat sink ensure that further damages to the HTS are avoided. In the case of a pressure tube rupture experiments have shown that it is likely that the calandria tube will also fail and that the end-fittings will eject, consequentially leading to a loss of moderator. Therefore the safety function of cooling is insufficient or unacceptable for an event traditionally included as a DBA.

This situation leads to impaired fuel cooling and consequential loss of fuel and fuel channel integrity.

C3 Based on current knowledge, direct consequential additional fuel channel failure due to pipe whip is not likely. Moreover, based on existing assessment of ECC performance and operator actions, consequential fuel channels due to impaired fuel cooling is also unlikely (less than 10-5 /y).

L0 2 -

185



Consequences of moderator drain depend on in-core break location (top, middle and bottom). End-fitting ejection at the top would not result in significant moderator loss and would have impact on small number of fuel channels.

Radiological Risk to Public at DBA.

(Tables A1, A2, A3)

Consequential moderator drain due to end-fitting ejection at in-core LOCA with single channel failure. (ECC unavailable)

For LOECC case, if end-fitting is ejected, then the station is in severe accident regime.

C3 We consider that the frequency of this scenario is greater than 10-7 per year and likely less than the DBA frequency limit.

L1 1 Consequential containment impairment is not expected.

Consequential moderator drain due to end-fitting ejection at in-core LOCA with LOECC and multiple fuel channel failure.

For LOECC case, if end-fitting is ejected and in addition if there are consequential pressure tube failures, then the station is in severe accident regime.

C4 We consider that the frequency of this scenario is less than 10-7 per year.

L1 3 (2, due to very low likelihood. In fact this sequence is considered below the DBA frequency threshold whereas this criteria is for DBA)

Consequential containment impairment is not expected.

186


Risk Area Scenario Risk Significance Level CommentsSevere Accidents Risks

(Table A4)

Consequential moderator drain due to end-fitting ejection at in-core LOCA with single fuel channel failure. (ECC unavailable)

2 The probability for an increase of release is not related to the additional fuel channel failure. Consequential containment impairment is not expected. We consider that the frequency of this scenario is greater than 10-7 per year and likely less than the DBA frequency limit. The contribution to severe core damage frequency is small since the frequency of pressure tube failure with unavailable ECC is small.

Consequential moderator drain due to end-fitting ejection at in-core LOCA with LOECC and multiple fuel channels failure.

2 Consequence is directly depending on containment performance and it is not challenge. Consequential containment impairment is not expected.Very low likelihood event. We consider that the frequency of this scenario is less than 10-7 per year.

187





(Tables A5, A6, A7)

Fuel channel failure due to ageing degradation.

The primary risk area related to this issue is the Negative Impact on Safety.

Fuel channel failure consequences are significant, particularly when taking into consideration the potential for damage to other channels and/or core internals.

Even if fuel channel are ageing, operating experience suggests that the frequency of failure remains low. However, size of the inspection database limits the confidence in predictions.

C2 Most important degradation mechanisms are managed. Operating experience indicate low likelihood of increase in fuel channel failure. The increase of occurrence of fuel channel failure stays less than 5%.

L0 1 Fuel Channel ageing and degradation mechanisms continue to be adequately monitored to ensure that the consequences of ageing on fuel channel integrity are adequately managed.


Age-related changes in core geometry cause changes in core characteristics (e.g. feedback coefficients and power distribution). Control safety function may be degraded.

Difficulty (i.e. insufficient information, data, tools) to assess conditions relevant for safety when compliance verification is impossible.

Control safety function may be degraded.

C1 The size of the inspection database limits the confidence in predictions.

L2 2 -

188




(Tables A1, A2, A3)


The consequences of a pressure tube rupture are assessed under the issue AA 7. Ageing of the pressure tube does not increase the radioactive releases following a pressure tube rupture.

C2 Frequency is not significantly different from, or is the same as that, originally assigned in the Safety Report; re-classification of the event is not necessary.

For core ageing issues, the frequency is unchanged.

L2 2 It takes credit of ageing management plan and LBBs system.


(Table 4)


2 Existing pressure tube life cycle management (CSA N285.8-05), ageing of the pressure tube does not increase the frequency of pressure tube rupture, and therefore does not impact on severe accident risks. However, the number of fuel channels affected is difficult to predict given the limited inspection database.

189


CI 2 Deterioration of Core Internals

Based on the following assessment and taking into account current information, it is recommended to move this issue to a category 2.



(Tables A5, A6, A7)


Impairment of injection Shutdown System. It is also to be pointed out that a contact between a calandria tube and a LISS nozzle would not completely impair Special Shutdown System (SDS)2.


C2 Most important degradation mechanisms are managed. Remaining mechanisms have uncertainty on adequacy of ageing allowances.

L1 2 Assessment assumes that no CT/LISS nozzle measurements are available. With such measurements, the RSL would become 1.


(Tables A1, A2, A3)


For core ageing mechanisms, there may be some increase in consequences.Ageing of the calandria tube does not increase the radioactive releases due to an impairment of one Shutdown System.

C1 Since ageing can be managed to identify and implement correction when necessary, for core ageing issues, the frequency is unchanged.

L2 1


(Table 4)


1 Contact could lead to an impairment of Special Shutdown System (SDS)2; however it is not likely to lead to a complete unavailability of the Special Shutdown System (SDS)2.

190


GL 3 Ageing of Equipment and Structures



(Tables A5, A6, A7)

Failure of SSCs to perform safety function.

Defence in depth is degraded – safety function is impaired.

C2 Ageing of most important SSCs is adequately monitored. The ageing management of the lower safety significant systems is less systematic.

L1 2 Ageing of most important SSCs is currently under control.


(Tables A1, A2, A3)

Mitigating system failure.

For core ageing mechanisms, there may be some increase in consequences. The consequences are directly related to the plant components affected.

C2 Frequency is not significantly different from, or is the same as that, originally assigned in the Safety Report; re-classification of the event is not necessary.

For core ageing issues, the frequency is unchanged.

L2 2 There is a general agreement that the ageing program should be upgrade.


(Table 4)

Mitigating system failure. 2 All or some Safety Goals increase, but remain less than the accepted limits.

191


GL 4 Inadequacy of Reliability DataBased on the following assessment and taking into account current information, it is recommended to move this issue to a category 2.



(Tables A5, A6, A7)

All scenarios of impairment of individual Safety functions.

Inadequate confidence in Probabilistic Safety Assessment (PSA), in reliability, and information used to support operations, maintenance, design etc. The uncertainty in the data for Probabilistic Safety Assessment (PSA) could lead to an underestimation in failure frequency.

C1 The quality of reliability data varies from plant to plant, and ranges from inadequate to adequate.

This has been recognized by the Licensee and there is an action to develop the CANDU-specific database.

L1 1 The impact at the level of individual safety functions and barriers is low.

All scenarios of cumulative impairment of Safety functions and Safety barriers.

Difficulty to assess conditions relevant for safety when compliance verification is impossible.

C2 As per scenario 1. L1 2 -


(Table A4)

The challenges to Safety Goals are underestimated if reliability data are underestimated or overestimated.

2 In general, if reliability data is inadequate, this may manifest itself in increased likelihood and consequences.

192


IH 6 Need for Systematic Assessment of High Energy Line Break Effects



(Tables A5, A6, A7)


Additional SSCs may be damaged as a consequence of a High Energy Line Break.

C3 The issue of high energy line break on the primary side was not fully addressed in the design stage in NPPs other than the Darlington NPP.

Although some information is available, assessing the adequacy of the design requires a large amount of work, given all the possible locations where the breaks and subsequent pipe whip could happen.

However, probabilistic justification was used to minimize the number of locations of high concern.Based on Leak Before Break design it is considered generally unlikely to have large spontaneous high energy line breaks on the primary side.

On primary side the impact of in core LOCA has been assessed.

L0 2 Lack of systematic assessments of high energy line break makes it difficult to estimate and evaluate risks.

Degradation of safety function and barriers.

Defense in depth may be degraded (one or more levels of protection are

C3 Some engineered restraints/barriers/ separation are present to prevent the Systems

L0 2

193


Risk Area Scenario Consequences Likelihood Risk Significance LevelDescription Category Description Category Category Commentsaffected and the safety function is impaired) due to consequential damage to SSCs

Important to Safety from impact of high energy line break.See also discussion on above scenario.


(Tables A1, A2, A3)


Consequential breaks may lead to increased releases.

C2 Based on Leak Before Break design it is considered generally unlikely to have large spontaneous high energy line breaks on the primary side. There is no significant difference in the event frequency from what was considered in the design basis.

L2 2


Impaired mitigating safety functions may lead to increased releases.

C2 See discussion on above scenario.

L2 2


(Table 4)


2 The frequency of high energy line breaks with consequential damage is estimated to be less than 10-5 /y and therefore will not significantly contribute to severe core damage.


2 The frequency of high energy line breaks with consequential damage is estimated to be less than 10-5 /y and therefore will not significantly contribute to severe core damage.

194


PF 15 Molten Fuel / Moderator Interaction



(Tables A5, A6, A7)

Insufficient data to predict melted fuel/moderator interaction.

Difficulty to assess conditions relevant for safety (consequences of Molten Fuel/Moderator Interaction (MFMI)) due to insufficient data.

C2 The energy from Molten Fuel/Moderator Interaction (MFMI) depends on the mode of interaction – free or forced. GAI 95G01 closure criteria includes experiments to demonstrate that a free interaction or steam explosion is unlikely. All the four experimental test results completed to close the GAI 95G01 indicate that the magnitude of the damage and its likelihood are low.

L0 1 Required experimental data to improve knowledge has been obtained.

Fuel melting after stagnation feeder break or severe flow blockage (damage to Special Shutdown System (SDS)1).

Impairment of Special Shutdown System (SDS)1 (deformation of SOR guide tubes) due to the loads caused by the energy from MFMI following stagnation feeder break or flow blockage.

C2 The experimental results indicate that the magnitude of the damage and its likelihood are low.

L0 1

Fuel melting after stagnation feeder break or flow blockage(multiple channel failure).

Multiple channel failures could be caused by the energy from MFMI.

C2 The energy from MFMI depends on the mode of interaction – free or forced. GAI 95G01 closure criteria include experiments to determine the nature of the interaction. The experimental results indicate that the magnitude of the damage and its likelihood are low.

L0 1

Fuel melting after stagnation

Impairment of Special Shutdown System

C3 The energy from MFMI depends on the mode of

L0 2

195



feeder break or flow blockage.(impairment of Special Shutdown System (SDS)1 and ECI)

(SDS)1 and ECI caused by the energy from MFMI.

interaction – free or forced. GAI 95G01 closure criteria include experiments to determine the nature of the interaction. The experimental results indicate that the magnitude of the damage and its likelihood are low.


(Tables A1, A2, A3)

Fuel melting after stagnation feeder break or flow blockage (Impairment of Special Shutdown System (SDS)1 and ECI).

Containment integrity is not challenged; however, we expect increased dose, but not significant increase.

C2 The energy from MFMI depends on the mode of interaction – free or forced. GAI 95G01 closure criteria include experiments to determine the nature of the interaction. Likelihood is estimated to be low based on test results.

L2 2


(Table A4)

Severe core damage due to consequential failure of Special Shutdown System (SDS)1 and multiple channel failure, due to the energy from MFMI following stagnation feeder break or flow blockage

2 Severe core damage frequency may slightly increase, however, based on experimental results this is not expected to lead to exceed safety goal for severe core damage and as the containment is not challenged, we do not expect increase of the release frequency and magnitude beyond the current Safety Goals.

196


PF 18 Fuel Bundle / Element Behaviour under Post-Dryout Conditions



(Tables A5, A6, A7)

Small loss of coolant.

Fuel FailuresPotential multiple pressure tubes failure.

C3 A probability lower than 5% is assumed for pressure tubes failure.

L0 C3*L0–> 2

Small loss of coolant and deflated airlocks.

Fuel FailuresPotential multiple pressure tube failures.

C3 A probability lower than 5% is assumed for pressure tubes failure.

L0 C3*L0–> 2

Single Pump trip. Fuel FailuresPotential multiple pressure tube failures.

C3 A probability lower of 5% is assumed for pressure tubes failure.

L0 C3*L0–> 2

Insufficient data to understand the behavior of element under post-dryout condition.

Difficulty in assessing the fuel behaviour under post dry-out conditions.

C2 The CNSC indicated a there is a lack of information to establish the element behavior; however the Industry is more optimistic about the data.

L1 (Industry)orL2(CNSC)

C2*L1–> 2(Industry)orC2*L2–> 3(CNSC)


(Tables A1, A2, A3)

Small loss of coolant.

Bounded by LLOCAECI effective inLOCA in 2-loops.

C2 L1 C2*L1–> 1

Small loss of coolant and deflated airlocks.

Bounded by LLOCAECI effective inLOCA in 2-loops.

C2 L1 C2*L1–> 1

Single Pump trip. Bounded by LLOCA C2 L2 C2*L2–> 2

197


Risk Area Scenario Consequences Likelihood Risk Significance LevelDescription Category Description Category Category CommentsECI effective inLOCA in 2-loops.


(Table 4)

SLOCA 2

SLOCA + Deflated airlock 2Single Pump trip 2

198


PF 19 Impact of Ageing on Safe Plant Operation



(Tables A5, A6, A7)



Licenses need to make sure that ageing effects are taken into account when establishing appropriate operating limits and conditions.

The consequences are directly related to the plant components affected.

Defence in depth is degraded and safety function is impaired.

C2 Ageing phenomena are addressed throughout plant life cycle management programs.

The ageing management of the lower safety significant systems is less systematic.

L1 2 -


(Tables A1, A2, A3)


Consequences increase compared to those originally presented in the Safety Report due to inadequate accounting for ageing effects such as safety system reliance on aged instruments, systems or components to perform as designed under accident conditions; ageing effects not taken into account establishing operating limits and conditions and in setting

C2 Frequency potentially increased relative to that originally presented in the Safety Report.

Ageing phenomena are addressed throughout plant life, although not as systematic as for major components.

L2 2 -

199


Risk Area Scenario Consequences Likelihood Risk Significance LevelDescription Category Description Category Category Commentstrip parameters.There may be some increase in consequences due to the impact of core ageing mechanisms.


(Table 4)


2 All or some Safety Goals increase, but remain less than the accepted limits.

200


PF 20 Analysis Methodology for NOP / ROP ROP Trips



(Tables A5, A6, A7)

Incorrect prediction of NOP trip setpoints from the analysis methodology (missing flux shapes that might be more limiting, or incorrect prediction of uncertainties in flux shapes, or incorrect application of correction factors, etc).

Difficulty to assess confidence of NOP trips to prevent dryout.

C2 There are concerns that NOP trip set-points, based on the recently proposed methodology, are too high and that fuel dryout will not be prevented with the required level of confidence, given the results of the ITR.

L1 2 The results of an Independent Technical Review (ITR) by an Independent Technical Panel of the Industry recently proposed methodology has indicated that:“Although the methodology appears to have a sound technical basis, additional justification, supplemental analyses, and/or revisions are required prior to its final acceptance in the regulatory process.”

Fuel deformation leading to fuel element / PT contact under dryout conditions resulting from NOP trip issues.

Difficulty to assess fuel and fuel channel integrity under post-dryout conditions.

C2 There are concerns that NOP trip set-points based on recently proposed methodology are too high and that fuel dryout will not be prevented with the required level of confidence, given the results of the ITR.

L1 2 Lack of evidence regarding fuel behaviour following dryout. Refer to issue PF 18.

Cannot prevent dryout following slow loss of regulation, due to NOP trip issues, leading to fuel failures.

One barrier (fuel) is lost.

C3 There are concerns that NOP trip set-points points based on recently proposed methodology are too high and that fuel dryout will not be prevented with the required level of confidence, given the results of the ITR.

L1 3 Due to some uncertainty of the impact of fuel deformation and its impact on fuel channel integrity we have considered the scenario with fuel damage.

201



Slow Loss of Regulation (SLOR) is a high frequency event, and it must be assumed that if there is fuel dry out, the barrier fails (is more than degraded, there is a strong link to PF 18), so the likelihood is estimated to be in the 1 to 10% range (L0 is < 5%).

Lack of evidence regarding fuel behaviour following dryout.

It must be assumed that if there is fuel dry out, the barrier fails (is more than degraded). This issue is strongly linked to PF 18.

Cannot prevent dryout following slow loss of regulation due to NOP trip issues and there is single fuel channel failure.

Two barriers (fuel and Primary Heat Transport (PHT)S) are degraded and fuel cooling function is degraded.

C3 Channel failures is estimated to be unlikely (overall event frequency < 5%).

L0 2 Due to some uncertainty of the impact of fuel deformation and its impact on fuel channel integrity we have considered the scenario with fuel damage and consequential fuel channel failure or fuel channel damage.

Lack of evidence regarding fuel behaviour following dryout. Refer to issue PF 18.


Two barriers (fuel and PHTS) are degraded and fuel cooling function is degraded.

C3 Multiple channel failures is estimated to be very unlikely (overall event frequency <5%).

L0 2 Due to some uncertainty of the impact of fuel deformation and its impact on fuel channel integrity we have considered the scenario with fuel damage and consequential fuel channel failure or fuel channel damage.

202



Lack of evidence regarding fuel behaviour following dryout. Refer to issue PF 18.


(Tables A1, A2, A3)

Cannot prevent dryout following slow loss of regulation due to NOP trip issues leading potentially to some fuel failure.

Consequence may be bounded by DBAs with fuel damage (e.g. LOCA).

C1 Slow loss of regulation has frequency in 10-1 -10-2 range.

Frequency of occurrence of a flux shape may not be fully covered by a NOP trip is judged to be in the 10-4 range as 2% of slow LOR flux shapes may not be covered by a NOP trip.

L2 1 No fuel channel failure.


Consequences will be comparable to, but likely less than other DBA events, such as single channel events stagnation feeder break or channel blockage.

C2 Slow loss of regulation has frequency in 10-2 range.

Frequency of occurrence of a flux shape may not be fully covered by a NOP trip is judged to be in the 10-4 range as 2% of slow LOR flux shapes may not be covered by a NOP trip.

Likelihood of fuel failure if dryout occurs, and consequential failure of a single fuel channel is judged to be 0.1.Estimated frequency for this scenario of the order of 10-5.

L2 2 Single channel failure and there may be fuel failure in several channels.

Cannot prevent dryout following slow loss of regulation due to NOP trip issues and there are multiple fuel channel

Scenario is a multi-point LOCA for which ECC may not be effective. Loss

C2 Slow loss of regulation has frequency in 10-2 range.

Frequency of occurrence of a flux shape may not be fully

L2 2 Multiple scenarios have been considered to reflect the relatively high degree of uncertainty with respect

203



failures. of moderator is also possible. Containment is not affected.

Consequences may be similar to Ex-Plant Release Category 5 (EPRC-5).

covered by a NOP trip is judged to be in the 10-4 range as 2% of slow LOR flux shapes may not be covered by a NOP trip.

Likelihood of fuel failure if dryout occurs, and consequential failure of several fuel channels is judged to be 1%.

Estimated frequency for this scenario is below 10-5 /y.

to fuel and fuel channel behaviour under post-dryout conditions.

Experimental data do not solve the absence of knowledge to evaluate the number of channel that may be affected in this scenario.


(Table 4)


1 This scenario represents the lower bound regarding the behaviour fuel and its interaction with fuel channel under post-dryout.

Cannot prevent dryout following slow loss of regulation due to NOP trip issues, fuel failures occur and there are multiple fuel channel failures. ECC is not effective and moderator heat sink may be lost.

2 High uncertainty of fuel behaviour under dryout conditions, as well, there is relatively high uncertainty in the number of channel affected. It is a BDBA (low likelihood) with significant consequence issue.

204


Probabilistic Safety Assessment (PSA) 3 Open Design of Balance of Plant - Steam Protection



(Tables A5, A6, A7)

Steam/feedwater line breaks outside containment resulting in high pressure steam in turbine hall and, with the failure of other SSCs, consequential core damage and containment failure due to loss of support systems.

The concern here is the adequacy of the design of the BOP to protect System Structure Component (SSC) needed to mitigate accidents and do post-accident monitoring.

Defence in depth is insufficient or unacceptable.

Consequential effect is loss of support systems to cool and contain (e.g., HVAC, EFADs, ACUs etc) (instrument air, electrical).

C3 If a steam/feedwater line breaks outside containment, the BOP design is not adequate for large breaks, and not completely adequate for medium and small breaks (ventilation helps some for small and medium breaks, but not adequate for large breaks).

At intermediate and large breaks there is a small probability that hostile environment will cause failure of essential System Structure Component (SSC) even when PEVS works.

At small breaks, the probability of failure of essential SSC is smaller as it requires PEVS failure.

L0 2 For instance, EPS does not supply power to service water. This issue is applicable only to multi-unit plants. Moreover it has already been addressed by some plants.


(Tables A1, A2, A3)

Steam/feedwater line breaks outside containment resulting in high pressure steam in turbine hall and, with the failure of other SSCs, consequential core damage and containment failure due to loss of

Steam/feedwater line breaks ultimately result in severe core damage and containment failure.

C4 Steam/feedwater line breaks and consequential failure of essential System Structure Component (SSC) due to hostile environment has a frequency below 10-5 /y.

L1 3(2, due to very low likelihood In fact this sequence is considered below the DBA frequency threshold whereas this criteria is for DBA.)

The contribution of secondary side breaks to severe core damage cumulative frequency for some plants indicates an unbalanced

205


support systems. design.


(Table 4)

As per Risk of Negative Impact on Safety.

2 Safety Goals are met, but the contribution of secondary side breaks to severe core damage cumulative frequency for some plants indicates an unbalanced design.

206


SS 1 ECCS Sump Screen Adequacy

Based on the underneath assessment and taking into account current information, it is recommended to move this issue to a category 1.


Risk of Negative Impact on Safety

(Tables A5, A6, A7)

LOCA + consequential loss of recirculation (Strainer partially blocked due to fouling/chemical effects and subsequent pump cavitation results in recirculation pumps not being able to inject water into core to cool the fuel).

Incomplete restoration of safety.Defence in depth is degraded (safety function is impaired).

C2 There are still uncertainties with regards to the effect of chemical effects on strainer fouling and subsequent blockage.

Based on current knowledge of chemical effects, the likelihood for impairment due to chemical effects is estimated to be 5 to 25% (the range in strainer area is quite large amongst the Canadian plants).

The results of testing have reduced uncertainties in estimating the likelihood of strainer blockage.

CANDU utilities are also updating the appropriate chemistry control documentation.

L1 2 This should be a 1 given that the likelihood of the event and the consequences are very low.

Radiological risk to public at DBA

(Tables A1, A2, A3)

LOCA + consequential loss of recirculation (Strainer partially blocked due to fouling/chemical effects and subsequent pump cavitation results in recirculation pumps not being able to inject water into core to cool the fuel).

Consequential loss of ECC recirculation will lead to additional fuel failures.

For Darlington, public doses for this scenario is less than dose limits for LOCA (LOCA dose is well below the C6R0 (0.3% of the Class 3 (LLOCA)) dose limit), but with loss of ECC recirculation, the dose

C1 Frequency of LOCA (10-2 (small LOCA) to 10-4 (Large LOCA)) as a DBA is not significantly changed with likelihood of ECC impairment with loss of long-term recirculation.

L2 1 -

207


is ~11mSv (~40% of the Class 3 dose limit of 30).

LOCA + Consequential Loss of recirculation + Failure of containment(Strainer partially blocked due to fouling/chemical effects and subsequent pump cavitation results in recirculation pumps not being able to inject water into core to cool the fuel).

The severity depends on the degree of strainer fouling, and the time at which ECC begins to be impaired. The scenario with impaired containment is already in the Safety Report; the consequential failure of the long term ECC does not significantly affect the radioactive release. Based on new information the strainers are not expected to fouled.

C1 Frequency of LOCA + Loss of Containment as a DBA is not changed significantly if there is strainer blockage. Considering the small likelihood of the strainers blockage, the overall scenario of is a BEYOND DESIGN BASIS ACCIDENT (BDBA).

L1 1 -


(Table A4)

LOCA + Consequential Loss of recirculation (Strainer blockage leads to increased probability of failure of ECC recirculation in comparison with that determined in the Probabilistic Safety Assessment (PSA). Therefore, we expect that Core Damage Frequency (CDF) and other Safety Goals will be greater than previously determined in the Probabilistic Safety Assessment (PSA). However, likelihood of significant blockage is low, therefore change in Core Damage Frequency (CDF) is expected to be small. Values will depend on specific plant configuration.)

1 The ranking reflects the risk significance of ECC recirculation.

208


SS 5 Hydrogen Control Measures during Accidents


Risk of Negative Impact on Safety

(Tables A5, A6, A7)

Large LOCA Containment damage due to hydrogen combustion or detonation loads. Containment performance is degraded as hydrogen generated during Large LOCA not as much as for Small /Large LOCA + LOECC, and water radiolysis during LOCA conditions leads to continuous generation of hydrogen.

However, fission product release for LLOCA with working ECC is low.

C2 We are somewhat sure of the ability of plant SSC to deal with hydrogen to prevent damage (i.e. containment venting promotes mixing and removes hydrogen from atmosphere) due to the fact the we think that hydrogen production is relatively low and installed equipment and mixing can handle hydrogen.

Early burns at low concentrations help removing hydrogen and are unlikely to damage containment.

L1 2 Based on the collection of information to date, there is a reasonably high level of confidence that PARs are robust and would enhance the effectiveness of hydrogen mitigation as well as reduce the potential threat of hydrogen burns. Evaluations of the AECL PARs performance with respect to effectiveness under post-accident containment conditions have been conducted, taking into account the delayed self-start characteristics of PARs with potentially degraded catalyst plates.

As part of the basis for closure of GAI 88G02, Licensees have agreed to install Passive Autocatalytic Recombiners (PARs) to improve hydrogen control during accidents.

209



Large LOCA + LOECC

Containment damage due to hydrogen loads :At LOCA+LOECC containment is the only barrier to prevent off-site releases of fission products (perform contain function).

The presence of PARs reduces the negative impact on defence in depth. However, the difficulty to assess conditions relevant to safety when compliance verification after installation of PARs is for the moment impossible.

C3 Amount of H2 production is high, likelihood of H2

leading to containment damage is low because:• Igniters;• Removal of hydrogen

by venting;• Burn before reaching

detonation are very likely;

• May not detonate even if limit is reached.

L0 2 See above comments.

Small LOCA + LOECC

Damage to SSC used for Mitigating & Manageing Accidents due to hydrogen loads following hydrogen detonation: The difficulty to assess conditions relevant to safety when compliance verification after installation of PARs is for the moment impossible.

C3 Amount of H2 production is high, likelihood of H2

leading to containment damage is low because:• Igniters;• Removal of hydrogen by

venting;• Burn before reaching

detonation are very likely;

• May not detonate even if limit is reached.

L0 2 See above comments

Radiological Risk to Public at DBA

(Tables A1,

Large LOCA Consequences of Large LOCA and consequential containment damage are similar to those for Large LOCA and random containment impairment.

C1 Consequential containment failure following Large LOCA has a very small probability.

Frequency of Large LOCA

L2 1 The Industry has developed a sufficient understanding of hydrogen behaviour during accidents, and has developed

210



A2, A3) and consequential containment damage is assumed similar with that for Large LOCA and random containment impairment. These two DBA scenarios are in the same class, having the same dose limits.

technology to effectively manage both short- and long-term hydrogen productions during accidents.

Large LOCA + LOECC

Large LOCA + LOECC and consequential failure of containment due to lack of hydrogen control is a BEYOND DESIGN BASIS ACCIDENT (BDBA) with significant offsite consequences

C2 Large LOCA + LOECC and consequential containment damage assessed to have frequency less than the DBA frequency limit.


Small LOCA + LOECC

Small LOCA + LOECC and consequential failure of containment due to hydrogen combustion loads is a BEYOND DESIGN BASIS ACCIDENT (BDBA) with severe off-site consequences.

C2 Small LOCA + LOECC and consequential containment damage within design basis assessed to have frequency not significantly different from originally assigned in the Safety Report.


211


Risk Area Scenario Risk Significance Level

Comments

Severe Accidents Risks

(Table A4)

LOCA (Large or Small) + LOECC + Loss of Moderator as a Heat Sink (due to any other failure) and containment is damaged due to hydrogen burned.

2 The core is already damaged, but off-site releases increase for a large number of sequences, causing significant increase of the Safety Goals (i.e. LRF).

LOCA (Large or Small) + LOECC + Loss of Moderator due to H2 deflagration (SA with containment failure, large release safety goal is to be considered) - in this scenario, the probability is very low but the consequences will be very high; the probability is low because there would only be a small amount of hydrogen produced by the channels affected by the LOCA, and this small amount of hydrogen is unlikely to explode and result in loss of moderator, and then loss of containment (since moderator no longer working). Also, PARs are robust and would enhance the effectiveness of hydrogen mitigation as well as reduce the potential threat of hydrogen burns.

2 Likelihood very low, consequences very high.Core is already damaged, but release goes up and could be significantly increased we don’t know.

LOCA (Large or Small) + LOECC + Loss of Containment integrity due to H2 deflagration.

2 Consequential containment failure due to hydrogen combustion loads at LOCA+LOECC causes increase of off-site releases and of the related Safety Goals (i.e. LRF, SRF).

212


Large LOCA

AA 8 Analysis for Moderator Temperature Predictions



(Tables A5, A6, A7)


Inadequate confidence in safety analysis results due to analysis issues.

C1 The related GAI (95G05) is being closed based on completion of code validation work. Now, according to CNSC staff, the issue is assessing the outputs of the code - the code is validated. What this validated code tells us about the adequacy of moderator cooling is treated under the other scenario discussed below.

L1 1

Failure of several Fuel Channels due to Inadequate Cooling under a LOCA.

Cooling safety function impaired and barriers impaired (both additional fuel failures and fuel channel failures resulting in release of tritium from moderator to containment).

C2 The code is now validated, so we have increased confidence in the code predictions.

It is considered that there is less than 5% chance that the moderator is not effective as credited.

L0 1


(Tables A1, A2, A3)

Consequential CT/PT Failure because of inadequate sub-cooling during a LOCA, (or LOCA with consequential LOECC).

If there is inadequate sub-cooling, may get PT/CT failure, then additional releases due to fuel failures and due to release of tritium from moderator to containment

Since there is no evidence that containment would consequentially failed, it

C2 Inadequate sub-cooling has no impact on LOCA frequency.

This is where the uncertainty in the adequacy of the code vis-à-vis predictions comes into consideration, if the code significantly underpredicts sub-cooling , then greater

L1 1 Only consequences are worse, frequency remains the same.

213


Risk Area Scenario Consequences Likelihood Risk Significance LevelDescription Category Description Category Category Commentsis estimated that the doses would remain low.

likelihood of entering SA regime.

However, likelihood of consequential PT / CT failure is lower with validated code, although the adequacy of moderator cooling, based on use of the validated code, has yet to be determined.


(Table 4)


1 If moderator fails to do its function, reactor enters SA regime. There are uncertainties regarding the number of channel failures, and progression to severe core damage.

214


AA 9 Analysis for Void Reactivity Coefficient



(Tables A5, A6, A7)

Code prediction of the coolant void reactivity (Coolant Void Reactivity (CVR)) may be under-predicted due to inadequate validation.

Difficulty in assessing the Coolant Void Reactivity (CVR) during a Large LOCA.

C2 We are not sure whether the coolant void reactivity (Coolant Void Reactivity (CVR)) is under-predicted.

L2 3 Based on reviews of the information on code validation for the prediction of the void coefficient reactivity, it is considered that the confidence in the prediction of this parameter is relatively good. There is acknowledgement that WIMS over-predicts the Coolant Void Reactivity (CVR).

CVR is under-predicted during a Large LOCA, but this does not affect the prediction that there is no fuel channel failure occurring.

Levels of protection / safety functions are affected but not significantly.

C1 It is possible that the CVR is under-predicted.

L1 1 Based on information presented to support the closure request of the GAI 95G04, it is considered that the conditions that may lead to fuel channel failures are very unlikely.There is acknowledgement that WIMS over-predicts the CVR.

Fuel channel integrity may be affected due to under-prediction of the CVR at Large LOCA with multiple consequential fuel channel failures occurring.

Impairment of safety functions (contain) and / or barriers (fuel, fuel channel).

C2 We are not sure whether the CVR is under- or over-predicted, but there is acknowledgement that WIMS overpredicts the CVR.

L0 1 Based on information presented to support the closure request of the GAI 95G04, it is considered that the conditions that may lead to fuel channel failures are very unlikely.

Fuel channel integrity may be affected due to under-prediction of the CVR at smaller voiding rates, - fuel channel failures not occurring.

There is still at least one trip before dryout. Fuel remains adequately cooled but one level of safety is compromised.

C1 L1 1 This scenario addresses cases where the voiding rate is not as great as in a large LOCA.

215




(Tables A1, A2, A3)

Increased doses to public when CVR is under-predicted during a Large LOCA, but without fuel channel failure occurring.

The consequences are compared with limits for the DBA. The consequences are related to the behaviour of fuel and fuel channel behaviour (PF 9 and 18), there is likely a small increase in releases.

C2 The probability of having CVR under-predicted such that fuel / fuel channels will fail during a Large LOCA is low.

The cumulated frequency is in the same range as for Large LOCA.

L2 2 The risks are dependent on the degree and the likelihood of under-prediction of the CVR.

The event frequency is in fact below the frequency for DBA. This event could be reclassified as a BEYOND DESIGN BASIS ACCIDENT (BDBA) event.

Increased doses to public due to fuel failure / fuel channel failure when CVR is under-predicted during a Large LOCA with consequential multiple fuel channel failures.

The consequences are compared with limits for the DBA. The consequences are related to the behaviour of fuel and fuel channel behaviour (PF 9 and 18), but depends on performance of ECC, and moderator.

The consequences of a Large LOCA, with consequential FC failures is potentially very significant, even with good containment performance.

More info is needed to assess if the 20 mSv dose acceptance criterion (in RD-337) will be met.

C2 The cumulated frequency is in the same range as for Large LOCA.

However, the probability of having CVR under-predicted such that fuel / fuel channels will fail during a Large LOCA is low.

L2 2 The risks are dependent on the degree and the likelihood of under-prediction of the CVR.

The event frequency is in fact below the frequency for DBA. This event could be reclassified as a BEYOND DESIGN BASIS ACCIDENT (BDBA) event.

216



(Table 4)

Safety Goals unchanged if no fuel channels fail at LOCA due to under-prediction of CVR.

2 The risks are dependent on the degree and the likelihood of under-prediction of the CVR.

Considering the current accepted limits on summed severe core damage frequency for existing plants and the frequency of Large Break Loss of Coolant Accident (LBLOCA), the summed severe core damage frequency will not exceed the limits even in the bounding assumption that large LOCA is assumed to lead to severe core damage. Therefore the possible under-prediction in CVR may only have a limited impact on severe core damage frequency.

217


PF 9 Fuel Behaviour in High Temperature Transients



(Tables A5, A6, A7)

Fuel behaviour under high temperature transients.

Difficulty to assess fuel and fuel channel integrity in high temperature transients

C2 The safety analysis of Large Break Loss of Coolant Accident (LBLOCA) shows that for some worst cased fuel experience temperature transients in the range for which no CANDU-prototypical experimental data exists.

Modelling of fuel bundle behaviour in the high fuel temperature range is lacking adequate validation and the credibility of code predictions under such conditions is low.

L2 3


ECC rendered ineffective - cooling safety function may be significantly impaired.

C3 Extent and locations of damaged channels is unknown due to inadequate knowledge of high temperature fuel behaviour.

L0 2 There is a good validation basis for fuel behaviour under large LOCA under most conditions. For extreme LOE conditions, prevailing during a combination of limited period of time (startup) and unlikely conditions (low HTS isotopic, high fuel channel creep, high tilts, etc.) the fuel may be subject to conditions that are outside the validation basis.


C2 L1 2

218




(Tables A1, A2, A3)

Large LOCA leading to high fuel temperatures and consequential multiple fuel channel failures.

Consequences judged to be similar to LOCA + LOECC. For Darlington, LOCA + LOECC dose is less than the LOCA dose limit, but more detailed verification relative to the RD-337 20 mSv dose limit for DBAs is needed.

C2 Scenario is judged to be less likely than Large LOCA. Assumed <10-5.

See discussion for AA9.

L2 2


(Table A4)


2 The frequency of a Large Break Loss of Coolant Accident (LBLOCA) where it progresses to multiple fuel channel failure failures is so small that even if it leads to severe core damage, it will not be a significant contributor to the overall risk.

219


PF 10 Fuel Behaviour in Power Pulse Transients



(Tables A5, A6, A7)

Fuel behaviour under CANDU Power Pulse conditions.

Difficulty to assess fuel and fuel channel integrity in large power pulse transients.

C2 The safety analysis of Large Break Loss of Coolant Accident (LBLOCA) shows that fuel experience rapid energy deposition in the range for which no CANDU-prototypical experimental data exists.

Modelling of fuel bundle behaviour in the high energy deposition range is lacking adequate validation and the credibility of code predictions under such conditions is low.

L2 3 Under most large LOCA conditions the power pulse remains comparable to power pulses for which experiments exist. For extreme LOE conditions, prevailing during a combination of limited period of time (start up) and unlikely conditions (low HTS isotopic, high fuel channel creep, high tilts, etc.) the fuel may be subject to conditions that are outside the validation basis.


ECC rendered ineffective - cooling safety function may be significantly impaired.

C3 Extent and locations of damaged channels is unknown due to inadequate knowledge of fuel behaviour in power pulse.

L0 2 See above discussion.


Multiple fuel failure consequent to high power pulse

C2 L1 2


(Tables A1, A2, A3)


Consequences judged to be similar to LOCA + LOECC. For Darlington, LOCA + LOECC dose is

C2 Scenario is judged to be less likely than Large LOCA. Assumed <10-5.

Same event class as in Safety Report – within

L2 2

220


Risk Area Scenario Consequences Likelihood Risk Significance LevelDescription Category Description Category Category Commentsless than the LOCA dose limit, but more detailed verification relative to the RD-337 20 mSv dose limit for DBAs is needed.

design basis.


(Table 4)

Large LOCA leading large power pulse and therefore multiple fuel channel failures.

2 The frequency of a Large Break Loss of Coolant Accident (LBLOCA) where it progresses to multiple fuel channel failure failures is so small that even if it leads to severe core damage, it will not be a significant contributor to the overall risk.

221


PF 12 GAI 00G01 Channel Voiding during a Large LOCA

Risk Area Scenario Consequences Likelihood Risk Significance LevelDescription Categor

yDescription Category Category Comments


(Tables A5, A6, A7)


If voiding rate is underestimated, the larger power pulse may cause the fuel channels to fail. Failures cannot be prevented by Special Shutdown System (SDS) action.

Multiple channel failures make ECCS ineffective. Barriers and the fuel cooling function may be lost.

Consequences may be more severe than LOCA + LOECC because fuel temperatures are higher. Using Darlington as an example, the LOCA + LOECC dose is less than the C6 Rev 0 dose limit for LOCA so even with multiple channel failures, the dose limit may still be met.

C2 Currently, we accept the code prediction of the voiding rate, although it has limited precision and the uncertainty in the measurement is high.

CATHENA and TUF are considered to be reasonably state-of-the-art and CNSC and the Industry accepts that “this is the best that can be done”.

L1 2 The margins to the derived acceptance criteria for large LOCA are small. The uncertainty estimation and sensitivity analysis needed to determine the possible consequences has not been submitted yet.

Furthermore there is not a good experimental database for CANDU fuel limits under power pulse conditions (Issues PF 9, 10).

Base on RD14M scaling.

Risk Area Scenario Risk Significance Level CommentsSevere Accidents Risks(Table 4)


2 All Safety Goals are met.

222

Risk Matrices

APPENDIX C. RISK MATRICES10

Table A1: Criteria for Consequence Categories for Radiological Risk to Public at Design Basis Accidents (DBA)

ConsequenceCategory

Criteria

C1- No significant additional radioactive releases would occur, such that the public doses calculated in the existing Safety Report are expected to be bounding.

C2- The radioactive releases would lead to public doses greater than those determined in the Safety Report, but still less the limits for the applicable class of the accident.

C3- The radioactive releases would lead to public doses may exceed the limits for the applicable class of the accident. The releases would not trigger evacuation.

C4 - The radioactive releases would require initiation of evacuation.

Table A2: Criteria for Likelihood Categories for Radiological Risk to Public at Design Basis Accidents (DBA)

LikelihoodCategory

Criteria

L1- Frequency of accident scenario is greater than 10-7 /year but less than the DBA frequency limit; the accident is beyond design basis.

L2- Frequency is not significantly different from, or is the same as that, originally assigned in the Safety Report; re-classification of the event is not necessary.

L3- Frequency of the accident scenario is significantly greater than that considered in the Safety Report; the accident sequence may have to be re-classified into a higher frequency category (example: from Class 3 to Class 2 in C-6, or from DBA to Anticipated Operational Occurence (AOO) in S-310).

Table A3: Risk Matrix for Radiological Risk to Public at DBA

CO

NSE

QU

ENC

ES

C4 3 4 4

C3 1 3 4

C2 1 2 3

C1 1 1 2

L1 L2 L3

LIKELIHOOD10 The risk matrices presented in this appendix are directly taken from reference 9.3.

223

Risk Matrices

Table A4: Risk Matrix for Severe Accidents Risks

Risk Level Criteria

1 - The increase of the Safety Goals11 is negligible.

2 - All or some Safety Goals increase, but remain less than the accepted limits.

3 - All or some Safety Goals may exceed the accepted limits.

4 - All or some Safety Goals significantly exceed accepted limits

Table A5: Qualitative Criteria for Consequence Categories for Risk of Negative Impact on Safety

ConsequenceCategory

Criteria

C3- Defense in depth is insufficient or unacceptable (one or more barriers are lost, or the safety function is disabled). - Impossibility (i.e. lack of knowledge, data, tools) to assess conditions relevant for safety when compliance verification is impossible. - Continuous deterioration of plant safety. - Excessive increase of the time at risk of plant operation.

C2- Defense in depth is degraded (one or more barriers are affected, or the safety function is impaired). - Difficulty (i.e. insufficient information, data, tools) to assess conditions relevant for safety when compliance verification is impossible. - Incomplete restoration of safety. - Significant increase of the time at risk of plant operation.

C1- Levels of protection / safety functions are affected but not significantly. - Inaccuracy of data, models and code predictions. - Non-sustainable long term safe operation. - Increase of the time at risk of plant operation.

11 For the purpose of this table, the Safety Goals are quantitative risk indicators specific to severe accident conditions, calculated in PSA. The quantitative Safety Goals defined in RD-337 are Core Damage Frequency, Large Release Frequency and Small Release Frequency

224

Risk Matrices

Table A6: Criteria for Likelihood Categories for Risk of Negative Impact on Safety

Likelihood Category Criteria

L3 - The consequences will very likely occur (> 75% chance).

L2 - The consequences will likely occur (25% - 75% chance).

L1 - The consequences are unlikely to occur (< 25% chance).

L0 - The consequences are highly unlikely top occur (<5% chance).

Table A7: Risk Matrix for Risk of Negative Impact on Safety

225

Risk Control Measures Assessment For Category 3 Issues

APPENDIX D. RISK CONTROL MEASURES ASSESSMENT FOR CATEGORY 3 ISSUES

1. Introduction

The basis for the assessment of the Risk Control Measures for the Category 3 issues is provided in 9.3. As described in 9.3 during that assessment the team discusses the advantages and disadvantages of the various Risk Control Measures (RCM). The team re-considers each risk scenario for which they found the risk as tolerable or unacceptable. For each scenario the team identifies possible risk control options to reduce or transfer the risk. This is done by reducing either the probability of occurrence, or the consequences.

The team should analyze the trade-offs among the range of options, rank the risk control options and, for each option, determine the residual risk associated with each scenario. In selecting the preferred option the team should also balance the cost of reducing the risk against the benefits obtained. However, economic considerations should not dominate when determining the preferred option. The team should also consider the possibility of combined risk control options.

In addition, the following key elements are considered when assessing risk control measures:

• The Risk Control Measures recommended to the decision makers are commensurate with the significance of the risk.

• The control measures should focus on addressing the more significant risks associated with the matter of concern.

• The degree of “severity” and “urgency” of the actions depends not only on the risk significance level, but on all the inputs to the decision makers.

• The risk in the intolerable region should be ruled out unless Risk Control Measures (RCM) are implemented to bring the level of risk into the lower regions.

• Within both the tolerable and acceptable ranges, additional Risk Control Measures (RCM) should be taken if it is reasonable to do so.

In order to get more detailed guidance to assess Risk Control Measures (RCM), the RIDM issue team consulted the RIDM process team to get clarifications on how to combine the opinions of the various CNSC and Industry experts to define a recommended path forward to reduce the

226

CO

NSE

QU

ENC

ESC3 2 3 4 4

C2 1 2 3 3

C1 1 1 2 3

L0 L1 L2 L3

LIKELIHOOD


risks associated to the Category 3 issues. The assessment of candidate Risk Control Measures is a decision-making process that involves both quantitative and qualitative evaluation criteria. Expert Elicitation Process (EEP) and the Multi-Attribute Decision-Making (MADM) process have been chosen for this purpose. The Analytic Hierarchy Process (AHP) is a widely used and recognized technique for MADM. In science, engineering, and research, Expert Elicitation is the synthesis of opinions of experts in a subject where there is uncertainty due to insufficient data or when data is unattainable because of physical constraints or lack of resources. Expert Elicitation is essentially a scientific consensus methodology. It is often used in the study of rare events.

Even if the methodology is well-established, its implementation for a particular application such as the assessment of the Risk Control Measures (RCM) for the Category 3 CANDU Safety Issues needs to be defined. The following section provides some detailed guidance on the use of the Expert Elicitation Process (EEP) to assess the Category 3 Safety Issues. It is to be pointed out that there have been some discussions between the various RIDM participants, including the Steering Committee, the RIDM Process Team (RPT) and the RIDM Issues team on the process that should be applied to assess the Risk Control Measures (RCM) identified to address the Category 3.The description below corresponds to the process as it has been applied and reflects the time constraints under which the Working Group had to operate. The application of the process to the Large Break Loss of Coolant Accident (LBLOCA) issues is also presented below.

2. Expert Elicitation Process

The Expert Elicitation Process is a structured system for helping decision makers deal with complex decisions. Rather than prescribing a correct decision, the Expert Elicitation Process (EEP) helps people to determine one using mathematics and psychology. The Expert Elicitation Process (EEP) provides a comprehensive and rational structure for decomposing a problem, for representing and quantifying its elements, for relating those elements to overall goals, and for evaluating alternative solutions. The Expert Elicitation process (EEP) and the Analytic Hierarchy Process (AHP) are well-established 9.3 methods, that have already been used to support the decision making process in various industries, including the Nuclear Industry outside (9.3 and 9.3) and inside Canada 9.3.

The first step of Expert Elicitation Process (EEP) is to decompose the decision problem into a hierarchy of more easily comprehended sub-problems, each of which can be analyzed independently. The elements of the hierarchy can relate to any aspect of the decision problem, tangible or intangible, like core damage frequency or public perception.

Once the hierarchy is built, the decision makers systematically evaluate its various Risk Control Measures (RCM), comparing them to one another in pairs. In making the comparisons, the decision makers can use concrete data about the elements, or they can use expert judgments about the RCM relative meaning and importance. It is the essence of the EEP that expert judgments, and not just the underlying information, can be used in performing the evaluations.

It is considered well suited for application to RIDM since

• The expert judgments is playing a key role;

227

http://en.wikipedia.org/wiki/MCDA

http://en.wikipedia.org/wiki/Hierarchy

http://en.wikipedia.org/wiki/Psychology

http://en.wikipedia.org/wiki/Mathematics


• Commonly accepted set of criteria available;

• Part of it is a strictly ‘mechanical’ application of defined steps;

• Provides credibility to our process.

The approach involves the following steps:

a) Preliminary screening.

b) Select an expert panel for the Expert Elicitation Process.

c) Selection of evaluation criteria (Expert Elicitation Process (EEP)).

d) Assessing Risk Control Measures (RCM) for a particular Safety Issue/accident scenario (EEP).

e) Reporting findings and make recommendations to the decision makers (RIDM Issue Team (RIT)/LBLOCA Working Group for its related issues).

It is to be pointed out that it is the normal practice to weight the selected evaluation criteria. The weighting is done by using a combination of the Expert Elicitation Process (EEP) and Analytic Hierarchy Process (AHP). However, for the application to the Category 3 issues, considering the project’s time constraints, it has been decided not to weight the evaluation criteria.

D.2.1 Preliminary Screening

During this step the Risk Control Measures (RCM) for the issue under consideration are identified based on expert judgement. The RIDM Working Group also decides whether or not a detailed Expert Elicitation Process (EEP) will be followed to support the recommendation regarding the path forward to resolve the issue. Normally, the Expert Elicitation Process (EEP) process will be followed if there are more than one RCM in addition to the status quo. If there is only one RCM in addition to the status quo, and if the risk significance level of the issue is 3 or 4, and if it is estimated that the RCM will lower the Risk Significance Level (RSL) for that issue, than it will generally be recommended that the RCM be pursued and a detailed EEP is not required.

If there is only one RCM in addition to the status quo, and if the risk significance level of the issue is lower than 3, or if it is estimated that the RCM will not lower the Risk Significance Level (RSL), the RIDM Working Group may decide not to recommend the RCM without performing a detailed Expert Elicitation Process (EEP). If the RIDM Working Group is not able to achieve consensus, then an EEP is performed.

D.2.2 Select an Expert Panel for Expert Elicitation Process

The RIDM and LBLOCA Working Groups identify experts who will be involved in the Expert Elicitation Process. The latter Working Group is consulted for Large LOCA Safety Issues.

228


It is recognized that the panels need to be balanced, that is should include approximately the same number of staff from the CNSC and the Industry, and representative of the various stakeholders. It is also considered that for the type of applications considered, and in order to represent adequately all the stakeholders, panels should consist of approximately 10 persons. The persons on the panel need to be knowledgeable of the issues being addressed and the Risk Control Measures (RCM) being assessed.

D.2.3 Selection of Evaluation Criteria

The evaluation criteria to be used in evaluating the adequacy of Risk Control Measures (RCM) have been proposed based on discussions between the RIDM Steering Committee, the RIDM Process team and the RIDM Issue team. In selecting those criteria both quantitative and qualitative factors should be taken into account. The same criteria will be used for all Category 3 issues.

The evaluation criteria (see Table D.1) have been selected to:

• Correspond to the safety areas that are considered to assess the risk significance level related to the issues; and

• Account for the various other factors that should be considered when assessing Risk Control Measures (RCM). These factors are based on the factors discussed in 9.3 and are coherent with those that have been considered by the LBLOCA Working Group 9.3.

Based on discussions within the Working Groups and general guidance provided in the CNSC RIDM process document 9.3, the following criteria have been proposed:

Table D.1: Evaluation Criteria for RCM Assessment

Level 1 Evaluation criteria Level 2 Evaluation criteria Remark

#1 Severe Accidents Risks / /Obtained from Risk Matrix A4 9.3

#2Radiological Risk to Public at DBA / /

Obtained from Risk Matrix A3 9.3

#3Risk of Negative Impact on Safety / /

Obtained from Risk Matrix A7 9.3

#4 Practicality

#4.1 Likelihood of completion. (Technically feasible?)

Qualitative assessment (EP)

#4.2Probability of success. (Likelihood of obtaining meaningful result.)


#4.3Timeframe for completion. (Will the results be available in time to be used?)


#5 Impact on other Safety Areas / / Qualitative assessment (EP)

229


#6 Benefit/Cost Considerations12 / / Qualitative assessment (EP)

The relationship between the evaluation criteria and the Risk Control Measures regarding the decision-making process is shown in Figure D.1.

12 This evaluation criteria was originally subdivided in two secondary criteria: i) Benefit/Cost Ratio and ii) Net Present Value (NPV). However, during the performance of the assessments it was considered that there was not enough details to perform the assessment on these more specific criteria and therefore only a Benegeneral ‘cost’ criteria was used.

230

Goal

Decision criteriaLevel 1

Decision criteriaLevel 2

Outcomes (RCM)

Recommend a corrective measures (RCM) (Safety Issue # / acc. Scenario )

1. Severe Accident Risks

2. Radiological Risk to Public at DBA

3. Risk of Negative impact on Safety 4. Practicability 5. Impact on Other

Safety AreasBenefit/Cost

Considerations

4.1 Likelihood of completion

4.2 Probability of success

4.3 Timeframe for completion

RCM #1 RCM #2 RCM #n...

Figure D.1: Relationship between evaluation criteria and Risk Control Measures in the decision-making process

231


D.2.4 Assessing Risk Control Measures Against Evaluation Criteria

This section describes the approach employed in assessing candidate Risk Control Measures (Risk Control Measures (RCM)) for a Safety Issue and its risk scenarios. The work consists in the use of EEP. The expert panel answers a questionnaire by assigning an Alternative Priority Number (APN) to each RCM against an evaluation criterion. The template for the questionnaire that was used for assessing the Risk Control Measures (RCM) addressing the LBLOCA issues is provided at the end of this appendix.

In applying the Expert Elicitation Process (EEP) to determine a preferred RCM, the potential impact of the Risk Control Measures (RCM) is compared against the evaluation criterion through a pairwise comparison13 of the effectiveness of a pair of candidate risk control measures.

The assessment for the first three evaluation criteria, which correspond to the safety areas that were used in the assessment of the Risk Significance Levels of the issues, is based on the expert judgement of the estimated ability of the considered RCM to change (most likely decrease) the Risk Significance Level (RSL) for each risk scenario related to each issue for each of the three safety areas, namely:

• The Severe Accidents Risks (Risk Significance Level (RSL) obtained from Risk Matrix A4);

• The Radiological Risk to Public at DBA (Risk Significance Level (RSL) obtained from Risk Matrix A3); and

• The Risk of Negative Impact on Safety (Risk Significance Level (RSL) obtained from Risk Matrix A7).

The assessment of the impact regarding an RCM against the practicality criteria is predominantly subjective. The experts solicited through a survey will indicate their responses regarding their assessment. The three sub criteria considered under practicality, are:

• Likelihood of completion : This criterion is introduced to take into account the technical feasibility of the considered RCM.

• Probability of success : This criterion is introduced to take into account the likelihood that the considered RCM will be successful in resolving the issue being considered.

• Timeframe for completion : this criterion is introduced to provide an indication of the time that is required to complete the activities required to implement the considered RCM.

The assessment of the impact regarding an RCM against this Impact on Other Safety Areas (OSA) criterion is predominantly subjective. The experts solicited through a survey will propose their responses regarding their assessment. The safety areas that may have to be considered are as described in 9.3:

• Operating Performance13 The pairwise comparison is a part of ANALYTIC HIERARCHY PROCESS (AHP) processing. It is based on the compiled answers obtained through the Expert Elicitation process.

232


• Performance Assurance

• Design and Analysis

• Equipment Fitness for Service

• Emergency Preparedness

• Environmental Performance

• Radiation Protection

• Safeguards

In the context of the application of the RIDM process to the Category 3 issues, in most cases the dominant safety area that has to be considered is the “Negative Impact on Safety” safety area. The evaluation criteria described in the rest of this document, have been selected primarily to address the impact of the Risk Control Measures (RCM) on the “design and analysis” area for the specific issue being considered. In that context, the questions that need to be asked when assessing these impacts on other safety areas are:

• Are there safety areas other than “Negative Impact on Safety” that can be significantly affected by the RCM being considered? If the answer is yes these other areas have to be identified and the basis for the ranking has to be provided. As usual this basis has to take into account regulatory, safety and economic factors.

• Does the RCM being considered have positive/negative impacts on other Safety Issues? The ranking will be based on the number, importance and impact on the other Category 3 Safety Issues.

• Does the RCM being considered have positive/negative impacts on other accident scenarios (Anticipated Operational Occurence (AOO), Design Basis Accidents (DBA) or BEYOND DESIGN BASIS ACCIDENT (BDBA)), and if so what is the significance of this impact? For instance an RCM that can have positive impact on Large Break Loss of Coolant Accident (LBLOCA) may have negative impact on steam line breaks.

• Does the RCM being considered have positive/negative impacts on the compliance with the design requirements? For example, a given RCM may have some impact on the separation between the safety systems.

The assessment of the impact of Risk Control Measures (RCM) against the Benefit/Cost Considerations criteria is predominantly subjective. The following provides some simplified guidelines for performing the estimates.

• The benefits should take into account both the economic benefits and the safety benefits, including the value of averted fatalities and averted radiation exposure. The benefits can be negative if the RCM leads to an increase in risk or a loss of capacity factor.

• The costs include costs directly related to the design, implementation and OM&A of the RCM being considered, as well as loss of revenue and cost of replacement power during implementation.

233


• To the extent possible all benefits and costs should be expressed as monetary values in dollars in order to allow comparison.

• In principle, the benefits and the cost should be discounted to account for the time value of money. As a first approximation, discounting can be neglected. This generally makes an RCM more attractive since the costs are primarily incurred in the short term whereas the benefits are spread over the remaining life of the station.

• The benefits and costs should be estimated based on the largest number of stations where the RCM is considered. This generally makes the RCM more attractive since most of the time the benefits are proportional to the number of stations where they apply whereas some of the costs, in particular the R&D costs, can be shared by all the stations.

It is to be pointed out that more quantitative guidance to rank the various criteria described above has been considered. However, due to time constraints, and considering the effort that would be required to get a consensus on more quantitative guidance to perform the ranking, it was decided to use only qualitative judgement.

234


Table D.2: Guidance on Risk Control Measure Correlation with RSLs

RSL1 RSL2 RSL3 RSL4

Recommendations for regulatory oversight and degree of scrutiny

- Additional efforts to control the risk may not be justified. - It may be appropriate to request addressing the risk as part of actions to resolve higher ranked risks, or as part of addressing other safety concerns due to the issue.

- Request the Licensee to identify measures to reduce the risk and to define a work plan to bring the risk in the acceptable region as far as practicable. Interim measures are not required. - Periodic review by CNSC of the status of the issue and of the implementation of the risk control measures.

- Request the Licensee to define a work plan within a firm timeframe to address the risk. Interim measures to reduce the risk may have to be recommended. - Intense scrutiny from CNSC with respect to verification (including inspections) of the implementation of risk control measures.

- Request the Licensee to implement immediate action to reduce risks. - Request establishing of compensatory measures until the safety problems are resolved. CNSC may instruct the Licensee to stop operation until compensatory measures are implemented.

Recommendations on potential measures that the Licensee can be requested to take for addressing the risk

- It may be appropriate to request addressing the risk as part of actions to resolve higher ranked risks, or as part of addressing other safety concerns due to the issue.

- Identify and implement Risk Control Measures such as restoring margins to bring the risk in the acceptable region as far as practicable. - Examples: refining safety analyses, improving operational procedures; reconfiguration of systems, R&D, design changes may also be considered if they are cost effective.

- Doing nothing to reduce the risk is not an option. - Where applicable, reducing the uncertainties should be part of the strategy to reduce risks, followed by a re-evaluation of the significance. - Examples: as for RSL2 plus reconfiguration of systems, R&D, design changes, interim change of operational parameters including power reduction.

- Any measure that will reduce the risk back to the lower regions. - Examples: as RSL3 plus reactor shutdown.

Time at risk considerations

- No specific limitation. - More time (than for RSL3) would be available for implementation of risk control measures. The timeframe should be agreed by both the Licensee and CNSC.

- Urgency of addressing the problems is increased as allowable time at risk in absence of interim measures is limited.

- Allowable time at risk is very low. Measures to reduce the risk have to be implemented immediately.

Weight of risk concerns in the decision to address the issue

- Risk is not a concern; other inputs (such as compliance with CNSC expectations, codes and standards) may have a dominant role in justifying the need for addressing the issue.

- It is expected that other inputs may have a greater weight in determining the actions to address the issue.- CBA arguments may become prevalent in selecting the measures to control the risk.

- The weight of the risk input becomes very significant (i.e. with respect to CBA) in the decision to select measures to address the issue.

- Decision on addressing the issue will be largely determined by the unacceptable risk... - Risk reduction should be undertaken independent of costs.

235


3. Application of Expert Elicitation Process to the LBLOCA RCMs

As discussed in section 1.19 an Expert Elicitation Process was applied to assess only the proposed Risk Control Measures (RCM) for Large Break Loss of Coolant Accident (LBLOCA). The process was not applied to the non-LBLOCA issues, because for these other issues the CNSC and the Industry staff have identified and agreed upon a single RCM required to address the issues. For the LBLOCA, two Risk Control Measures (RCM) were identified (see section Erreur : source de la référence non trouvée) and therefore in this case it was appropriate to use an elicitation process to assess the merits of the two options.

The assessment was done by following the process presented in 9.3. The two RCMs identified section 9, that is the Composite Analytical approach (RCM-1) and the Low Void Reactivity Fuel (LVRF; RCM-2) were assessed.

The basic assessment was done during a meeting held on April 2, 2009. The meeting was attended by the RIDM Issue team members. In order to get a balanced representation between CNSC members and Industry members, three additional CNSC persons, who were involved in the LBLOCA team, were also invited. Eight persons were confirmed as members of the assessment team. All the members had more than 10 years of experience in the area of the CANDU safety.

The assessment team members had previously participated to discussion on the application of the EEP process. Nevertheless the process was summarized and some general guidance was provided. Basically, the members were asked to fill in the RCM evaluation questionnaire (see template at the end of the appendix) for each of the four LBLOCA issue discussed in section 1.3 and for each of the 2 proposed Risk Control Measures (RCM); a total of 8 questionnaires were filled in by each of the 8 members. Since it had been previously agreed to perform a qualitative assessment, no attempt was made to provide quantitative guidance on how to rank the various Risk Control Measures (RCM) relative to the various evaluation criteria.

Following the presentation of the questionnaire, it was decided by the team that, considering the fact that no detailed information on the costs and benefits of the Risk Control Measures (RCM) were available, the two evaluation criteria on Benefit/Cost considerations would be lumped together and that only one criterion, referred to as ‘Cost’, would be used.

The assessment is summarized in Table D.1, where the values that are presented (Ranking Number of the Alternative - RNA) are obtained by combining both geometric and arithmetic mean of the obtained responses14. The table shows that:

• For the Risk on Negative Impact on Safety, which is the safety area where the risk significance level for a number of LBLOCA Category 3 issues was the highest, being in the unacceptable region (RSL= 3), both Risk Control Measures (RCM) are providing

14 The results of the survey were translated by 5 to provide final results between 1 and 9. Therefore a value of 5 indicates that the RCM has no impact on the considered Safety Issue, whereas a value between 1 and 5 represents a negative impact of the RCM and a value between 5 and 9 represent a positive impact.

236


some risk reduction. The LVRF approach provides better improvement, in particular for the AA9 (Positive void reactivity);

• The Composite Analytical approach (RCM-1) has essentially no impact on the severe accident risk and the Radiological risk to public at Design Basis Accidents (DBA);

• The LVRF approach (RCM-2) slightly reduces the severe accident risk and the Radiological risk to public at Design Basis Accidents (DBA);

• Both Risk Control Measures (RCM) have similar impact on other safety areas;

• The likelihood of completion and the probability of success of the Composite Analytical approach is considered to be medium;

• The likelihood of completion and the probability of success of the LVRF approach is considered to be relatively high;

• Both Risk Control Measures (RCM) will require relatively long time to implement; and

• The cost for implementing the Low Void Reactivity Fuel is higher than the cost for implementing the Composite Analytical approach.

The Composite Analytical approach does not affect the Severe Accident Risk and Radiological Risk to Public at Design Basis Accidents (DBA) safety areas as this approach does not modify the physical behavior of the plant. It is nevertheless to be pointed out that the Composite Analytical approach is likely to reduce the estimated consequences of Large Break Loss of Coolant Accident (LBLOCA) by providing a more realistic modeling of the event.

The LVRF approach on the other hand will reduce the power pulse for the various considered risk scenarios and therefore provides some improvements relative to these safety areas. The fact that these improvements are minor is considered to be a consequence that the Risk Significance Levels for these safety areas are RSL 2, as indicated in Table 4 the RSLs for the Safety Issues related to Large Break Loss of Coolant Accident (LBLOCA) for the Severe accident risk and Radiological risk to public at Design Basis Accidents (DBA)..

The results of the survey were also compared to the assessments of the LBLOCA team 9.3 which are summarized in Table 10. The results in Table 10 and Table D.1 related to assessment criteria on Time frame for completion and Cost are comparable. However the results related to the Likelihood of completion and the Probability of success appear to be different.

There is, in fact, a range of opinions regarding the Likelihood of completion and Probability of success of the Composite Analytical approach. In particular there are concerns regarding the capability to complete the experimental program required to support this approach; in particular there have been some concerns expressed regarding the completion of the experimental program to support the proposed change to the LBLOCA break opening time model. Providing the experimental data to support reclassification of some LBLOCA events is also considered to be challenging.

237


In conclusion, taking into account that:

• For some scenarios for the LBLOCA-related Category 3 Safety Issues the Risk Significance Levels related to the Safety on Negative Impact on Safety are in the unacceptable region (RSLs = 3, see Figure 4);

• Both Risk Control Measures (RCM) are considered to be capable of reducing the Risk of Negative Impact on Safety;

• The Risk Significance Levels related to the Safety areas on Severe Accident Risk and Radiological Risk at Design Basis Accidents (DBA) are in the tolerable region (RSLs = 2; see);

• Both Risk Control Measures (RCM) have comparable impacts safety areas on Severe Accident Risk and Radiological Risk at Design Basis Accidents (DBA);

• The costs of implementation of the LVRF option is higher than the cost of the Composite Analytical approach; and

• Both Risk Control Measures (RCM) are comparable in addressing the LBLOCA-related CANDU Safety Issues.



A program defining the detailed scope, tasks, success criteria for the elements of the Composite Analytical approach, and schedule will need to be prepared for development and implementation of the Composite Analytical approach. A Terms of Reference, with clear accountabilities for the CNSC and Industry participants, will need to be developed as well.

Considering the challenges regarding the implementation of this RCM, and consistent with the RIDM process, a monitoring process will need to be put in place to:

• Demonstrate that the level of confidence in the successful outcome of the Composite Analytical approach increases with time; and

• Verify that the proposed approach is effective in reducing the Risk of Negative Impact on Safety of the Category 3 issues related to Large Break Loss of Coolant Accident (LBLOCA).


238



or



Work also needs to performe in two areas that are essential elements of any overall solution. These areas are:



239


Table D.1: RCMs Assessment Summary

SEVERE ACCIDENT

RISK

RADIOLOGICAL RISK TO PUBLIC

AT DBA

RISK OF NEGATIVE

IMPACT ON SAFETY

IMPACT ON

OTHER SAFETY AREAS

LIKELIHOOD OF

COMPLETION

PROBABILITY OF SUCCESS

TIMEFRAME FOR

COMPLETIONCOST

RCM RCM RCM RCM RCM RCM RCM RCM #1 #2 #1 #2 #1 #2 #1 #2 #1 #2 #1 #2 #1 #2 #1 #2AA9 5* 7 5 6 6 8 4 5 5 8 5 7 4 4 4 2 PF9 5 6 5 6 6 6 5 5 6 7 6 7 4 4 4 2 PF10 5 6 5 6 6 7 5 5 6 7 5 8 4 4 4 2 PF12 6 7 6 6 5 6 5 5 6 7 6 8 4 5 5 2

RCM-1 = Composite Analytical ApproachRCM-2 = LVRF

* The results of the survey were translated by 5 to provide final results between 1 and 9. Therefore a value of 5 indicates that the RCM has no impact on the considered Safety Issue, whereas a value between 1 and 5 represents a negative impact of the RCM and a value between 5 and 9 represent a positive impact.

240


4. References

[1] “Generic Safety Issues for Nuclear Power Plants with Pressurized Heavy Water Reactors and Measures for their Resolution”, IAEA TECDOC - 1554, June 2007.

[2] “Generic Safety Issues for Nuclear Power Plants with Light Water Reactors and Measures Taken for their Resolution”, IAEA TECDOC Series No. 1044, 1998.

[3] “Ranking of Safety Issues for WWER-440 Model 230 Nuclear Power Plants, Report of the IAEA Extrabudgetary Programme on the Safety of WWER-440 Model 230 Nuclear Power Plants”, IAEA TECDOC Series No. 640, February 1992.

[4] “Development of Regulatory Positions on CANDU Safety Issues: Categorization of Safety Issues”, File 2.01, BITS 3074210,. Miller, D., August 1, 2007.

[5] “Risk-Informing CNSC Planning, Licensing and Compliance Activities”, Detailed Guidance Document, Revision 6, December, 2008.

[6] “Risk Management - Guidelines for decision makers”, A National Standard of Canada CAN/CSA Q-850-97.

[7] “Risk Assessment, Evaluation and Ranking for Risk Informed Decision Making - Application for new Regulatory Requirements”, BITS 1083094, A.Bujor, November 30, 2006.

[8] “Risk in Safety Regulations and Decision Making - International and Canadian Approaches”, BITS 999356, A.Bujor, January 26, 2007.

[9] “Application of the RIDM process and tools for risk estimation and evaluation of CANDU Safety Issues”, BITS 1083121, A.Bujor, February 8, 2007.

[10] “Risk-Informed approach for the CNSC Power Reactor regulatory program - Basis Document with examples of actual and potential applications”; Revision 6; E-doc 3264949-1, prepared by the Power Reactor Regulation Program Working Group on Risk-Informed Approach in Power Reactor Regulation, revision 6 by A. Bujor, R. Gheorghe, D. Miller, G. Ishack, 6 December 2008.

[11] “Considering Cost-Benefit Information”, P-242, Canadian Nuclear Safety Commission, October 2000.

[12] Development of Risk-informed Regulatory Positions for CANDU Safety Issues: Risk Significance of Category 3 Safety Issues, September 21, 2007.

[13] Saaty, T. L., (1980), The Analytic Hierarchy Process, McGraw-Hill Co.

[14] US Nuclear Regulatory Commission, (2003), Formal Methods of Decision Analysis Applied to Prioritization of Research and Other Topics – NUREG/CR-6833, Washington, DC 20555-0001.

241


[15] US Nuclear Regulatory Commission, (2003), Estimating Loss-of-Coolant Accident (LOCA) Frequencies Through the Elicitation Process Main Report – SR-1829, Washington, DC 20555-0001.

[16] Komljenovic, D., Chan, E., Ganguli, S., Wu, J., and Parmar, R., (2008), An Analysis to Determine Industry’s Preferred Option for an Initial Generic Reliability Database for CANDU, 29th Annual Conference of the Canadian Nuclear Society, Toronto.

[17] COG-JP-4290-V02, LBLOCA report.

242

Ranking of Candidate Risk Control Measures for LBLOCA RCMsLBLOCA RCM Evaluation Questionnaire

Name/Organisation: __________________________________

LBLOCA Issue:

RCM Being Considered: :

Level 1 evaluation criteria (#1, #2, #3, #5 and #6) are judged against their likely impact (effect) on RSL for the specific LBLOCA issues and candidate RCM being evaluated. The RSLs for Criterion #1, Criterion #2 and Criterion #3 are obtained from risk matrices A4, A3 and A7, respectively.

243

The RCM is very likely to increase the RSL

The RCM is unlikely to change the RSL

The RCM is very likely to

decrease the RSL

-4 -3 -2 -1 0 1 2 3 4

What is the Likely Effect of the RCM on RSL for Criterion #1 Severe Accident Risk




decrease the RSL

-4 -3 -2 -1 0 1 2 3 4

What is the Likely Effect of the RCM on RSL for Criterion #2 'Radiological Risk to Public at DBA'




decrease the RSL

-4 -3 -2 -1 0 1 2 3 4

What is the Likely Effect of the RCM on RSL for Criterion #3 'Risk of Negative Impact on Safety'


Level 2 evaluation criteria, #4.1, #4.2 and #4.3 are judged against their likely impact (effect) on their corresponding Level 1 criterion. The experts are asked to indicate their judgement as to the impact of a particular RCM through a set of Tables as follows:

244

The Cost is very high

The Cost is

MediumThe Cost

is very low

-4 -3 -2 -1 0 1 2 3 4

What is the likely impact of of the RCM on RSL for Criterion #6 Cost Consideration

RCM has a very low probability

of success

RCM has a 50%

probability of

success

RCM has a very high

likelihood of

success-4 -3 -2 -1 0 1 2 3 4

What is the Likely Effect of the RCM on Criterion #4.2 Probability of Success

RCM has a very

negative impact on

OSA

No impact on OSA

RCM has a very

positive impact on

OSA-4 -3 -2 -1 0 1 2 3 4

What is the Likely Effect of the RCM on RSL for Criterion #5 Other Safety Considerations

RCM is very

unlikely to be

completed

RCM is likely to

be completed

RCM is very likely

to be completed

-4 -3 -2 -1 0 1 2 3 4

What is the Likely Effect of the RCM on Criterion #4.1 Likelihood of Completion


245

RCM is very

unlikely to be

available in time frame

RCM has 50%

chance of being

available in time frame

RCM has very high likelihood of being available in time frame

-4 -3 -2 -1 0 1 2 3 4

What is the Likely Effect of the RCM on Criterion #4.3 Timeframe for Completion

APPENDIX E. RISK CONTROL MEASURES ASSESSMENT FOR CATEGORY 3 ISSUES

246

Risk Control Measures: AA 3 Computer Code and Plant Model Validation

Issue Scenarios Risk of Negative Impact on Safety.

Radiological Risk to public at DBA.

Severe accident risk

AA 3Computer Code and Plant Model Validation


C1*L3–> 3 - -


C2*L2–> 3 - -

Risk Control Measures

The RCM proposed to address this issue involves continued development of the Industry Standard Toolset (IST) and non-IST codes to improve the confidence in computer code predictions.

The Industry Standard Toolset (IST) program was added to the COG R&D program as a separate entity starting in fiscal year 2005/06. The program is a consolidation of the validation, development and maintenance activities on different computer codes used for the design, safety analysis and operational support of CANDU reactors. During the past few years, Industry Standard Toolset (IST) codes have been upgraded and validated to comply with the applicable Software Quality Assurance Standard (CSA N286.7). Significant, on-going effort is required for the baseline support of the Industry Standard Toolset (IST) codes. To address the issue in the short and medium term (i.e., until gaps are filled), additional measures should continue to be taken in the safety analysis performed in the meantime to account for any shortcomings that have been identified.

The IST program is currently structured around the following nineteen codes:Project 501: ADDAM-ISTProject 502: ASSERT-PV-ISTProject 503: DOORS/ORIGEN-ISTProject 504: DRAGON-ISTProject 505: ELESTRES-ISTProject 506: ELOCA-ISTProject 507: GOTHIC-IST

247

https://www.cogonline.org/researchdev/IST/IST2/istr_dprojects.html#507







Risk Control Measures: AA 3 Computer Code and Plant Model Validation

Project 508: MAAP-CANDU-ISTProject 509: MODTURC_CLAS-ISTProject 510: RFSP-ISTProject 511: SMART-ISTProject 512: SOPHAEROS-ISTProject 513: SOURCE-ISTProject 514: TUBRUPT-ISTProject 515: WIMS-ISTProject 516: CATHENAProject 517: TUFProject 518: IST SHELLProject 599: IST Codes General

A number of gaps for IST codes N286.7 compliance remain. Technical Basis Documents (TBD) and Validation Matrices (VM) are being augmented and updated. Code accuracy and uncertainty analyses methodologies are being developed – need to provide adequate funding and priority to activities.

This work will be done as part of the Safety Analysis Improvement Project. The first step in the project is completion of a Safety Analysis Improvement Project Plan is to be completed by December 31, 2009.


Implementation Schedule

The code validation is a continuous process and the Industry will continue the validation of their code and keep on going discussion with the CNSC. However, a specific milestone to close this issue will be established to summarize the work on Safety Analysis Improvement. A Safety Analysis Improvement Project Plan is to be completed by December 31, 2009.

248


https://www.cogonline.org/researchdev/IST/IST2/istr_dprojects.html#_518











Risk Control Measures: CI 1 Fuel Channel Integrity and Effect on Core Internals





Fuel channel failure due to ageing degradation. C2*L0–> 1 C2*L2–> 2 2


C1*L2 -> 2 - -


The RCM proposed to address this issue involves the further development and implementation of appropriate Fuel Channel Ageing Management Program (FC AMP) for assessing fuel channels with regards to fuel channel integrity and supporting safety analysis assumptions.

In particular, the existing FC AMPs should be modified to address risk-informed in-service inspection (RI-ISI) of fuel channels, and provide more meaningful information from inspection campaigns.

The Fuel Channel Ageing Management Program FC AMP also needs to consider impact of FC behaviour on other Heat Transport System (HTS) components, rather than focusing solely on Fuel Channel FC integrity. In addition, the appropriate information need to be collected to support the safety analysis assumptions related to pre-accident pressure tubes characteristics.

This program is considered to be part of an overall Integrated Ageing Management Program, as described in the RCM for issue GL 3 Ageing of Equipment and Structures.

CSA N285.4 is the governing standard for both the regulatory authority and the Industry on Periodic Inspection of CANDU Nuclear Power Plant Components, from which the Life Cycle Management Plan was developed to ensure fuel channel ageing is properly managed. Moreover, N285.8-05 “Technical Requirements for In-Service Evaluation of Zirconium Alloy Pressure Tubes in CANDU Reactors” provides technical bases for fitness of service evaluation of pressure tubes.

Successful completion of the proposed RCM is expected to result in fuel channel ageing management programs that ensure that the consequences of ageing on fuel channel integrity are adequately managed, and that the appropriate information to continue to confirm safety analysis assumptions is collected.

249

Risk Control Measures: CI 1 Fuel Channel Integrity and Effect on Core Internals


Currently CSA N285.4 is referenced in Power Reactor Operating Licences. In order to implement risk-informed in-service inspections of FCs, some flexibility will be needed to address the requirements in CSA N285.4. The means to provide this flexibility needs to be addressed by the CNSC and the Industry.

As discussed for GL3, all licenses are to fully document and implement an Integrated AMP by December 31, 2011. All Licensees are expected to develop and implemented the updated Fuel Channel Inspection program by this date, as part of implementation of the Integrated AMP.

250

Risk Control Measures: GL 3 - Ageing of equipment and structures




GL 3Ageing of Equipment and Structures

Failure of SSCs to perform safety function.

C2*L1–> 2 - -

Mitigating system failure.

- C2*L2–> 2 2


Operating Reactors:

Currently all the Licensees have established, or are in the process of implementing, ageing management programs for System Structure Component (SSC)’s important to safety. In the context of the implementation of S-98, the stations have also put in place programs to monitor the reliability of the Systems important to safety. Moreover, at stations that are currently involved in life extension programs, extensive condition assessments of all the SSCs important to safety have been performed.

The RCM is to finalize documentation of Licensee’s overall approach for Ageing Management and to fully implement the processes. Effective ageing management requires a proactive, systematic, and integrated approach to coordinating all programs and activities relating to the understanding, control, monitoring, and mitigation of ageing throughout each System Structure Component (SSC)’s service life. This ensures that significant ageing impacts on the performance and reliability of the safety related systems, components and structures are taken into account, and that appropriate information to continue to confirm safety analysis assumptions is collected. The Licensee’s approach for AM is to be in accordance with IAEA Safety Standards NS-G-2.12, “Ageing Management for Nuclear Power Plants”. This document does not override the requirements of other codes and standards, but serves to provide a framework within which codes and standards can be applied to ensure that the ageing degradation of SSCs is being effectively monitored and managed.

It should be pointed out that the CNSC is currently preparing a Regulatory Document on Ageing Management (RD-334, “Ageing Management for Nuclear Power Plants”) which is expected to be available for public consultation in the fall 2009, with final publication in the winter 2010. In the meantime, IAEA document NS-G-2.12 should be addressed, as RD-334 will be consistent with it.

Life Extension:Licensees are to complete condition assessment as required for Integrated Safety Reviews, and to document and implement their overall approach for Ageing Management.

251

Risk Control Measures: GL 3 - Ageing of equipment and structures

Successful completion of the proposed RCM is expected to result in Integrated Ageing Management Programs that ensures that System Structure Component (SSC) ageing is understood and managed effectively, and that ageing effects of System Structure Component (SSC) are detected (through inspection, testing or surveillance programs) and corrective actions taken (operating limits, operation, maintenance, repair, replacement) before loss of System Structure Component (SSC) integrity or functional capability occurs. In addition, the program should ensure that the appropriate information is collected to support the safety analysis.


All licenses are to fully document and implement their overall approach for Ageing Management by December 31, 2011.

252

Risk Control Measures: IH 6 Need for Systematic Assessment of High Energy Line Break Effects




IH 6 Need for Systematic Assessment of High Energy Line Break Effects


C3*L0–> 2 C2*L2–> 2 2

Degradation of safety function and barriers. C3*L0–> 2 C2*L2–> 2 2


For operating reactors and life extension, the Licensees should perform an assessment to identify vulnerabilities related to pipe whip and implement corrective measures where practicable. In addition, Licensees should carry out appropriate inspection and maintenance activities to support fitness-for-service of high energy pipe. For stations that were designed in the 70’s and early 80’s, feedback from more recent CANDU design will be taken into account.

The pipe-whip and jet-impingement analyses will be used to identify those postulated rupture locations that are candidates for further consideration. The purpose of these further considerations is to disposition any potential non-compliance with modern standards and practices. This further consideration may involve one or more of the following:• Perform more advanced safety analysis to demonstrate that the consequences of the postulated

rupture (i.e. pipe whip and jet impingement) are acceptable.• Introduce design modification(s) to minimize the consequences of the dynamic effects associated

with the postulated rupture.• Compensatory measures to ensure low probability of occurrence of dynamic effects so that the

postulated rupture location may be exempt as a postulated initiating event. A RIDM approach could be used to assess compensatory measures.

Internationally, leak-before-break (LBB such NRC-CR4572 and United State Nuclear Regulatory Commission Standard Review Plan SRP-3.6.3 Leak-Before-Break Evaluation Procedure, NUREG-0800, Rev. 1, March 2007) principles have been widely accepted as the technical justification for relaxing the requirement for pipe-whip restraints whose sole purpose is to mitigate the consequences of the dynamic

253

Risk Control Measures: IH 6 Need for Systematic Assessment of High Energy Line Break Effects

effects associated with the postulated ruptures of high-energy nuclear piping systems. The application of Leak Before Break (LBB) principle for primary circuit piping will be used as the principal element for the disposition of problematic postulated pipe ruptures in main circuit piping.

Completion of the proposed RCM requires a systematic review of the dynamic and environmental effects of high energy piping breaks inside the containment and the consequences on plant safety, an assessment of the consequential damage associated with the postulated failure and identification of potential design improvements.


Bruce A: An assessment is being looked into as part of Unit 1 and 2 refurbishment. If approved, this assessment will be completed by 2011-2012.

Bruce B: Assessment already performed for heat transport system (AECL 29-01320-RSN-003, 1982).

Darlington: Considered in the design (OHN-SDG-38-03650-3 1985) and applied leak-before-break principles (OH Report 85167 1985 plus Addenda 1987, Report 86015 1987, AECL 38-33100-TD-001 & 38-3310-TD-002 2004).

Pickering: To be specified.

Point Lepreau: To be specified.

Gentilly-2: To be specified.

254

Risk Control Measures: PF 15 GAI 95G01 Molten Fuel / Moderator Interaction




PF 15GAI 95G01: Molten Fuel / Moderator Interaction.

Insufficient data to predict melted fuel/ moderator interaction.

C2*L0-> 1 - -

Fuel melting after stagnation feeder break or flow blockage (Damage to Special Shutdown System (SDS)1)

C2*L0–> 1 - -

Fuel melting after stagnation feeder break or flow blockage (Multiple channel failure)

C2*L0–> 1 - -

Fuel melting after stagnation feeder break or flow blockage (Impairment of Special Shutdown System (SDS)1 and Emergency Coolant Injection (ECI)

C3*L0–> 2 C2*L2–> 2 2


The planned sets of experiments to improve our understanding of molten fuel/moderator interaction phenomena have been completed. The test results demonstrated that at ejection pressures of 3.35 MPa or higher, the dominant mode of interaction is forced interaction giving rise to a modest pressure rise that can be sustained inside the calandria vessel.

The closure document (COG-08-2054) summarizing the entire molten-fuel moderator-interaction program conducted at Argonne National Laboratories and at AECL’s Chalk River Laboratories has been completed and submitted for internal review by the Licensees. It briefly describes the apparatus, instrumentation, test procedures, and major results. This report also lists the reports describing the details of each experiment, technology development report, the assessment report, and papers published in the open literature. This report need to be finalized and submitted to the CNSC.

The results from the experimental program documented in this report, test reports, and the assessment report will be used to close the Generic Action Item 95G01 raised by the Canadian Nuclear Safety Commission on Molten Fuel Moderator Interaction.

The first results have been revised by CNSC Staff and it is expected that this Generic Action Item (GAI) will be closed in 2009.

255

Risk Control Measures: PF 15 GAI 95G01 Molten Fuel / Moderator Interaction

Successful completion of the proposed RCM involves the acceptance by the CNSC that the consequences of molten fuel/moderator interaction are manageable.


Industry plans to submit closure request by June 2009. Based, on information submitted to date, CNSC expects closure of this issue by December 2009.

256

Risk Control Measures: PF 18 Fuel Bundle / Element Behaviour under Post-dryout Conditions.




PF 18Fuel Bundle / Element Behaviour under Post-dryout Conditions

SLOCA C3*L0–> 2 C2*L1–> 1 2

SLOCA and deflated airlock

C3*L0–> 2 C2*L1–> 1 2

Single pump trip C3*L0–> 2 C2*L2–> 2 2

Insufficient data to understand the behavior of element under post-dryout condition

C2*L1–> 2 (Industry)or C2*L2–> 3 (CNSC)

- -


The RCM to address this issue is multi-faceted. It includes:

1. Present experimental evidence to clarify the conditions for fuel deformation and for fuel sheath failure (i.e. dryout, fuel temperature, timing of failure), and for consequential failure of fuel channels.

2. Establishing firm acceptance criteria for Special Shutdown System (SDS) and Reactor Regulating System (RRS) trips to ensure their effectiveness.

3. Development of methodology for bundle deformation simulations under post-dryout conditions

There is a need to develop a model for bundle deformation under accident conditions to support the current experimental program for fuel bundle deformation. More importantly, the methodology can be extended to model potential fuel bundle deformations during accident conditions.

257


Objectives of this Bundle Deformation Methodology Project:

1. Understand/benchmark our existing CANDU bundle modeling capability for NOC.

2. Develop a bundle deformation model enhancement that could be used for sensitivity study/assessment. This will help to support planning of experimental programs and limited application to relatively small deformation.

The Bundle Deformation Methodology project will be in multiple phases (each year represents a phase). The objective of this development is to model fuel bundle deformation under high temperature accident conditions.

Phase 1 - Develop and validate model to simulate fuel bundle deformation under PDO (post dry-out?) conditions.

Phases 2, 3, etc. - a number of tasks will be performed, for example, to develop models for high temperature transients (large break LOCA or LBLOCA); to link the code that contains all bundle deformation models to the thermalhydraulic code ASSERT to perform iterations between thermalhydraulic and deformation simulations; to validate this code using experimental data (e.g., Trefoil test data documented in COG WP 22224).

Ongoing COG S&L R&D Work Packages to address this issue include:

WP 20231 Fuel Element to Pressure Tube Contact Heat Transfer Experiments.Due date: February 28, 2012

WP 20306 Fuel Bundle Behaviour Experiments.Due date: March 31, 2013

WP 20324 Fuel Pin Rigidity Model in Support of Bundle Deformation Models (Workshop SOR 506GD).Due date: December 31, 2010

WP 20326 Acceptance criteria for compliance with Reg Doc R-8: PIRT Panel.Due date: March 1, 2010

258


WP 20927 Post-dryout Heat Transfer for the 37-Element Bundle in the 5.1% Crept Channel – Experiments.Due date: January 31, 2010

WP 20928 Post-dryout Heat Transfer for the 37-Element Bundle in the 5.1% Crept Channel – Analysis.

Due date: March 31, 2011

WP 20933 Assessment and Improvement of ASSERT Subchannel Models for Improving Predictions of CHF Location, Dryout Power and PDO Sheath Temperature.

Due date: December 31, 2010

WP 20935 Drypatch Spreading and Drypatch Fraction in 28-Element Fuel.

Due date: September 30, 2009

WP-20943 State-Of-The-Art Report on the Impact of Bundle and Bundle-Component Geometry Variation on Critical Heat-Flux and Post-Dryout Heat Transfer in 28-Element and 37-Element Bundles.


WP 20948 Development of Database on CHF and PDO Heat Transfer for Element bowing in annuli and Bundles.


WP 20950 Update of PDO Heat Transfer Correlations for the New PDO Methodology.

Due date: October 31, 2010

WP-21022 Feasibility Study for In-Reactor Tests to Assess the Impact of Dryout on Bundles in Loss of Flow (LOF) and ROP/NOP Scenarios.


WP 21429 Requirements for ASSERT-PV Reactor Transient Analysis.


WP-21430 Assessment of the ASSERT Prediction Capability for Deformed CANDU Fuel Bundles.


WP 22109 Industry Coordination of the R&D Strategic Direction on Fuel Bundle Deformation.

259


Due date: October 10, 2010

WP 22224 Assess and document Stern Lab Element Bow Tests.

Due date: July 24, 2009

WP 22225 Assess Different Tools for Bundle Deformation Simulations Under NOC.

Due date: June 30, 2009

Successful completion of the proposed RCM is expected to result in an improved knowledge for post-dryout fuel, fuel bundle and pressure tube behaviour, in support of the current safety case.


Successful completion of all the listed work package is expected to result on the closure of the Issue: Fuel Bundle / Element Behaviour under Post-Dryout Condition. The last work package is expected to be complete for March 31, 2013

260

Risk Control Measures: PF 19 Impact of Ageing on Safe Plant Operation




PF 19Impact of Ageing on Safe Plant Operation


C2*L1–> 2 C2*L2–> 2 2


The issue of the impact of ageing on safe plant operation is a sub-issue of the issue GL 3, Ageing of equipment and structures. The RCM to address PF 19 are part of the RCM to address GL3. The specific activities required to address PF 19 include:

• As discussed for GL 3, further develop, document and implement ageing monitoring program to comprehensively address all safety-related SSCs, and to collect the appropriate information to continue to confirm safety analysis assumptions;• Assessing the impact of ageing on the safe operation envelope; and• Update safe operating limits to account for ageing.

This needs to be done through the further development, documentation and implementation of an Integrated Ageing Management Program, as discussed for GL3.

Successful implementation of the proposed RCM is expected to result in Integrated Ageing Management Programs that ensures that plant ageing mechanisms are identified, their impacts determined and addressed in an integrated manner, and are adequately accounted for in the shutdown system trip parameter setpoint adjustments, and other safe operating limits.


As discussed for GL3, all licenses are to fully document and implement an Integrated AMP by March 31, 2011.

261

Risk Control Measures: PF 20 Analysis Methodology for NOP/ROP Trips




PF 20Analysis Methodology for NOP / ROP Trips (ageing aspects)

Incorrect prediction of NOP trip setpoints from the analysis methodology.

C2*L1–> 2 - -

Fuel deformation leading to fuel element / PT contact under dryout conditions resulting from NOP trip issues.

C2*L1–> 2 - -

Cannot prevent dryout following slow loss of regulation, due to NOP trip issues, leading to fuel failures.

C3*L1–> 3 C1*L2–> 1 -


C3*L0–> 2 C2*L2–> 2 1


C3*L0–> 2 C2*L2–> 2 2


In order to address this issue, the Industry NOP/ROP Working Group should continue to perform the activities that were identified in the Working Group Terms of Reference most recent version dated June 2008. The scope of this work includes:

1. Assess residual risk in NOP/ROP analysis due to aggregate of low-frequency events.2. Agree on a common path forward to be used by the Industry for addressing the outstanding generic and station specific Neutron/Regional Overpower Protection (NOP/ROP) issues and for improving operating margins. This will include the sharing of the NOP/ROP analysis reports and documentation. It is the utility responsibility to ensure that proprietary information is protected.3. Agree to a common NOP/ROP methodology, including toolsets and Critical Heat Flux (CHF) correlation.

The deliverables from this Working Group include:1. Documentation of SIMBRASS and ROVER comparison (COG reports, WP 23009/COG-xxxx, FY 2008-2009); and

262


2. “High Level Principles and Guidelines for the Development, Improvement, Application and Management of Regional/Neutron Overpower Trip Setpoints for CANDU Reactors” (COG report, WP 23009/COG-xxxx, FY 2008-2009);3. Report on the residual risk in NOP/ROP analysis due to aggregate of low-frequency events.

Industry needs to follow-up and on the recommendation from the Independent Technical Panel's assessment of the proposed new NOP methodology. An acceptable NOP trip setpoint methodology such that the risk from fuel dryout and possible consequential fuel channel failure is negligible, needs to be developed and accepted by the CNSC.

It is important to note that the industry follow-up will not be limited to issues raised by the Independent Technical Panel (ITP). The new methodology is currently under CNSC staff review. The main topics covered in this review are:

1) Probabilistic aspects of the new methodology.a. Probabilistic treatment of neutron flux shapes.b. Statistical treatment of uncertainties.

2) Incorporation of ageing effects in the new methodology.3) OPG and BrucePower compliance and monitoring programs in support of the

implementation of the new NOP methodology.

The Independent Technical Panel (ITP) has been set up to support the CNSC’s review of the probabilistic aspects of the methodology. The CNSC staff report will include findings and recommendations regarding all three topics.

An acceptable NOP trip setpoint methodology such that the risk from fuel dryout and possible consequential fuel channel failure is negligible, needs to be developed and accepted by the CNSC.

The activities described above are already included in the COG NOP/ROP Methodology Working Group Work Plan.

Work ProgramWP23009 NOP Trip Effectiveness Methodology.

263


Working GroupNOP/ROP Methodology Working Group (Sponsored by COG Nuclear Safety Committee).

Successful completion of the proposed RCM is expected to result in improved confidence in preventing fuel dryout following a slow loss of regulation.


BP and OPG will provide a detailed schedule of the implementation activities shortly after the reception of the final version of the Independent Technical Panel (ITP) Report from CNSC; at the latest by the end of August 2009.

264

Risk Control Measures: PSA 3 Open Design of Balance of Plant - Steam Protection.




PSA 3 Open Design of Balance of Plant - Steam Protection

Steam/feedwater line breaks outside containment resulting in high pressure steam in turbine hall and, with the failure of other SSCs, consequential core damage and containment failure due to loss of support systems.

C3*L0 –> 2 C4*L1 –> 3(2, due to very low likelihood. In fact this sequence is considered below the DBA frequency threshold whereas this criteria is for DBA)

2


This issue specifically applies to multi-units stations. Moreover, BP has already addressed the issue by installing baffle walls in several parts of the turbine hall to protect electrical rooms. Other multi-unit stations need to address the status of steam protection. At Pickering B, the essential equipment is located in the Reactor Auxiliary Bay (RAB) which is separated from the turbine hall by the H-wall. The H-wall has been tested for leak tightness and strength following a sudden pressure rise in the turbine hall. However, the Probabilistic Safety Assessment (PSA) has assumed a failure probability. Darlington design relies more on steam protected rooms than any other plant; however, it has been found that the rooms were not properly sealed during construction.

For multi-units stations, a review of the PSA assumptions should be made to determine if more realistic assumptions could be made. Moreover the possibility of improving the protection against steam/feedwater line breaks outside containment should be examined.

Successful implementation of the proposed RCM is expected to result in plant design models that better reflect plant design features currently present to protect against steam and feedwater line breaks outside containment. The RCM could also result in the identification of potential design changes that improve the protection against steam and feedwater line breaks outside containment.


All OPG power plants are expected to update their Probabilistic Safety Assessment (PSA) by the end of 2010.

265





SS 5Hydrogen Control Measures during Accidents.

Large LOCA C2*L1 -> 2 C1*L2 -> 1 -Large LOCA + LOECC C3*L0 -> 2 C2*L1 -> 1 -Small LOCA + LOECC C3*L0 -> 2 C2*L2 -> 2 -LOCA (L or S) + LOECC + Loss of Moderator as a Heat Sink (due to any other failure) and containment is damaged due to hydrogen burned.

- - 2

LOCA (L or S) + LOECC + Loss of Moderator due to H2 deflagration

- - 2

LOCA (L or S) + LOECC + Loss of Containment integrity due to H2 deflagration

- - 2


The Industry now has a sufficient understanding of hydrogen behaviour during accidents, and has developed technology to effectively manage both short- and long-term hydrogen productions during accidents. All the Licensees have now committed to install Passive Autocatalytic Recombiners (PARs) to improve hydrogen control during accidents. Detailed schedule for the installation of PARs in all the Canadian CANDU stations need to be finalized. In particular, OPG proposed (and CNSC agreed with) a staged approach to PARs installation at Darlington and Pickering A/B, subject to confirmation of PARs installation feasibility and maintainability and decisions around plant life extensions.

The number and location of PARs are to be determined based on practical considerations and engineering judgement supported by hydrogen mixing analyses to demonstrate sufficient coverage for design basis accidents, using source terms derived for credible Loss of Coolant Accident (LOCA) and LOECI design basis accident events. For Loss of Coolant Accident (LOCA) + Emergency Core Cooling System (ECCS) impairments considered as BEYOND DESIGN BASIS ACCIDENT (BDBA), analysis using a best estimate approach to demonstrate that the adequacy of the number of PAR units to be installed and that there are not issues with short-term hydrogen production.

Based on detailed plans and proposals presented by the various Licensees to install PARs, GAI88G02 was

266


closed in 2009. Station specific action items have been opened to track the completion of the implementation activities.

Successful implementation of the proposed RCM is expected to result in identification of provision to mitigate the impact of hydrogen production during Design Basis Accidents (DBA)s.

ImplementationSchedule

See station specific action items:

Bruce: new action item 080714 and 081214.BP is developing a plan to install PARs for the rest of Bruce A and Bruce B. The plan should be firmed up by the summer 2009. BP is already committed to install PARs for Unit 1 and Unit 2 prior to restart.

Darlington: new action item 20081308.Pickering A: new action item 2008409.Pickering B: new action item 2008809.Point Lepreau: new action item 081214.Gentilly-2: new action item 091002, to be address during the refurbishment shutdown.

267





AA 8Analysis for Moderator Temperature Predictions


C1*L1–> 1 - -

Failure of several Fuel Channels due to Inadequate Cooling under a LOCA

C2*L0–> 1 - -

Consequential CT/PT Failure because of inadequate sub-cooling during a LOCA, or LOCA + LOECC

- C2*L1–> 1 -


- - 1


Operating Reactors, Life Extension and New Build: Licensees are expected to address the GAI 95G05 “Moderator Temperature Predictions” closure criteria. However, given that Licensees have made a final submission to the CNSC in December 2005 with a request to closure this Generic Action Item (GAI), CNSC should address this closure request in a timely manner (CNSC staff has developed a plan to review the industry submission in detail, and to identify factors that would lead to acceptance or rejection of the request for Generic Action Item (GAI) closure. The review has started in 2006, and is scheduled to continue until 2009 in view of the large size of the submission that includes 17 individual assessment reports.)

It is noted closure of the Generic Action Item (GAI) is being considered; however, station-specific action items related to this issue will be raised. Licensees are expected to address the station-specific issues.

Working GroupModerator Temperature Predictions GAI 95G05 Working Group (Sponsored by COG Nuclear Safety Committee).

R&D ReportsCOG-02-2003 Moderator Temperature Distribution Experiments: Tube Bank Pressure Drop Tests.COG-02 2004 Moderator Temperature Distribution Experiments: High Flow Tests.COG-02-2005 Moderator Temperature Distribution Experiments: Flow Pattern Transition Tests.

268


COG-02-2029 Moderator Temperature Distribution Experiments: Axial Temperature.Variations in Steady Momentum and Buoyancy Dominated Tests.

Successful implementation of the proposed RCM is expected to result in improved confidence in moderator temperature predictions.


Station-specific action items related to this issue will be raised and the schedule will reflect to completion of those actions.

269





AA 9Analysis for Void Reactivity Coefficient

Code prediction of the coolant void reactivity (CVR) may be under-predicted due to inadequate validation.

C2*L2–> 3 - -

CVR is under-predicted during a Large LOCA, but this does not affect the prediction that there is no fuel channel failure occurring.

C1*L1–> 1 - -

Fuel channel integrity may be affected due to under-prediction of the CVR at Large LOCA with multiple consequential fuel channel failures occurring.

C2*L0–> 1 - -

Fuel channel integrity may be affected due to under-prediction of the CVR at smaller voiding rates, - fuel channel failures not occurring

C1*L1–> 1

Increased doses to public when CVR is under-predicted during a Large LOCA, but without fuel channel failure occurring.

- C2*L2-> 2 -

Increased doses to public due to fuel failure / fuel channel failure when CVR is under-predicted during a Large LOCA with consequential multiple fuel channel failures.

- C2*L2-> 2 -

Safety Goals unchanged if no fuel channels fail at LOCA due to under-prediction of CVR.

- - 2




A program defining the detailed scope, tasks, success criteria for the elements of the

270


Composite Analytical approach, and schedule will need to be prepared for development and implementation of the Composite Analytical approach. A Terms of Reference, with clear accountabilities for the CNSC and the Industry participants, will need to be developed as well.






or





271


272





PF 9Fuel Behaviour in High Temperature Transients

Fuel behaviour under high temperature transients. - -


C3*L0–> 2 C2*L2–> 2 2


C2*L1–> 2








In this approach, Licensees may also include design improvements not related to Low

273


Void Reactivity Fuel.


or





274





PF 10Fuel Behaviour in Power Pulse Transients

Fuel behaviour under CANDU Power Pulse conditions.

C2*L2–> 3 - -


C3*L0–> 2 C2*L2–> 2 2


C2*L1–> 3 - -








In this approach, Licensees may also include design improvements not related to Low

275


Void Reactivity Fuel.


or





276





PF 12GAI 00G01 Channel voiding during a Large LOCA


C2*L1–> 2 - 2









277


The Low Void Reactivity Fuel option is considered to be the fall back option in the event that the success criteria for the Composite Analytical approach are not met. As such, a high level schedule for Low Void Reactivity Fuel implementation (including a cost estimate for development and implementation) needs to be developed in parallel with implementation of the Composite Analytical approach.

or


A program defining the detailed scope, tasks, and schedule will need to be prepared for development and implementation of the LVRF.



278

RIDM Use in CNSC Category 3 Safety...

Documents

Transcript of RIDM Use in CNSC Category 3 Safety...