COMPLEMENTARY SAFETY ASSESSMENT 1. General Context and Planning

Less than two weeks after Fukushima event, European authorities requested that a comprehensive safety assessment, in light of preliminary lessons learned from the accident, be performed on all EU nuclear plants. The stress tests specification validated in May requires analysis on 6 items: earthquake, flooding, other natural hazards, total loss of electrical supply, total loss of heat sink, and management of severe accidents. It includes a first part with description of the current design basis, and check of conformity of the installation, and an evaluation of behavior of the plant beyond the design basis, in order to identify possible cliff-edge effects and propose ways to increase plant robustness.

The CSA was completed in September by EDF and reviewed by Institut de Radioprotection et de Sûreté Nucléaire (IRSN). The opinion of ASN is summarized in a national report, which was itself the object of peer-reviews performed by Safety Authorities of the 17 participating countries. The process is achieved by editing technical prescriptions from ASN to EDF, in June 2012.

129 2.2. Earthquake Analysis

The original design requirement for ground motion was determined according to French Standard RFS I.2.c. This RFS was updated in 2001 and the needs to upgrade the plants were checked during PSRs. The design requirement of a plant is called SMS. For the design of standard parts of a given series, an envelope response spectrum which bounds all the possible SMS and soil conditions of the series sites is defined. It is called Design Basis Spectrum, which in practice provides margins against SMS for a large part of the sites of a series.

Beyond the design, evaluations where already performed on two sites: a full Seismic Margin Assessment (SMA) in Tricastin, and a seismic Probabilistic Safety Assessment (sPSA) in Saint-Alban. Standardization of nuclear island enables to extend a wide part of the conclusions to other sites of the same series.

For the purpose of CSA, a new analysis was performed to evaluate the behaviour of the plant to about 1.5 SMS. Seismic walkdowns were performed on each reactor. Only the minimum set of equipment needed in case of SBO, around 200 components, was checked considering the limited time to perform the evaluations, the results of the previous evaluations, and the obligation to consider SBO in other parts of CSA. The main conclusion of these evaluations is that seismic capacity of SSCs needed is generally larger than 1.5 SMS.

However, the capacity of some specific equipment needs to be further checked and eventually reinforced for this severe level of earthquake to increase robustness of the units, mainly secured make-up to Emergency Feedwater (EFW) storage tank, to Reactor Water Storage Tank (RWST) and to Spent Fuel Pond (SFP), Emergency Control Center, and sand bed filter.

2.3. Flooding Analysis

The original design requirement for design basis flooding was determined according to French Standard RFS I.2.e. It defines a design reference level called CMS, which depends on the type of site (river or sea side). Following the Blayais flooding (1999), a comprehensive reassessment of the flooding risk where undertaken. It included an update of the risks listed in RFS, taking into account the last available data, complemented with 7 additional hazards:

deterioration of a water storage in case of earthquake, intumescence, rainfall, ground water, failure or equipment item and influence of the wind on the river, on intake channel, or on the sea (i.e., wave swell) according to the type of site. Combinations are also considered if dependency links exist between them.

For the sites where the platform level was not sufficient according to the revision of CMS and its combinations, a peripheral protection (i.e., dikes) was erected or over elevated.

Moreover, as a first protection against ground water and defence in depth protection against other hazards, a volumetric protection was implemented. It consists in a leak-tight envelop including the volume of all the building sheltering safety related equipment, up to the platform level. All the piping, cable or underground penetrations were plugged using tested materials. For a few sites, where presence of water cannot be excluded on the platform and where a delay for implementing protection is guaranteed, this protection has been extended over the platform using mobile protection equipment.

For the purpose of CSA, the hazards levels have been increased using fixed coefficients, to provide an important margin while remaining plausible:

• The flow rate used for CMS of rivers have been increased of 30 %.

• Storm surge have been increased by 1 m for coastal or estuary sites.

• Rain flow rates have been doubled.

• Additional failures over the platform due to heavier earthquake have been considered.

130

The main conclusion is that all sites have margins with respect to updated design basis, once the protective works decided as a result of analysis following Blayais event are completed in due time. However, some sites have no margins or even negative margins with respect to CSA assumptions. The quantity of water brought by rain or failures over platform is generally limited to a few cm or dm. But increase in CMS may reach up to 2 m for few sites.

For these sites, three types of conditions may be triggered: Loss of Ultimate Heat Sink (LUHS), Loss of Off-Site Power (LOOP), and SBO.

To increase robustness of these sites, measures are being considered such as reinforcements or rising of peripheral dikes, elevation above the platform level of the volumetric protection, or limit the additional protection to a set of key functions needed to reach and maintain the unit in a safe state, in a watertight protection when the platform is flooded. A study is in progress to check if for some sites an important earthquake upstream the site could cause the break of more than one dam (the most penalizing one is already in design basis).

2.4. Other Extreme External Hazards

The external hazards linked to the risk of flooding, and not fully examined in the previous chapter were examined, that is hail, lightning and wind. Direct effect of extreme winds and lightning are already considered in the design basis, and wind induced projectiles were considered through PSR. The standard design of structures against an external explosion of 5 kPa provides an important margin against direct effect of extreme winds. Robustness against indirect effect of extreme winds combined with LOOP of 6 hrs and LUHS has been assessed leading to protection of specific equipment. Robustness of equipment sensitive to hail has been confirmed.

No cliff edge effect has been identified for these hazards. Additional studies are being performed to increase robustness of plant to extreme winds: assessment of the resilience of the CFV, and identification of equipment needed for the emergency plan to be reinforced.

2.5. Loss of Electrical Power and Cooling Systems

LOOP is included in the original design of the plant, and subsequent modifications enabled to take into account more complicated situations such as SBO and LUHS. Autonomy for LOOP is around 3.5 days for the fuel tank, and it is at least 100 hours for LUHS when only one unit of a site is concerned. This value may be reduced in case of accident concerning all units, but the minimum value was increased during last PSR to 24h for coastal sites and 60h for others.

In case of SBO, coping means are the EFW turbine driven pump and the turbine driven generator (called LLS) to supply Chemical and Volumetric Control System (CVCS) hydrotest pump for Reactor Coolant Pump (RCP) seal injection and minimum Instrumentation and Control (I&C). Minimum autonomy is about 24 h before core uncover.

Beyond the design, no recovery of these means was considered, and additional cases where studied: SBO + loss of any other on-site backup electrical power, without external hazards, and SBO + LUHS, with CSA type hazards. Additional studies will be performed to assess the possibility for LLS and EFW turbine driven pump to continue to operate after 24 h even if ventilation systems are lost, and to check by tests the behaviour of existing RCP seals at high temperatures. Other cliff edge effects may appear due to decrease in pressure of Steam generators (SGs), to insufficient quantity of water in EFW tanks, and shared components between units.

131 To improve the behaviour of the units, the main improvements being studied are the increase of battery autonomy, the implementation of additional generator sets for each unit, and the addition of ultimate ways to recharge water in EFW system and in SFP that are unlimited in nature (drilling, basins...).

2.6. Severe Accidents

Severe accident management was introduced progressively in the plants through the PSRs, taking into account the feedback from foreign accidents and the results of research and development (R&D) programs EDF participate in this field. The main provisions available on the units are the CFV using sand bed filter outside the containment and metallic prefilter inside, against slow pressurization, PARs inside containment building, and reliable depressurization of reactor cooling system (RCS) to avoid pressurized core melt and induced SG tube rupture (being implemented),

The main measures studied to improve the behaviour of the plants are:

• To strengthen the electrical back-up of ventilation filtration system of the control room to improve its habitability.

• To systematically ensure a basic pH of water in containment in case of core melt to limit iodine emissions, thus reducing the short term impact of the situation.

• To improve the filtration of organic iodine.

3. THE SAFETY IMPROVEMENTS