SAFETY
APPROACHESThe “practical elimination”
approach of accident
situations for water-cooled
nuclear power reactors
2020
Revision 1

MEMBEROF

ABSTRACT
The implementation of the defence in depth principle and current regulations have lead applicants
to define provisions to prevent accidents, including severe accidents, and to limit theirconsequences should they occur.
However, while defining the design orientations for a new water-cooled power reactor, applicants
shall use the “practical elimination” approach for severe accident situations (in the reactor core or
the spent fuel pool) potentially leading to large early radiological releases, where it appears
impossible to define realistic and demonstrable provisions to limit their consequences according tocurrent knowledge and the techniques available at the time.
The use of this approach should be discussed between the applicant and the safety authority at thedesign orientations stage; the authority will specify on a case-by-case basis the conditions for its
approval.
In order to “practically eliminate” a situation, the designer shall first examine the possibility formaking it physically impossible. Where physical impossibility cannot be achieved, provisions shall be
implemented to justify with a high degree of confidence that the situation is extremely unlikely.
Situations likely to be “practically eliminated” are diverse (massive and rapid reactivity insertion
accidents, explosions, containment bypasses, etc.); the justification of “practical elimination” canonly be assessed on a case-by-case basis, using deterministic considerations complemented by aprobabilistic analysis. The assessment relies on the reactor physical characteristics as well as on therobustness and reliability of the lines of defence implemented to prevent the situation to be“practically eliminated”. The implemented provisions shall be subject to strong design,
manufacturing and operation requirements; considerations related to human factors and hazards
shall also be taken into account.
This document is an orientation text which defines IRSN approach to “practical elimination” and its
place in safety demonstration.

RESUME
D’une manière générale, la mise en œuvre du principe de défense en profondeur et de larèglementation en vigueur conduit les concepteurs de réacteurs de puissance à définir desdispositions visant, en complément des dispositions de prévention, à limiter les conséquences desaccidents pouvant entraîner une dégradation du combustible de ces réacteurs.
Toutefois, lors des orientations de conception d’un nouveau réacteur de puissance à eau, leconcepteur doit recourir à une démarche d’« élimination pratique » pour les situations d’accident
grave (cœur du réacteur ou piscine d’entreposage de combustibles usés) pouvant entraîner desrejets radiologiques précoces importants, qui apparaîtraient, dans l’état des connaissances et destechniques disponibles lors du choix des orientations de conception, ne pas pouvoir faire l’objet dedispositions raisonnables et démontrables de limitation des conséquences.
L’utilisation d’une telle démarche devrait être soumise par le concepteur ou l’exploitant àl’autorité de sûreté lors de l’examen des orientations de conception ; l’autorité précise au cas par
cas les conditions de son approbation.
Afin d’« éliminer pratiquement » une situation, le concepteur doit d’abord examiner les possibilitésde la rendre physiquement impossible. Lorsque cela n’est pas possible, des dispositions concrètes

1/12permettant de justifier que la situation est extrêmement improbable, avec un haut degré deconfiance, doivent être prises.
Lessituations

pouvant

fairel’objetd’unedémarched’« élimination

pratique »sontdiverses (accidents d’insertion rapide et massive de réactivité, explosions, bipasses du confinement,etc.) ; leur caractère « pratiquement éliminé » ne peut être apprécié qu’au cas par cas, sur la basede considérations

déterministes, complétées par un éclairage probabiliste. Cette appréciation

repose sur les caractéristiques physiques du réacteur ainsi que sur la robustesse et la fiabilité deslignes de défense mises en œuvre pour prévenir la situation à « éliminer pratiquement ». A ce titre,les dispositions retenues doivent faire l’objet d’exigences de conception, de réalisation etd’exploitation ; la prise en compte des aspects liés aux facteurs humains et des agressions dans ladéfinition et la conception de ces dispositions est importante.
Ce document est un texte d’orientation qui définit l’approche de l’IRSN concernant la démarched’« élimination pratique » et son positionnement dans la démonstration de sûreté.

KEYWORDS“practical elimination”, safety demonstration, severe accident, radioactive releases

2/12TABLE OFCONTENTS
1 INTRODUCTION .............................................................................. 5
2 THE “PRACTICAL ELIMINATION” APPROACH: GENERAL CONSIDERATIONS ...... 7
3 SITUATIONS FOR WHICH A “PRACTICAL ELIMINATION” APPROACH CAN BE
USED ............................................................................................. 9
4 JUSTIFICATION OF “PRACTICAL ELIMINATION” ...................................... 9
4.1 Physically impossible situations ........................................................10
4.2 Situations extremely unlikely with a high degree of confidence..................10

5 CONCLUSION ............................................................................... 11

3/12

REFERENCES[1]

General safety objectives for the next generation of pressurised water reactors - 1993

[2]

Defence in depth in nuclear safety - INSAG-10 - 1996

[3]

Basic safety principles for nuclear power plants 75 - INSAG-3 Rev.1 INSAG-12 - 1999

[4]

Technical guidelines for the design and construction of the next generation of nuclear power
plants with pressurized water reactors, adopted by the Advisory Committee for Nuclear
Reactors (GPR) and German experts in 2000

[5]

WENRA - RHWG safety of new NPP designs – Mars 2013, incluant le document “WENRA
statement on safety objectives for new nuclear power plants” – Novembre 2010.

[6]

RHWG report for the attention of WENRA -Practical Elimination Applied to New NPP Designs Key Elements and Expectations – 17 Septembre 2019 (publié en novembre 2019 sur le site
internet de WENRA)[7]

Order of 7 February 2012 setting the general rules for basic nuclear installation[8]

IAEA Safety Standards Series No. SSR-2/1 (Rev. 1), Safety of Nuclear Power Plants: Design –Specific Safety Requirements – 2016

[9]

Council Directive 2009/71/EURATOM of 25 June 2009 establishing a Community framework forthe nuclear safety of nuclear installations amended by Council Directive 2014/87/Euratom of
8 July 2014[10] ASN Guide n° 22 produced jointly with IRSN - Design of pressurised water reactors – 18 July
2017 (currently only available in French)

4/12

1 INTRODUCTION
Following the Three Mile Island and Chernobyl accidents, the need of a significant improvement of
the safety of reactors to be built from the start of the 21st century compared to the ones inoperation or under construction at the end of the 20th century has been recognized at theinternational level. This improvement seemed to be achievable for water-cooled reactors taking
into account the state of knowledge achieved on core melt accidents.
It was in this context that the fourth level of defence in depth was developed, implying theimplementation of design provisions aimed at limiting the consequences of accidents with reactor
core melt. However, in some core melt situations that could be envisaged at least theoretically, it
appeared impossible to implement realistic provisions that would reduce the radiologicalconsequences at an acceptable level and to demonstrate their robustness. For this reason theconcept of “practical elimination” was introduced during the 1990s.
For water-cooled reactors, these situations were characterized by rapid high-energy phenomenathat could drive to a sudden failure of the containment and lead to “large early releases”. An
objective of elimination was set for these situations, but since the elimination was not strictly
demonstrable except in case of physical impossibility, the term “practically eliminated” was coined,meaning that the applicant shall implement “all reasonable provisions” to ensure that the accident
situation could, by mutual agreement with the relevant safety authority, be considered extremely
unlikely with a high degree of confidence.
The term “practical elimination” appeared for the first time in 1993 in the definition of the generalsafety objectives for the future pressurised water reactors [1]. These objectives have been thendeveloped in the “Technical guidelines for the design and construction of the next generation of
nuclear power plants with pressurized water reactors” [4]:“d)[…] an important objective is to achieve a significant reduction of potential radioactive

releases due to all conceivable accidents, including core melt accidents. […]Accident situations with core melt which would lead to large early releases have to be "practicallyeliminated": if they cannot be considered as physically impossible, design provisions have to betaken to design them out. This objective applies notably to high pressure core melt sequences.
Low pressure core melt sequences have to be dealt with so that the associated maximum
conceivable releases would necessitate only very limited protective measures in area and in time
for the public.”
Without explicitly referring to the concept of “practical elimination”, Article 3.9 of the Order of
7 February 2012 [7] also includes this objective: “The demonstration of nuclear safety must provethat accidents that could lead to large releases of hazardous substances or to hazardous effects off
the site that develop too rapidly to allow timely deployment of the necessary population
protection measures are physically impossible or, if physical impossibility cannot be demonstrated,that the measures taken on or for the installation render such accidents extremely improbablewith a high level of confidence”. Pursuant to this article, ASN guide n° 22 related to the design ofpressurised water reactors [10] specifies : “accident situations with fuel meltdown which could
lead to significant radioactive releases that develop too rapidly to allow timely the deployment of
the necessary population protection measures in good time shall be rendered physically impossible
5/12or, failing this, measures shall be implemented to render them extremely improbable with a highlevel of confidence”.
At international level, INSAG 10 [2] stated in 1996 that: “For advanced designs, it would bedemonstrated, by deterministic and probabilistic means, that hypothetical severe accident
sequences that could lead to large radioactive releases due to early containment failure are
essentially eliminated with a high degree of confidence”.
Then, in 1999, INSAG 12 [3] stated: “27 - the target for existing nuclear power plants consistent
with the technical safety objective is a frequency of occurrence of severe core damage that is
below about 10-4 events per plant operating year. Severe accident management and mitigation
measures could reduce by a factor of at least 10 the probability of large off-site releases requiring
short-term off-site response. Application of all safety principles and the objectives of para.251 to
future plants could lead to the achievement of an improved goal of not more than 10-5 severe coredamage events per plant operating year. Another objective for these future plants is the practicalelimination of accident sequences that could lead to large early radioactive releases, whereas
severe accidents that could imply late containment failure would be considered in the design
process with realistic assumptions and best estimate analyses so that their consequences would
necessitate only protective measures limited in area and in time”.
Different international texts, issued by WENRA or the IAEA, recommend that “practical elimination”
should be applied to situations likely to lead to early or large releases [5] [8].
These texts can be related to the European directive [9] which requires, consistently with safety
objectives stated by WENRA for new reactors:“Member States shall ensure that the national nuclear safety framework requires that nuclear
installations are designed, sited, constructed, commissioned, operated and decommissioned withthe objective of preventing accidents and, should an accident occur, miti¬gating its consequences
and avoiding:a) early radioactive releases that would require off-site emergency measures but withinsufficient time to implement them;b) large radioactive releases that would require protective measures that could not belimited in area or time”.
Within this context, IRSN wants to clearly distinguish the “practical elimination” approach from theapproach aiming at improving defence in depth, as explained hereafter in the current document.
For its part, the RHWG report for the attention of WENRA mentions that the different WENRA
countries practices can be consistent with the European directive objective whilst varying regarding
the use of the notion of “practical elimination” [6].
The current report is a revision of the report published in 2017 in order to take into account the
aforementioned RHWG report [6].

1“25. For future nuclear power plants, consideration of multiple failures and severe accidents will be achieved in a more
systematic and complete way from the design stage…”

6/12

2 THE “PRACTICAL ELIMINATION” APPROACH:GENERAL CONSIDERATIONS
Nuclear facilities are designed according to the defence in depth principle: a series of provisions aredefined on the one hand to prevent accidents and on the other to limit the consequences of any
accidents that do occur despite the provisions taken to prevent them. There are today five levels ofdefence in depth for nuclear reactors; each level aims to limit the consequences of the failure of
the previous level and to prevent challenging the next one, in compliance with the general safety
objectives set for these reactors:

the first four levels rely on physical, human and organisational provisions defined by theapplicant;the fifth level, of different nature2, essentially consists of organisational provisions
implemented by the utility and the governmental authorities in case of emergency
potentially leading to off-site consequences. Actions to protect the population foreseen in
the off-site emergency plans can then be implemented if needed.

The design mainly focusses on the first four levels of defence in depth, aiming to limit as far as
possible the risk of off-site radioactive releases. The safety approach used for the design of new
nuclear facilities aims to enhance defence in depth improving the robustness of the different levels,
increasing their independence, improving the way hazards are taken into account, etc.. However, it
is important to point out that the implementation of defence in depth has its limitations and that it
is not possible, for facilities where large quantities of radioactive materials coexist with the energy
able to disperse them, to limit the consequences to an acceptable level in all cases.
So situations likely to lead to large releases, because of the simultaneous or successive loss of
integrity of all the containment barriers or because of the bypass of these barriers (containment
bypass situations):

either lead to define provisions allowing to significantly limit their consequences;or shall be “practically eliminated” where it appears to be impossible to define suchprovisions or to demonstrate their adequacy with the knowledge and techniques available atthe time of the design orientations.

For French water-cooled reactors, for example, the situations likely to lead to large radioactive
releases are:core melt with loss of containment integrity - case 1;
core melt with containment bypass - case 2;
core melt when the containment is open (shutdown states) - case 3;
melting of spent fuel assemblies being handled or stored in the spent fuel pool - case 4.

2

For the first four levels of defence in depth, the applicant has an obligation of “results”, i.e. it shall demonstrate that theprovisions taken at the design stage and during operation allow the safety objectives of the facility to be met while the fifth
level of defence in depth is essentially an obligation of “means”.

7/12

Cases 1 and 2: the integrity of the containment, or more generally of the third containment barrieror its extension3, could be affected suddenly by the occurrence of a high-energy phenomenon (e.g.
massive and rapid reactivity insertion, hydrogen detonation, etc.) or by the failure of one or more
items of equipment contributing to the containment function4, or more gradually due to the loss ofthe containment heat removal function (slow increase of temperature and pressure inside thecontainment, erosion of the basemat by the corium, etc.). In the latter case, the uncertainties
associated with possible evolutions of the plant conditions are smaller and the operator would havesome time to act before large releases occur. The definition of provisions to limit the consequencesof these situations and the justification of their sufficiency are possible. This is why, according to
IRSN, only fuel melt situations that could lead to large early releases shall be “practicallyeliminated”; for other situations, sufficient provisions to limit releases into the environment shallbe defined by the applicant.
Case 3: this case results from the impossibility of keeping the containment permanently closed, due
to operating imperatives. The applicant shall take provisions to “practically eliminate” situations
leading to a severe degradation of the first two containment barriers in this state, which could also
lead to large early releases;
Case 4: for this case, the implementation of provisions to limit releases due to the melt of spent
fuel assemblies could technically be envisaged. However, in France, the spent fuel pool is locatedoutside the containment, given the relatively slow kinetics of accidents likely to lead to a severe
degradation of these assemblies and the potential for intervention in the corresponding building.
This option has been considered as acceptable up to now. Hence, given the scale of the releases
that could result from fuel melt in the spent fuel pool, the “practical elimination” approach shall be
used also for these situations.

Therefore, while defining the design orientations for a new water-cooled power reactor,
applicants shall use the “practical elimination” approach for severe accident situations (in thereactor core or in the spent fuel pool) potentially leading to large early radiological releases,
where it seems impossible to define realistic and demonstrable provisions to limit theirconsequences according to current knowledge and the techniques available at the time.
IRSN highlights that it would not agree a priori the notion of “practical elimination” of accident
situations to be used for other accidental situations than those aforementioned. Particularly, it
should not be applied without discussions to accident situations for which no provisions would havebeen implemented to limit their consequences. This highlights how important the discussions
between applicants and safety authorities in the early stages of a new design are, primarily with theintention of improving the defence in depth.

3

The extension of the third barrier refers to the envelope of circuits belonging to the systems whose operation is needed inincident or accident conditions to ensure a safety function and carrying radioactive fluids (reactor coolant, containment
atmosphere) outside the containment.
4

It is aimed in particular at core melt situations with steam generator tube(s) rupture as well as bypasses leading to core
melt.

8/12

3 SITUATIONS FOR WHICH A “PRACTICALELIMINATION” APPROACH CAN BE USEDIn the general design approach, applicants identify the operating and accident conditions, which areclassified into categories associated with objectives for limiting off-site consequences, dependingon the estimated frequency of occurrence of the conditions. At this stage, a number of single
initiating events and multiple failures are “excluded” since considered as not plausible; thus, theirconsequences are not studied deterministically in the safety demonstration and no mitigation
provisions are defined.
In order to consider situations likely to lead to large early releases as “excluded”, the applicant
shall use the “practical elimination” approach. These situations are identified on the basis of theanalysis of the third barrier (or its extension) possible failure modes.
With regard to this, IRSN emphasises that the acceptance of a new design at a given time is basedon considerations relating to both the probability of accident situations occurring and the possible
consequences of those situations, in view of the knowledge and technical possibilities available atthe time. This is why it is important for discussions between applicants and safety authorities tobegin as early as the conceptual design stage, with the authority concerned setting objectives andthe applicants proposing safety options able to meet these objectives. This was what happened in
1993 when the design orientations of the pressurised water reactors to be operated in France andGermany in the early 21st century were being developed. The design of a nuclear facility being an
iterative process, discussions should continue throughout the licensing process; the conclusions ofthese discussions should be formally recorded at certain stages of the process.
Situations for “practical elimination” should be characterised taking account of uncertainties due tolimited knowledge of certain physical phenomena. This characterisation should rely as much as
possible on dedicated studies or research and development activities (identification of the relevant
sequences and determination of the limit values of key parameters beyond which provisions to limit
the consequences could not be taken (e.g. threshold value for a reactivity insertion in pcm/s)).
It is important that, from the early design stages, the applicant specifies the provisions it envisages
to prevent the situations to be “practically eliminated” and the approach to justify the “practicalelimination” of these situations.

4 JUSTIFICATION OF “PRACTICAL ELIMINATION”
The Technical Guidelines (A.1.4) [4] state:“However, the "practical elimination" of accident situations which could lead to large early
releases is a matter of judgement and each type of sequence has to be assessed separately. Their"practical elimination" can be demonstrated by deterministic and/or probabilistic considerations,taking into account the uncertainties due to the limited knowledge of some physical phenomena. It
is stressed that "practical elimination" cannot be demonstrated by compliance with a general "cutoff" probabilistic value.”
The situations for which the “practical elimination” approach can be applied are very diverse andproof that they are physically impossible or, failing that, extremely unlikely with a high degree ofconfidence, can only be achieved through analysis on a case-by-case basis.
9/12

The justification of “practical elimination” shall preferably rely on the physical impossibility of thesituation (see Section 4.1 below). Where this is not possible, the applicant shall demonstrate with ahigh degree of confidence that the situation is extremely unlikely (see Section 4.2 below).

4.1 Physically impossible situations
Demonstration of the physical impossibility of a situation can be based on various considerations,for example:
intrinsic characteristics that guarantee the non-occurrence of certain dreaded
phenomena (e.g. neutron feedback);
design choices limiting the quantities of substances likely to produce energetic
phenomena (e.g. limitation of the capacity of deborated water tanks for the circuits
connected to the reactor primary circuit in order to prevent heterogeneous dilutions, which
would lead to a reactivity-initiated accident);passive static equipment that cannot fail (such as construction provisions allowing toprevent a heavy load drop from seriously damaging the structural integrity of the spent fuelpool and causing the uncovery of spent fuel assemblies or an assembly being handled).
It should be noted that the demonstration of physical impossibility shall not, under any
circumstances, be based on measures requiring active components, since any active component has
a non-zero probability of failure.

4.2 Situations extremely unlikely with a high degree ofconfidence
If physical impossibility cannot be demonstrated, it has to be proved that the situation is extremely
unlikely with a high degree of confidence. The justification, assessed on a case-by-case basis, isbased on a deterministic approach, generally complemented by probabilistic analysis and relies on
the following principles:the deterministic justification for a situation being “practically eliminated” shall be basedon both the existence of a sufficient number of lines of defence consisting of material andorganizational provisions and the robustness and independence of these different lines ofdefence;material provisions defined within the scope of the “practical elimination” of an accident
situation shall be subject

torequirements5 concerning

the design (redundancy,

diversification, geographical separation, backup power, qualification, reliability, etc.),
manufacturing (quality control) and operation (operation monitoring...). This also applies tothe instrumentation used to check the functions fulfilled by these provisions. The more aprovision or a set of provisions contributes to reduce the probability of a situation
occurring, the more the requirements are stringent.

5

It should be pointed out that functions and equipment already subject to requirements in accordance with accident
studies may contribute to the justification of “practical elimination” of an accident situation.

10/12

Provisions defined within the scope of the “practical elimination” of an accident situation
shall be tolerant to human actions and errors:othe applicant shall prove that these provisions cannot be challenged because of humanerrors prior to the accident (e.g. maintenance) or that it takes all necessary measures
to limit the probability of such errors;oif the justification for “practical elimination” is partly based on human actions (e.g. thedepressurisation valves in the Flamanville 3 EPR main coolant circuit, which have to beopened manually by the operators to “practically eliminate” high-pressure core melt
situations), the operators shall have the necessary information for carrying out theseactions without misunderstandings and for checking their effectiveness. The detection
systems shall be reliable, clear and explicit, and the time scales within which theactions have to be carried out following the alert shall be long enough, particularly
given the conditions of intervention, so that the actions can be considered to have avery low probability of failure.

Provisions defined within the scope of the “practical elimination” of an accident situation
shall be tolerant to internal and external hazards; in particular, the occurrence of rare andsevere external hazards shall not challenge a “practical elimination” justification.
Preference should be given to the implementation of provisions that are tolerant to the lossof support functions.
Although probabilistic safety assessments (PSA) can be used to assess the exhaustiveness ofthe measures taken to avoid certain accident situations (in particular their investigation
methods

canidentify

situations

resultingfrommultiplefailuresnotidentified

deterministically (support system failures, common cause failures, human errors, etc.)),they should be used with care for assessing the extreme unlikeliness of situations for“practical elimination” because of the impact that the models used and the assumptions
taken into account can have on the results.
if the situation to be “practically eliminated” is the result of a single event corresponding to
the failure of a mechanical component of the facility, the justification of “practicalelimination” is based on the “non ruptible” nature of this component (e.g. reactor vessel,
steam generators external envelope).

5 CONCLUSION
A “practical elimination” approach is currently applied, consistently with the recommendation of
the ASN guide n° 22 related to the design of pressurised water reactors [10], for severe accident
situations that can lead to large early radioactive releases, where it appears impossible to define
realistic and demonstrable provisions to limit the consequences of these situations.
The situations for which this approach can be used shall be discussed by applicants and safety
authorities from the initial design stages of a new reactor type. The discussions should continue
throughout the entire licensing process.
However, any agreements resulting from these discussions are time limited given that they takeaccount of current knowledge and technical possibilities. Although using the “practical elimination”
concept means that the consequences of the accident situations concerned are not studied in detailand are not included in the formal safety demonstration, this should not stifle continuous efforts to

11/12

improve safety, further reflection leading to potential safety improvements may still be carried out
later on, after the initial design phase, for example during periodic safety reviews.
In order to “practically eliminate” an accident situation, the applicant shall first examine thepossibility for making it physically impossible. If this cannot be achieved, provisions shall be takenthat enable the situation to be considered extremely unlikely with a high degree of confidence.
These provisions shall be subject to requirements in terms of design, manufacturing and operation;
they shall be tolerant to human actions, human error or hazards. The justification of “practicalelimination” should be examined on a case-by-case basis, using deterministic considerations,complemented by a probabilistic assessment.

12/12

31, avenue de la Division Leclerc
92260 Fontenay-aux-Roses
RCS Nanterre b 440 546 018
MAIL
B.P. 17 - 92262 Fontenay-aux-Roses Cedex

PHONE+33 (0)1 58 35 88 88
WEBSITE
www.irsn.fr
E-MAIL
contact@irsn.fr@IRSNFrance

MEMBEROF