Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE

Date: December 2020
Validity: until next update or archiving
Version 1

MDEP Design-SpecificTechnical Report
TR-HPR1000WG-02
HPR1000 WORKING GROUP

Technical Report on Regulatory
Requirements and Practices for Severe
Accidents

Participation
Regulators involved in the MDEP working group
discussions:

ARN (Argentina), NNSA (China),
NNR (South Africa), ONR (UK)

Regulators which support the present technicalreport:ARN (Argentina), NNSA (China),
NNR (South Africa), ONR (UK)

Regulators with no objection:

none

Regulators which disagree:

none

1

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE

Date: December 2020
Validity: until next update or archiving
Version 1

MDEP HPR1000 – Severe Accidents TESGTechnical Report on Regulatory Requirements and Practices for Severe Accidents

Introduction
The HPR1000 design is currently under review in the UK and the People’s Republic ofChina. A Multinational Design Evaluation Programme (MDEP) design-specific working groupfor the HPR1000 has been established consisting of the following members, referred to as‘regulators’ herein:••••

Office for Nuclear Regulation (ONR) – UK;
National Nuclear Safety Administration (NNSA) – China;
Autoridad Regulatoria Nuclear (ARN) – Argentina; andNational Nuclear Regulator (NNR) – South Africa.

A Severe Accidents (SA) Technical Expert Sub-Group (TESG) was established as part of
the HPR1000 MDEP design-specific working group. Early in the establishment of the SA
TESG, it was agreed that a technical report would be produced in order to compile theexpectations of the regulators that are applied when assessing safety submissions anddesign aspects associated with severe accidents.
This document summarises the regulatory requirements and expectations of the regulators,
and highlights where consensus or differences exist. A survey was produced and sent to all
regulators regarding various aspects of the regulation, analysis, and management of severe
accidents. This report compiles the information provided within the responses to the survey
and summarizes the information presented by the regulators.
It should be noted that whilst there is a close relationship between the severe accident
analysis and the demonstration of practical elimination of large or early releases, the conceptof practical elimination is addressed by a separate common position paper currently being
produced under the HPR1000 MDEP design-specific working group .
Regulatory Requirements
Definition of a Severe Accident
China, Argentina and South Africa define a severe accident in terms of an accident condition
involving significant damage to the core. The UK definition is not specific to reactors, and isexpressed in terms of an accident with potential off-site dose consequences in excess of 100
mSv or “substantial unintended relocation of radioactive material within the facility thatplaces a demand on the integrity of the remaining physical barriers”. However, the definitions
are broadly aligned and serve the same purpose.
For reactors, NNSA specifically adopt the Design Extension Condition (DEC) approachwithin its regulatory requirements. Whilst not explicit guidance/policy, ONR, ARN and NNR’s
expectations for deterministic severe accidents analysis align with those of DEC-B, andthese expectations are implicitly expressed in their respective guidance/policy documents.

2

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE

Date: December 2020
Validity: until next update or archiving
Version 1

With the above in mind, whilst there are differences in the definitions of severe accidents in
the respective regulatory frameworks, the intent of the definition for the purpose of lightwater reactors is aligned, in that it relates to significant core degradation and mitigation.
Slight differences arise in the approach to severe accidents analysis in the spent fuel pool.
NNSA require that the designer/licensee demonstrate that significant fuel degradation in
SFP should be “practically eliminated” via adequate water supplies and monitoring to reduce
the probability of occurrence to extremely low values, whereas the other regulators are nonprescriptive. In practice, however, the demonstration of reducing risks as far as reasonably
practicable (as is expected by the other regulators), should drive the designer/licensee todemonstrate that scenarios with the potential to lead to large or early releases are practicallyeliminated by keeping fuel adequately cooled to avoid significant fuel degradation.
Relevant legislation, requirements and guidance
In general, the regulatory framework for regulators’ consideration of severe accidents
comprises a hierarchy:i. National legislation (of various forms); andii. Policy, regulations, and/or guidance originating from the nuclear regulatory body.
Item (ii) directs that severe accidents be addressed in the design and operation of nuclear
power plants in all regulatory frameworks. NNSA and ONR has established guidance andexpectations to inform their independent regulatory reviews of designer/licensee severe
accident analysis safety reports. NNR and ARN are still developing their guidance however
their regulatory frameworks require the expectations of IAEA safety standards to be met.
All regulators expect designer/licensees to comply with their domestic regulatory framework,and to meet the expectations of guidance and/or guidelines issued by the regulator so far as
reasonably practicable. In all cases, the domestic requirements/expectations are at leastaligned with IAEA safety standards.
Severe Accident Analysis
All regulators are aligned on the use of Severe Accident Analysis. The regulators agree thatit should be used to:
•
•
•
•
•
•

identify severe accident scenarios beyond the design basis;
identify reasonably practicable features to prevent or mitigate severe accident
scenarios;
demonstrate the effectiveness of the severe accident features;
define the environmental conditions in a severe accident;
support the Level 2 PSA; andsupport the development of severe accident management guidelines (SAMGs).

In pursuit of developing the SAMGs, the regulators also expect the designer/licensee to
identify design features that could be used in severe accident scenarios, which are not3

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE

Date: December 2020
Validity: until next update or archiving
Version 1

directly dedicated to the prevention and mitigation of severe accident phenomena, but which
may benefit situational awareness or provide additional safety benefits.
All regulators agree that the severe accident analysis should cover all plant operating states,from reactors at power through refuelling, as well as severe accidents in the spent fuel pool.
A shared expectation is that large or earlier releases are practically eliminated. For severe
accident analysis, the designer/licensee is expected to demonstrate that unlikely events withlarge consequences have been considered, and that adequate safety features areincorporated in the design to either prevent escalation or mitigate consequences of severe
accident phenomena.
When performing SAA, the designer/licensee is expected to consider the relevant severe
accident phenomena that may occur if measures provided for design basis accidents fail orare not effective in preventing fault escalation. The designer/licensee is expected todemonstrate that those phenomena will not result in failure of the last barrier to release.
None of the regulators are prescriptive in how it expects the designer/licensee to define
which phenomena should be considered.
Regulators consider that the majority of the deterministic analysis to support Severe
Accidents Analysis should focus on the demonstration of the effectiveness of the severe
accident features. Where a designer/licensee does not consider it appropriate to design tomitigate a certain phenomenon, regulators expect that it is demonstrated through qualitativeand quantitative arguments, drawing on international research and experience asappropriate, that these phenomena can be excluded due to sufficiently low probability or
physical impossibility. However, it is also expected by the regulators that some of the
excluded phenomena be analysed in order to demonstrate an understanding of the
progression of severe accidents.
The means by which the designer/licensee demonstrates the effectiveness of the SA safety
features and performs analysis to support the Level 2 PSA is not prescribed by any of theregulators. It is the designer/licensee’s choice on which analysis tools it uses in its severe
accident analysis. However, the designer/licensee is expected to provide justification for theuse of methodologies in the severe accident analysis in the context of the HPR1000. Whilst
codes and methodologies are not prescribed, regulators expect that the designer/licensee
perform the analysis using codes and methods that are aligned with relevant good practicein the international community and their own guidance. In addition, the regulator may choose
to perform independent analysis of severe accident sequences in order to gain confidence inthe designer/licensee’s severe accident calculations or to unearth uncertainties that may
require further attention.
All regulators agree that the validation and verification (V&V) of the analysis tools usedshould be submitted as part of the designer/licensee’s safety submissions. As thedesigner/licensee may not be the code developer, the regulators do not expect that the V&V
activities and related documentation be performed by the designer/licensee. Moreover, theregulators expect that an understanding of the limitations of the code is demonstrated andthat uncertainty analyses are performed appropriately.

4Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE

Date: December 2020
Validity: until next update or archiving
Version 1

All regulators expect that some form of numerical criteria or limits be used to determine theadequacy of the design. ONR does not define limits (e.g. a limit core damage frequency), butinstead uses numerical targets defined in its guidance to judge whether risks have been
reduced to as low as reasonably practicable.
All regulators expect that technical criteria be set by the designer/licensee in determining theeffectiveness of the severe accident mitigation strategies identified. The technical criteria areultimately linked to the demonstration that the last barrier to release (containment) remains
intact throughout the severe accident progression. For technical criteria not prescribed by
the regulator, it is expected that the designer/licensee provide adequate justification for theiruse, even if those criteria have been adopted from other international practices.
DesignIn general, the severe accident equipment is determined by the designer/licensee and theadequacy of such equipment is reviewed by the regulator. Whilst none of the regulatorsprescribe the choice of severe accident strategies/equipment, all regulators will draw
conclusions on the adequacy of the severe accidents dedicated equipment informed byrelevant good practice and international research. In cases where there is divided opinion on
the inclusion of a certain design feature (for example, containment venting), the regulators’
judgements will be informed by the strength of the arguments presented by thedesigner/licensee.
Aligned with IAEA’s DEC approach, NNSA have specific requirements that adesigner/licensee must not credit mobile equipment in the DEC-B analysis. Whilst ONR,
NNR and ARN do not have specific requirements for use of mobile or fixed equipment, theseregulators judge the adequacy of the design on international relevant good practice.
Therefore, for a new reactor, like the HPR1000, all regulators expect that the design
incorporates permanent equipment to mitigate severe accidents, supplemented by the ability
to connect mobile equipment.
In the severe accident analysis of a generic site (for which DEC-B forms part of), where thelocal emergency arrangements are unknown and the site-specific details are unknown, allregulators agree that the severe accidents safety demonstration should not be dependent on
off-site and on-site mobile equipment in the short term. General assumptions should bemade on their availability after an appropriate time to account for the uncertainty (typically
hours for on-site and days for off-site equipment).
The safety performance requirements are design specific and therefore are not prescribedby the regulator. In general, the regulators expect that the design is optimised in order todeliver the safety functions determined by the designer/licensee. This process is normallyiterative, and achieved through analysis, research and testing.
The mission times for given equipment is not prescribed by any regulator, however, it isgenerally expected that a plant will be autonomous for a number of hours, and control of thesafety functions can be maintained for days without the need for off-site supplies. In making
a judgement on the adequacy of the design, regulators will draw comparisons to relevant
5Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE

Date: December 2020
Validity: until next update or archiving
Version 1

good practice. ONR and ARN require the designer/licensee to demonstrate that risks havebeen reduced to as low as reasonably practicable. This requires a demonstration that any
further enhancements would be grossly disproportionate to the cost, trouble and timerequired to make that enhancement. In addition, all regulators agree that the design shouldbe optimised to a reasonable level to which mobile and off-site equipment could be aligned.
All regulators agree that severe accident safety features should be independent from otherlevels of defence in depth so far as reasonably practicable (with notable exceptions, such as
the containment). The levels of defence in depth should be sufficiently independent that they
are not susceptible to common cause failures. In addition, the implementation of a severe
accidents design strategy should not negatively impact other levels of defence in depth, so
far as reasonably practicable.
None of the regulators expect that the single failure criterion is applied in severe accident
analysis; i.e. none of the regulators expect that SA safety features be single failure tolerantor that the worst single failure be applied in the deterministic analysis of severe accidents.
Notwithstanding this, uncertainty in the severe accident scenarios often means that it isreasonable to incorporate redundancy or sufficient margin in the design, to account for cliffedge effects and to improve the overall reliability. The regulators make their judgement
based upon relevant good practice in a particular area.
Whilst different approaches to the classification of severe accident equipment exist between
the regulators, the intent of the classification is the same. Regulators agree that theclassification of the equipment should be commensurate with the frequency in which its
safety function is demanded and the significance of the consequences of the failure of thesafety function to be delivered. The implications for this are that severe accident safety
features tend to be of lower safety classification than design basis accident safety measures.
There are notable exceptions to this where failure of the severe accident features would
initiate a design basis accident, or where a design basis safety measure is also credited insevere accidents mitigation (e.g. severe accident primary depressurisation valves, passive
autocatalytic recombiners credited in design basis faults, containment etc).
The regulators agree that equipment and instruments needed to deliver SA safety features
should be demonstrated to function during severe accident environmental conditions. It isagreed that the standard of equipment qualification be commensurate with the safetyclassification of the equipment, which may result in a lower standard applied to SA safety
features. However, the environmental conditions in which the SA safety features are
required to perform their safety functions are likely to be harsher than those of design basis
safety measures. In addition, regulators agree that it is often appropriate that equipment
credited in severe accidents have a relatively high standard of seismic qualification.
Severe Accidents Guidelines and Procedures
All regulators agree that site-specific severe accident management guidelines andprocedures should be developed, to guide the operator to most effectively manage an
accident scenario. The basis for development is expected to be informed by the severe
accident analysis; however, the form of this may vary dependent on the facility in question.
6

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE

Date: December 2020
Validity: until next update or archiving
Version 1

For the HPR1000, it is expected that the severe accident management guidelines bedeveloped, in part, with knowledge taken from computer analyses performed as part of thesevere accident analysis.
None of the regulators prescribe criteria for initiation of severe accident management
procedures/guidelines. The regulators agree that the designer/licensee should demonstrate
the reasoning for the choice of said criteria and justify the applicability of the criteria to thedesign. The regulators take cognisance of international good practice relevant to similar
reactor designs when making a regulatory judgement on the adequacy of the design.
None of the regulators prescribe any severe accident management guidelines, and they willvary from one site to another. However, there are slight differences in the requirements
related to the involvement of the regulators in decision making during emergency response,
which impact severe accident management.
Conclusion
The Severe Accidents (SA) Technical Expert Sub-Group (TESG) of the Multinational Design
Evaluation Programme (MDEP) design-specific working group for the HPR1000 has
performed a review of each of the regulators’ regulations and expectations for severe
accident analyses and the implications for reactor design.
The review has found that whilst there are differences in the way that the laws are applied intheir respective countries, the expectations of the regulators are aligned. In general, themethodology for performing severe accident analyses and design features are notprescribed by the regulators. However, all regulators agree that severe accident features
should be incorporated in the design and will assess the design based on relevant goodpractice for new reactors.

7

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicRegulatory
requirements

Question

Date: December 2020
Validity: until next update or archiving
Version 1
Comment

1. How is a severe
Please explain how you
accident defined, and define what constitutes a
how does this relate to severe accident
other accident
conditions considered?

ONR – UK Response

NNSA – China Response

From SAPs paragraph 664. An accident
with off-site consequences with thepotential to exceed 100 mSv, or to a
substantial unintended relocation ofradioactive material within the facility thatplaces a demand on the integrity of theremaining physical barriers.

According to HAF102-2016, a severe
accident is an "accident condition thatexceeds the design basis accident andcauses a significant damage of the core."
The frequency of these accidents isgenerally below 1E-6/reactor per year, withmultiple failures occur, resulting in an
accidental damage of the core. The severe
accident management in industry generally
takes the core outlet temperature above
650 °C as the criterion.

NNR – South Africa Response

From Section 2 of the NNR’s Draft Specific
Nuclear Safety Regulations: Nuclear
Facilities [1]:‘“severe accident” means an accident
condition involving significant coredegradation;’
From Section 5 of [1]:‘(3) The selected events shall be classified,based on the results of probabilistic safetyassessment and engineering judgment,
into the following categories of events:…
The fuel building that contains spent fuel(c) Design base extension conditions,pool does not have the same leak tightness which include all events with frequencies oflike containment. The fission productless than 10-5, including severe accident
inventory is much larger than the core
conditions.’
inventory. However, the decay heat power From p.12 of NNR RG-0019 “Interim
is low, the water inventory in the pool is
Guidance on Safety Assessments oflarge, and the accident progression is slow. Nuclear Facilities” [2]:The NNSA requires the power plant isdesigned with adequate watersupplementary and water level monitoringmeasures after the Fukushima accident.
The frequency of a significant fueldegradation accident in the spent pool islow. Utility should prove that the significant
fuel degradation accident in the spent fuelpool has been “practically eliminated”, so it
does not need to be considered in thesafety analysis report.

ARN – Argentina Response
ARN follows IAEA in the definition of asevere accident:
Accident more severe than a design basis
accident and involving significant coredegradation.
For the HPR 1000 project, severe accident
is an accident with off-site potential
consequences exceeding 100mSv.

HAF102-2016 adopts the concept ofdesign extended conditions, which
comprise conditions in events without
significant fuel degradation and conditions
in events with core melting (severe
accident). The core melting (severe
accident) conditions considered in thedesign are mainly used for the design ofrelevant SSCs, which is reflected in
Section 19.2 of the Safety Analysis Report.
In addition, severe accident analysis is also
applied in the fields of PSA, SAMG
development, emergency response, etc.
2. What is the regulatory Please explain applicable
framework forlegal framework (laws,
consideration of severe regulations etc.)
accidents?

The Health and Safety at Work Act – 1974, China's nuclear safety laws and regulations From Chapter 1, Section 1 of National
requires that risks have been demonstrated are divided into three levels: national laws, Nuclear Regulator Act (Act No. 47 of 1999)
to be reduced to as low as reasonably
State Council Ordinances, and department [3]:practicable. The starting point for meeting rules. The NNSA has also developed policy ‘(xiii) ‘‘nuclear accident’’ means any
the standards of ALARP (As Low As
requirements document and nuclear safety occurrence or succession of occurrences

8

The Argentinean legal framework is formedby the National Constitution, the treaties
and conventions (like Convention on
Nuclear Safety), the National Law of
Nuclear Activity No. 24,804 enacted in April

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestion

Date: December 2020
Validity: until next update or archiving
Version 1
Comment

ONR – UK Response

NNSA – China Response

Reasonably Practicable) is that the design guidelines to guide the nuclear safety
meets Relevant Good Practice (RGP).
review, as well as the design and operation
ONR’s safety assessment principles areof NPP.
benchmarked against IAEA standards, andregularly reviewed to ensure that they at
Mandatory nuclear safety regulations
least meet these.
include:SAP para – 663. “Rigorous application of
1. National laws:
DBA and PSA should ensure that the Peoples Republic of China Law of
predicted risks from fault sequences
prevention and control of radioactive
leading to significant radiologicalcontamination;consequences are very low. Nevertheless, Nuclear Safety Law of the People's
it is important that operators of facilities
Republic of China.
with very large hazard potentials consider 2. State Council Ordinances:possibilities such as: HAF 001, 1986 Regulations of thePeople's Republic of China on the• the DBA or PSA may be incorrect
Safety Supervision and Management
or incomplete;of Civil Nuclear Facilities.
• the true severity of an initiating3.
Department
rules:
event may exceed that considered HAF102 "Nuclear Power Plant
in the analysis; orDesign Safety Regulations" (2016);• a safety measure could be
HAF103 “Nuclear Power Plant
circumvented or fails in someOperation Safety Regulations"unpredicted way.
(2004).
In considering these matters, further
4.
Policyrequirements documents:
beyond design basis improvements mayGeneralTechnical
then be identified as reasonably practicable
Requirements(GTR) on postfor either preventing severe accidents, orFukushima Nuclear Accident
mitigating their consequences, eg by
Improvement Measures for NPPs
preventing further escalation. The insights(Tentative) (2011);
gained from SAA are also important for Safety Review Principle for HPR1000
planning for the possibility of severe
Design (2019).
accidents and are used to inform theresponse activities that would be needed
were such an accident to occur.”
In addition, Article 8a of the European
Nuclear Safety Directive states that:“(1) Member States shall ensure that thenational nuclear safety framework requiresthat nuclear installations are designed,sited, constructed, commissioned,
operated and decommissioned with theobjective of preventing accidents and,should an accident occur, mitigating its
consequences and avoiding:(a) early radioactive releases that would
require off-site emergency measures butwith insufficient time to implement them;(b) large radioactive releases that would
require protective measures that could not
be limited in area or time.”

9

NNR – South Africa Response
having the same origin which—(a) results in the release of radioactive
material, or a radiation dose, which
exceeds the safety standards
contemplated in section 36; and(b) is capable of causing nuclear damage;’

ARN – Argentina Response

1997, with its Regulatory Decree No.
1,390/98 and the Regulatory Standards(AR standards).
Among the AR standards there are two thatare of relevance when considering severe
accidents in nuclear power plants:
AR 10.1.1 Rev3. “Basic Radiation Safety
From R.388: Regulations In Terms Of
Standard”
Section 36, read with Section 47 of theAR 3.1.3 Rev.2 “Radiological criteria
National Nuclear Regulator Act, 1999 Act
relating to accidents in nuclear power
No. 47 on Safety Standards andplants”
Regulatory Practices [4]:These regulations provide a risk based‘6.1 Criteria for the definition of a nuclear
approach and establish limiting criteria for
accident
each accidental sequence with radiologicalAny occurrence or succession ofconsequences for both, the worker and theoccurrences having the same origin andpublic.
resulting in an unintended/unauthorised
In addition, the Memorandum of
exposure to radiation or release of
Understanding for the HPR 1000, which isradioactive material, which is capable ofalso mandatory, establishes that the design
giving rise to an effective dose in excess of of the plant must consider provisions for
1 mSv to the public off-site in a year, or in the prevention or mitigation of theexcess of 50 mSv to a worker on site
consequences of design extension
received essentially at the time of theconditions including severe accidents.
event, is regarded as a nuclear accident as
defined in section 1 (xiii) of the Act.’
From Part 5, Section 3 of the NNR’s Draft
General Nuclear Safety Regulations [5]:(7) A set of design extension conditions
shall be derived on the basis ofengineering judgment, deterministic
assessments and probabilistic
assessments for the purpose of further
improving the safety of the nuclear facility
by enhancing the plant’s capabilities towithstand, without unacceptableradiological consequences, accidents thatare either more severe than design basis
accidents or that involve additional failures.
These design extension conditions shall be
used to identify the additional accident
scenarios to be addressed in the design
and to plan practicable provisions for theprevention of such accidents or mitigationof their consequences if they do occur.
Further requirements on severe accidents
appear in [1].

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestion

Date: December 2020
Validity: until next update or archiving
Version 1
Comment

3. What are the regulatory Please explain any
expectations for
related requirements or
consideration of severe guidance from theaccidents?
regulator, and how theregulator performs its
review

Severeaccident
analysis

4. What are the expected
outputs/uses for thesevere accident
analysis?

Please explain what the
purpose of the analysis is(e.g. to inform SAMG
etc.)

ONR – UK Response

NNSA – China Response

ONR assesses the requesting parties’safety cases primarily against ONR’ssafety assessment principles. As statedabove, ONR’s SAPs are benchmarked
against international relevant goodpractice. This includes, but is not limited to,
IAEA guidance and WENRA reference
levels.
ONR’s SAPs are technology neutral.
ONR’s Technical Assessment Guides
provide more specific guidance andhighlight relevant good practice (such as
IAEA and WENRA standards) that should
be considered in ONR’s assessment.

NNR – South Africa Response

Recommended or referenced documents: The existing NNR regulatory requirements
1. Nuclear safety guidelines
for Nuclear Power Plants (NPP) are
HAD 102/06 Design of Reactor
technology based (PWR, PBMR) andContainment Systems
vendor country specific. Under the current
HAD 102/17 Safety Assessment
regulatory strategies, the vendor country
and Verification for NPPs
and reference plant specific safety
2. Technical documents
requirements are accepted subject to also
HAJ-0001-2016 Nuclear Powerdemonstrating compliance with NNR
Plant Severe Accident Management regulations. The NNR intends to keep thisregulatory strategy for future NPP projects.
3. Drawing on international normative
At present, license applicants are required
documents,
to meet NNR regulations and guides asFor example, NUREG-0800
well as country of origin requirements.
(Standard Review Plan) of USA and The NNR’s Regulatory Framework project
relevant guidelines of IAEA (IAEA
aims to create a comprehensive set of
In addition, ONR may choose to cite
SSG-2 Deterministic Safety
regulations and regulatory guidance
another countries regulations as relevant
Analysis for Nuclear Power Plants, documents that will support new NPPs. At
good practice; it should be noted, however,
IAEA NS-G-2.15 Severe Accident
present, there are several new regulations
ONR cannot impose those regulations, andManagement Programmes for
waiting for Ministry promulgation. The newthat it is the responsibility of the requesting
Nuclear Power Plants, and IAEA
draft regulations ([1] and [5]) are moreparty (the vendor requesting pre-licensing
Safety Reports Series No. 56
detailed and comprehensive compared todesign acceptance) to demonstrate that the
Approaches and Tools for Severe
the existing regulations, for example [3],risks have been reduced to ALARP.
Accident Analysis for NPP ).
and Safety Standards and Regulatory
Practices [4].
Further guidance on severe accidents
appear in RG-0019 [2].
In general, the aims of SAA are to ensure
According to HAD 102/17 and IAEA SSGthat high hazard nuclear facilities are
2, the purpose of the SA analysis:designed and operated so that, should a
1. Apply to relevant SSCs design:
severe accident occur, the facility can be(1) To identify risks and measures under
returned to an appropriately safe andsevere accident, and propose severe
stable condition with the radiologicalaccident prevention and mitigationconsequences mitigated subject tomeasures;principle of ALARP. This involves(2) Guide and support the design ofdetermining the potential progression of the severe accident mitigation measures andaccident, the magnitude and characteristics verify their effectiveness;of the consequences and any cliff edges.
(3) Determine the environmental
ONR SAPs paragraph 672. The severe
conditions of severe accidents for
accident analysis should provide
equipment qualification or availability
information to:
analysis.
2. Applied to support PSA, SAMG
• assist in the identification of any
development and emergency plan zone
further reasonably practicableverification:
preventative or mitigating(1) Support level 2 PSA analysis;
measures beyond those derived(2) Guide and support the developmentfrom engineering analysis, DBA
of
SAMG and confirm its effectiveness;
and PSA;(3) Provide input of severe accident
source terms for emergency preparedness.

10

ARN – Argentina Response
ARN performs review and assessment of
the submissions against the AR standards
and the agreed applicable codes andinternational standards as those from theorigin country of the technology.
The main purpose is the verify complianceagainst the regulatory requisites. It is
important to mention that the Argentinean
regulation is not prescriptive, instead is agoal-setting approach with fully adherence
to IAEA safety standards.

From Part 3, Section 5 of [5]:Severe accident analysis is used for‘(6) A multilayer system of provisions fordifferent purposes.
nuclear safety commensurate with theDuring the licensing process, in particularmagnitude and likelihood of the potential
during the design review, the analysis is
exposures involved shall be applied toused for the identification of adequate
radiation sources or radioactive material for design provisions so that the plant can be
the purposes of –brought into a controlled state and the…
containment function can be maintained,(d) control of severe conditions in which the with the result that the possibility of plantdesign basis of the nuclear facility may be states arising, that could lead to an earlyexceeded, including the prevention of fault radioactive release or a large radioactive
progression and mitigation of therelease, is “practically eliminated”.
consequences of severe accidents; andIn addition, the severe accident analysis(e) mitigation of radiological consequences should provide information to:of significant releases of radioactive• develop and validate of accident
substances that could result from accident
management programs,
conditions.’• support PSAs,
From Part 5, Section 6 of [5]:• develop tech. spec. of severe“(1) Where a prior safety assessment or
accident mitigation systems andoperational safety assessment hascomponents,
identified severe conditions in which the• support the development ofdesign basis of a nuclear facility may be
emergency plans,
exceeded –Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestion

Date: December 2020
Validity: until next update or archiving
Version 1
ONR – UK Response

Comment•

NNR – South Africa Response

form a suitable basis for accident
management strategies andprocedures;support the preparation of
emergency plans for the protectionof people; andsupport the PSA of the facility’s
design and operation(a) Accident prevention andmitigation measures shall beapplied as appropriate in line witha graded approach;(b) Accident prevention andmitigation measures, accident
management procedures andguidelines including emergency
planning, emergency
preparedness and emergency
response shall be established,
implemented and maintained as
appropriate.”
From Appendix 4 of RG-0019 [2]:“The licence applicant should provide in
Chapter 19 of the SAR an adequate levelof documentation to enable the NNR todetermine the acceptability of the risks topublic health and safety associated with
operation of a proposed new plant. The
acceptability of the risks to public healthand safety is determined from theinterpretation of the results and insights of
the applicant's (1) plant-specific PRA and(2) severe accident evaluations.”

The scope of the SAA is determined by therequesting party. However, ONR expectthat the scope includes all possible states
and configurations in which a severe
accident can occur. The scope should
include:a. High consequence events of low
frequency beyond the designbasis; andb. Design basis events where thesafety provisions are assumed tofail.

1. Severe accident sequences need to be From Part 8, Section 2 of [5]:identified through engineering judgement, ‘(a) The authorisation holder shall deterministic assessments and probabilistic (i) conduct a comprehensive hazard
assessment;
assessment of sources of exposure to
2. Based on the existing international
evaluate worker and public radiation doses
research results, considering severe
from potential accidents over a wide range
accident phenomena that have beenof probabilities including severe accidents;’
identified, such as hydrogen explosion,base mat penetration caused by coreconcrete interaction, steam explosion, etc.,
resulting in loss of containment integrity;
3. Conduct severe accident analysis basedon SSCs design and PSA, SAMG
development and emergency plan zone
verification.

••

5. How is the scope of thesevere accident
analysis determined?

NNSA – China Response

ONR expects that severe accident
scenarios should be identified using a
combination of probabilistic anddeterministic approach.
Further guidance on the scope can befound in NS-TAST-GD-007.

11

ARN – Argentina Response•

provide information for plant
simulators.

The scope of the severe accident analysis
is determined by the applicant in fully
agreement with the requirements statedduring the pre-licensing stage.
In the Memorandum of Understanding for
the HPR 1000 it is clearly stated that:
Events that could lead to a release ofradioactive material outside from the plantmust be identified through a systematic
process. The initiating events to bereviewed must include internal events andexternal events, and must be grouped into
categories based primarily on the nature of
the events and their frequency ofoccurrence.
In terms of methodology for theidentification, it is expected that both,
deterministic and probabilistic approach, beused.

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestion
6. If particular severe
accident
phenomenology or
analysis is excluded,
how is this justified?

Date: December 2020
Validity: until next update or archiving
Version 1
Comment

ONR – UK Response

Please explain the basis A full range of SA phenomena should beby which the vendor can considered in the severe accident analysis.
exclude particular
ONR expects that where phenomena arephenomena from analysis screened out, i.e. that the design is not
specifically designed to mitigate
phenomena, then appropriate arguments
should be provided.
This demonstration may be made througha combination of arguments which may
include analyses, in-house research,
international research, a demonstrationthat the effects have negligible impact on
the progression of the transient, that
uncertainties can be bound byconservatisms, or that the occurrence is of
low likelihood (which may also be based on
PSA or the above considerations).

NNSA – China Response

NNR – South Africa Response

ARN – Argentina Response

1. Based on international consensus
derived from research and analysis, suchas the results of SERG and SERENA, thatthe steam explosion in the reactor pressure
vessel does not threaten the integrity of the
RPV lower head;
2. Phenomena with very low probability
and without practical guidance for thedesign, adequate precautions have beentaken, such as the RPV rupture, whichshould be demonstrated to have beenpractically eliminated in the design.

It is considered that similar reasoning as isused for “practical elimination” could be
used. From Section 6.1 of RG-0019 [2]:“4) Practical eliminationa) Accident sequences with a large or
early release can be considered to havebeen practically eliminated if:i) It is physically impossible for theaccident sequence to occur; orii) The accident sequence can beconsidered with a high degree ofconfidence to be extremely unlikely
to arise.

The exclusion may be justified on the basisof engineering judgment as well as
deterministic and probabilistic assessment.
Regarding engineering judgment, theknowledge available today from extensive
programs of research after the Three Mile
Island (TMI) accident provides a soundbasis for the identification of severe
accident scenarios and associatedphenomena that must be addressed in thedesign.
In addition, it may be excluded phenomena
with very low probability of occurrence.

b) In each case the demonstration
should show sufficient knowledge of theaccident condition analysed and of thephenomena involved, substantiated byrelevant and sufficient evidence.
c) The degree of substantiation provided
for a practical elimination demonstration
should take account of the assessedfrequency of the situation to beeliminated and of the degree ofconfidence in the assessed frequency(uncertainties associated with the data
and methods must be evaluated in orderto underwrite the degree of confidence
that is claimed).
d) Appropriate sensitivity studies should
be included to confirm that sufficientmargin to cliff edge effects exist. For
engineered provisions, the practicalelimination can be done for instance by
providing substantial increase of theprotective means of reliability.
e) Practical elimination of an accident
sequence should not be claimed solely
based on compliance with a general cutoff probabilistic value. Even if theprobability of an accident sequence isvery low, any additional reasonably
practicable design features, operational
measures or accident management
procedures to lower the risk further
should be implemented.”
It could also be considered whether
phenomena to be excluded may becovered by bounding or enveloping

12

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestion

Date: December 2020
Validity: until next update or archiving
Version 1
Comment

ONR – UK Response

NNSA – China Response

NNR – South Africa Response

ARN – Argentina Response

scenarios, which should be chosen sothat collectively they include cases
presenting the greatest possible
challenges to each of the relevant
acceptance criteria and involving limiting
values for the performance parametersof safety related equipment. The safety
analysis should confirm that bounding orenveloping scenarios are acceptable.
7. How is the adequacy of Please explain how thethe severe accident
vendor can demonstrate
analysis determined? that their analysis iscomplete and suitable

ONR has produced Technical Assessment 1. Review the analysis assumptions andGuidance on Severe Accident Analysis
methods in accordance with nuclear safety(NS-TAST-GD-007), which provides
regulations and guidelines to confirm theguidance to inspectors on the adequacy of rationality of the results;
the severe accidents safety case. ONR
2. In addition, for the key issues, thealso looks to SSG-2
rationality of the analysis is confirmed by
ONR has performed Generic Designmeans of independent calculation and test
Assessment of the AP1000, UK ABWR and verification, dedicated research program,
UK EPR, and looks to the methods,
and expert consultation.
approaches, codes or models used in theirsafety cases as relevant good practice.

From Part 8, Section 2 of [5]:ARN performs review and assessment of“(a) The authorisation holder shall the submission with the objective to(i) conduct a comprehensive hazard
determine whether the analysis fulfils theassessment of sources of exposure to regulatory expectations as stated in theevaluate worker and public radiation
regulations as well as the applicable codes
doses from potential accidents over a and guides agreed for the plant. Also,wide range of probabilities including
topical reports supporting the analysis
severe accidents;”
hypothesis, phenomenology of the
The demonstration that the severe accident accidents, etc. are required to beanalysis is complete and suitable should
submitted.
show sufficient knowledge of the accident
condition analysed and of the phenomena
involved, substantiated by relevant andsufficient evidence.

8. What acceptancecriteria are applicablefor severe accident
analysis?

Radiological criteria
According to HAF102-2016 and IAEA
SSR2/1 states that “The design shall be
guidelines (SSG-2), the acceptance criteriasuch that for design extension conditions,for analysis of severe accidents should beprotective actions that are limited in terms divided into different levels:of lengths of time and areas of application 1. High level (radiological) criteria, whichshall be sufficient for the protection of therelate to radiological consequences. The
public, and sufficient time shall be available design shall be such that for design
to take such measures.”extension conditions, protective actions
that are limited in terms of lengths of timeand areas of application shall be sufficient
Besides this, ONR’s safety assessment
principles describe the radiological release for the protection of the public, andsufficient time shall be available to takeTargets 8 and 9 which are applicable tosuch measures..
severe accidents. ONR’s SAPs often
2. Detailed (derived) technical criteria,
describe radiological targets in terms of“Objectives” and “Limits”. In simple terms, if which relate to the integrity of barriers to
an Objective is not met, ALARP arguments releases of radioactive material. The
are required to justify why they are not met. analysis of severe accidents should provethat the containment integrity can be
The Limits can be seen as absolute, andONR would not accept a safety case for a ensured.

From Section 4 of [1]:“(1) The safety objectives for nuclear
facility, in addition to the fundamental
safety criteria and objectives specified in
the Annexure 2 of the General Nuclear
Safety Regulations, are:…
(c) The likelihood of an exposure shalldecrease as the potential magnitude
thereof increases;(d) Accidents which could lead to early orlarge releases shall be practicallyeliminated and have to be considered in
the design of the facility; and(e) Any offsite releases that could occur
shall only require limited offsite emergency
response.”

new reactor which breached these limits.
Target 8
Objective – The sum of thesequence frequencies leading to an

For new plants, the safety objective isthe practical elimination of accident
sequences that could lead to large
early radioactive releases, whereas
severe accidents that could imply latecontainment failure would beconsidered in the design process withrealistic assumptions and best estimate
analyses so that their consequences
would necessitate only protective
measures limited in area and in time.
- For new plants, the objective for large
off-site releases requiring short term
off-site response is 10-6 / per reactoryear.
From Section 5 of [1]:Also, severe accident scenarios shall“(4) The following acceptance criteria, in
addition to the safety objectives specified in comply with AR 3.1.3.
regulations 4(1) above shall apply for thevarious categories of events:…

13

ARN doesn´t prescribe acceptance criteria.
The regulatory approach is objectivebased:-Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestion

Date: December 2020
Validity: until next update or archiving
Version 1
Comment

ONR – UK Response

NNSA – China Response

off-site dose greater than 1 Sv,
should be less than 10-6 pa.
Limit – The sum of the sequencefrequencies leading to an off-sitedose greater than 1 Sv should beless than 10-4 pa.
Target 9
Objective – The total risk of 100 or
more fatalities should be less than
10-7 pa.
Limit – The total risk of 100 or more
fatalities should be less than 10-5 pa.
Detailed criteria
ONR does not prescribe acceptancecriteria. However, ONR would look to RGP
in order to make an assessment as to theadequacy of the requesting parties’
acceptance criteria. This may include
taking confidence that the requesting party
meets the international regulators’
specified criteria.
9. How are themethodologies,
approaches, codes ormodels used toperform the severe
accident analysis
specified?

10.
What are therequirements forvalidation andverification of thesevere accident
analysis codes andmodels?

Please explain whether
the vendor or regulator
specifies, and if so on
what basis

NNR – South Africa Response

ARN – Argentina Response(b) Design base extension
conditions – Minor radiologicalconsequences outside theexclusion area are within specified
limits; and(c) Severe accident conditions –Off site radiological consequences
requires limited protective
measures in area and time.”

ONR does not prescribe themethodologies, approaches, codes ormodels used to perform severe accident
analyses. The vendor chooses themethodologies, approaches, codes ormodels.
However, ONR has performed Generic
Design Assessment of the AP1000, UK
ABWR and UK EPR, and looks to themethods, approaches, codes or models
used in their safety cases as relevant goodpractice. ONR expects that the vendors’
choice at least meets these standards.

Approaches, codes and models are
determined by vendors and the results arereviewed by regulator. The rationality of themodel and results are confirmed throughsafety review, and sometimes, by
independent calculation.
According to HAF102-2016, the bestestimate methods and realistic
assumptions can be used for severe
accidents analysis.

The methodologies, approaches, codes ormodels used to perform the severe
accident analysis are proposed by thevendor, with due regard to the regulatory
framework and subject to acceptance by
the regulator.

ONR does not prescribe V&V requirements
for any computer codes used, nor does
ONR license codes.
However, ONR’s Technical Assessment
Guide NS-TAST-GD-042 provides
guidance to inspectors on how to assess
the Requesting Parties’ safety
documentation. ONR’s expectations for
documentation of V&V for SAA codes is
not as involved as design basis codes.

The utility should fully demonstrate that thecodes used can simulate the severe
accidents of a specific power plant design.
And the utility should also analyse theapplicability of the codes. Regulatory
requirements refer to IAEA SSG-2 andIAEA Safety Reports Series No. 56.

To support the safe, reliable operation of
The regulatory expectations for V&V are
the currently operating nuclear power plant aligned with the IAEA SSG-2 and IAEA
in South Africa, a wide range of accident
SRS N°56.
analysis codes covering reactor neutronics,
radiation and dose, thermal hydraulics, andso forth can be utilised.
Subject to appropriate verification andvalidation, these codes can be used in thefollowing applications:• Accident management guidance;• Emergency exercise scenario
development;• PSA analyses;…

14

ARN doesn´t prescribe a specificmethodology, code, model or approach.
The responsibility for the safety
demonstration including severe accident
analysis is under the applicant.
However, ARN expects a best estimate
approach for DECs.

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestion

Date: December 2020
Validity: until next update or archiving
Version 1
Comment

ONR – UK Response

NNSA – China Response

NNR – South Africa Response• Containment performance;…
• Support for design basis, beyond designbasis and severe accident procedures;
See further information in the next row.
Use of these software codes and theperforming of accident analysis for theabove applications shall be subject to thefollowing provisions:• personnel performing analysis using
software codes shall hold appropriatequalification(s) and relevant
authorisation(s);• all analyses shall be carried out inaccordance with approved and controlled
processes and procedures;• verification and validation of the software
code and its models shall be performed.
The extent of applying this shall bedependent on the pedigree of the code(s)and its importance to the safety case;• all software codes and analyses shall be
developed within a formal Quality
Assurance and verification and validation
management system in accordance withapproved and controlled processes andprocedures. An auditable trail shall beevident for all data and phases in thedevelopment, validation and verification
process;• all software codes shall be authorised as
fit for its intended use in each particularapplication and any limitations shall be
specified;• all analyses shall be reviewed internallyand independent reviews shall beconsidered Commensurate with the natureof the calculation and its importance to thesafety case. All review comments and theirresolution shall be documented;• a complete description and justification of
the models, analytical approaches,
equations, approximations, assumptions
and empirical correlations used, thelimitations of the code, sensitivity studies
and demonstration of solution
convergences shall be documented toconform to the principal requirements given
in RG-0016 [10].

15

ARN – Argentina ResponseMultinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicDesign

Question

Date: December 2020
Validity: until next update or archiving
Version 1
Comment

ONR – UK Response

NNSA – China Response

NNR – South Africa Response

ARN – Argentina Response

11.
How is the list of Please explain whether
severe accident related this is done by theequipment specified? regulator or vendor, andhow

ONR does not prescribe the severe
accident related equipment.

The vendor (utility) determines the severe
accident related equipment according to
the system design and management
requirements of the severe accident. The
regulator reviews its adequacy andrationality in accordance with the relevant
requirements.

The list of severe accident related
The list of equipment is developed by theequipment is proposed by the vendor
applicant according to the severe accident
subject to acceptance by the regulator.
analysis. It is important to stress that by
In the context of a possible new build
regulatory requirement, the list must also
programme in South Africa, the NNR also include equipment for monitoring severe
considers guidance as provided in, foraccidents.
example, IAEA SSR-2/2 (Rev. 1) Safety of
Nuclear Power Plants: Commissioning andOperation [9]:“5.8B. The accident management
programme shall include instructions forthe utilization of available equipment —safety related equipment as far as
possible, but also items not important tosafety (e.g. conventional equipment).
5.8C. The accident management
programme shall include contingency
measures, such as an alternative supply ofcooling water and an alternative supply ofelectrical power, to mitigate theconsequences of accidents, including any
necessary equipment. This equipment shallbe located and maintained so as to befunctional and readily accessible whenneeded.”12.
Is there apreference over how
the severe accident
related equipment is
implemented?

ONR does not prescribe the severe
accident related equipment and does nothave a preference; however, if mobile
equipment is credited in the analysis, ONR
expects that it is on-site, readily available,
and any actions required to implement thesafety equipment are timely and feasible.
For new reactors, ONR benchmark it’s
expectations against IAEA’s SSG-2.

Mobile equipment should not be used in
the severe accident analysis todemonstrate the safety objective. In theprocess of severe accident management,
mostly, priority is given to specific on siteequipment, while the mobile equipment isused as a backup device, and it is dependon the specific scenarios.

Any preference is informed by the safety
benefit. For example, mobile equipment
might be the last resort in case of extreme
external events.

Please explain how thedecision over whether touse mobile or specific onsite equipment is made13.
How are thePlease explain whether
performancethe equipment
requirements forrequirements (e.g.
severe accident related capacity, mission times
equipmentetc.) are determined bydetermined?
performance needs or
are prescribed

The vendor determines the performance
The performance requirements for severe
requirements of the severe accident related accident related equipment is determined
equipment. However, ONR looks to RGP
by the utility and reviewed by the NNSA.
and OPEX when determining the adequacy The requirements for severe accidentof the safety claims. For example, therelated equipment (equipment capacity,
AP1000, UK ABWR and UK EPR all have time allowance, etc.) are determinedavailable DC power ≥ 24 hours following an through function analysis, iterative design,
SBO.
and good practice. the requirement is thatthe three safety functions should bemaintained.

16

ARN doesn´t prescribe specific requisites
for severe accident related equipment.

From p.61 of [8]:Engineering requirements for severe“Preventive domain (prevention of
accident related equipment are determinedsignificant fuel rod degradation):from the functional analysis. In contrast to
In Emergency Operating Procedures
events on other DID levels there usually is(EOPs), at least one success path relies on not a single accident analysis available thatstructures, systems and components
would allow for identification of the safety
qualified, as required by Requirement 30 of functions necessary in severe accidents.
SSR-2/1 (Rev. 1) [3], for design basis
Instead the design of the different severe
accidents and for the design extension
accident features is usually based on aconditions those structures, systems andset of deterministic and/or probabilistic
components were designed to cope with.
analyses from which the necessary
However, EOPs may be implemented byinformation can be taken.
using all available equipment (e.g. mobile, According to IAEA SSG-30, the functions
portable).
necessary to mitigate severe accidents are

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestion

Date: December 2020
Validity: until next update or archiving
Version 1
Comment

ONR – UK Response

NNSA – China Response

NNR – South Africa Response

ARN – Argentina Response

Mitigatory domain (mitigation of theassigned to Safety Category 3 and fromconsequences of significant fuel rod
this category can be derived the equipment
degradation):requirements.
SAMGs favour the use of structures,
systems and components with capabilities
consistent with the performance andenvironmental conditions expected in asevere accident, as required by paras 5.28
and 5.29 of SSR-2/1 (Rev. 1) and para.
5.8B of SSR-2/2 (Rev. 1). However,
SAMGs may be implemented by using all
equipment still available and alternatives(i.e. non-permanent equipment) to fulfil thefundamental safety functions; available
systems may also be used beyond theirdesign limits, if appropriate.”
The latter wording “if appropriate” implies
preference for performance needs overprescriptions when determining equipment
requirements.
From p.18 of [8]:“2.59 Guidance should be prepared fortesting the permanent and non-permanentequipment and for testing any assembled
subsystems necessary for the equipment
to meet its planned performance. The
frequency and type of testing should be
conducted in accordance with the
manufacturer’s recommendations. Tests
should address necessary local actions,contingencies, the proper connection of
non-permanent equipment to plant
equipment, access to the site, off-siteactions, emergency lighting and thepossibility of events affecting multiple units,
as well as the time needed to implement
these actions, if appropriate. Accident
management guidance should be provided
for maintenance and periodic testing toensure the proper functioning of equipment
and may include the need for plant
walkdowns.”
See also the responses to Question 16.
14.
What are therequirements forsevere accident
equipment related to:a. Independency?

ONR has no requirements forindependency, SFC, or safetyclassification. However, ONR has
expectations for the following:a. According to HAF102-2016, as fourthlevel of DID, equipment used for SA
mitigation should be independent as far as
possible from other level of DID. For someequipment that cannot be stripped, such as

17

In the context of the currently operating
Koeberg nuclear power plant, the following
approach to the analysis of severe
accidents provides some indications. In thecontext of a possible new build programme

Paragraph 5.29 of IAEA SSR 2/1 requiresthat “the analysis undertaken shall include
identification of the features that aredesigned for use in, or that are capable ofpreventing or mitigating, events consideredMultinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestionb.
c.

Single Failure
criteria?
Safetyclassification?

Date: December 2020
Validity: until next update or archiving
Version 1
Comment

ONR – UK Responsea. Independency between levels ofdefence in depth as far as
reasonably practicable;b. The single failure criterion is notexpected to be applied to SA
measures;c. ONR expects that systems
structures and components areclassified based upon the
categorisation of safety functionthat they provide, and thecontribution to that safety function
they provide. ONR does notprescribe the classification of theSSCs, however, it is expected that
the SA safety measures are safetyclassified. Whilst it is likly that thesafety function to be delivered by a
SA measure is of lower
categorisation than those fordesign basis accidents, ONR
expects that measures that could
negatively impact other levels ofdefence in depth be of a higher
classification where necessary. In
addition, it is often necessary for
SA measures to operate during
seismic events; these SSCs
require a high standard of seismic
qualification.

NNSA – China Responsecontainment, the independence is notconsidered in practice.
b. Single Failure criteria is not necessary in
SA. According to HAF102-2016 and IAEA
SSG-2, for the design extension conditions
with core melting, the Single Failure
criterion is not required. The utility may
consider certain redundancy or design
margin to improve the reliability, such as
the pressure release value dedicated tosevere accident.
c. The current requirement of safetyclassification is in Safety Functions andComponent Classification for BWR, PWR
and PTR HAD103-1986, the HPR1000
uses IAEA SSG-30 and TECDOC-1787.

18

NNR – South Africa Response

ARN – Argentina Response

some of these requirements may bein the design extension conditions. These
updated to reflect international good
features:practices.
(a) Shall be independent, to the extent
Analysis Method for Beyond Design
practicable, of those used in more frequent
Basis Accidents (Including Severe
accidents;
Accidents)(b) Shall be capable of performing in the
For the deterministic and probabilistic
environmental conditions pertaining toanalysis of BDBAs, including severe
these design extension conditions,accidents, it is acceptable to use best
including design extension conditions inestimate computer codes combined withsevere accidents, where appropriate;
realistic assumptions and initial and(c) Shall have reliability commensurate withboundary conditions that reflect the likely
the function that they are required to fulfil.”plant configuration and conditions and the
expected response of plant systems andRelated to independency requirements,
operators in the analysed accident
ARN follows the IAEA SSR 2/1, which
scenario, together with an evaluation of the requires the independence of safety
uncertainties associated with the relevant
provisions at different defence in depth
phenomena. However, an uncertainty
levels: “The levels of defence in depth shallanalysis is not always practicable or evenbe independent as far as practicable topossible, and should not necessarily be
avoid the failure of one level reducing theperformed when determining what
effectiveness of other levels. In particular,
measures should be taken to mitigate thesafety features for design extension
consequences of severe accidents. The
conditions (especially features for
single failure criterion does not need to be mitigating the consequences of accidents
applied in the analysis of BDBAs. Where it involving the melting of fuel) shall as far as
is not possible to use realistic assumptions is practicable be independent of safety
and/ or initial and boundary conditions,systems.”
reasonably conservative assumptions and / According to SSR-2/1 Requirement 20, theor initial and boundary conditions should be analyses of the DECs may be performed
used in which the uncertainties in theusing realistic assumptions. In particular,
understanding of the phenomena being
redundancies necessary to comply with themodelled are considered and boundedsingle failure criterion are not required,based to the extent possible on available
provided the reliability of the function to beexperimental data or expert judgement.
accomplished is adequate.
For safety classification the regulatory
Assumptions Used for the Analysis ofrequirement is to follow the methodology
Beyond Design Basis Accidents Except stated in IAEA SSG-30and TECDOC 1787.
Severe Accidents
The following assumptions may be used forthe analysis of BDBAs:• When the reactor is initially at power, thepower level is at 100% full power.
• Control devices are considered to be
operating normally.
• Credit for actuation of non-safetyclassified systems may be given.
• Off-site electrical power supply remains
available (except for Blackout scenario).

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestion

Date: December 2020
Validity: until next update or archiving
Version 1
Comment

ONR – UK Response

NNSA – China Response

NNR – South Africa Response• Residual power is evaluated without any
margin as a function of burn-up.
• The times at which the relevant systems
are assumed to start-up are calculated
realistically.
Assumptions Used for the Analysis of
Severe Accidents
The following assumptions may be used in
the analysis of severe accidents:• Expert judgement from recognised
sources may be used where benchmarked
models are not available.
• Realistic credit is taken for the availabilityof all SSC including instrumentation evenwhen required to operate outside of theirdesign basis.
• Best estimate severe accident analysis
programmes are used where practical andwhen their models include the relevant
phenomena.
• For instrumentation, no margin need beconsidered, but where possible, readings
are validated by multiple/diverse means.
However, consequential effects on
instrumentation accuracy due to post
accident environmental conditions shall beconsidered.
• Credit can be taken for the recovery offailed systems or equipment.
• Uncertainties regarding severe accident
phenomena and the outcome of mitigating
measures may be accommodated throughthe trade-off between positive and negative
impacts.
• Credit may be taken for operator action.
The risk benefit of operator actions in
SAMGs should be assessed and actions
that would result in a significant risk
reduction in all conditions applicable to theset of guidelines must be considered to be
assigned a mandatory status.
From p.25 of IAEA SSR-2/1 (Rev. 1) Safetyof Nuclear Power Plants: Design [11]:“5.29. The analysis undertaken shall
include identification of the features thatare designed for use in, or that arecapable15 of preventing or mitigating,19

ARN – Argentina ResponseMultinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestion

Date: December 2020
Validity: until next update or archiving
Version 1
Comment

ONR – UK Response

NNSA – China Response

NNR – South Africa Response

ARN – Argentina Response

events considered in the design extension
conditions. These features:(a) Shall be independent, to the extent
practicable, of those used in more frequent
accidents;(b) Shall be capable of performing in theenvironmental conditions pertaining tothese design extension conditions,
including design extension conditions insevere accidents, where appropriate;(c) Shall have reliability commensurate withthe function that they are required to fulfil.
15 For returning the plant to a safe state or
for mitigating the consequences of an
accident, consideration could be given to
the full design capabilities of the plant andto the temporary use of additional
systems.”
From p.21 of IAEA-TECDOC-1791 [12]:‘SSR-2/1 also requires the independenceof safety provisions at different defence in
depth levels:
4.13A. “The levels of defence in depth shallbe independent as far as practicable to
avoid the failure of one level reducing theeffectiveness of other levels. In particular,
safety features for design extension
conditions (especially features for
mitigating the consequences of accidents
involving the melting of fuel) shall as far as
is practicable be independent of safetysystems.”
The issue of the independence of thedifferent levels of defence in depth isaddressed in detail in Section 6 of thispublication.’
15.
How is equipment
qualification
determined?

ONR’s SAPs (EQU.1) sets the
expectations that “Qualification proceduresshould be applied to confirm thatstructures, systems and components will
perform their allocated safety function(s) in
all normal operational, fault and accident
conditions identified in the safety case andfor the duration of their operational lives.”
ONR expects that the environmental
conditions in which SSCs claimed insevere accidents are expected to operate,
are derived from the SAA.

According to HAF102-2016, The design
features for DEC Shall be capable ofperforming in the environmental conditions
pertaining to these design extension
conditions, including design extension
conditions in severe accidents, whereappropriate, and they Shall have reliability
commensurate with the function that they
are required to fulfil. As for HPR1000, forequipment or instruments dedicated tosevere accidents, equipment qualification
under severe accidents conditions were20

Based on p.24 of IAEA SSG-2 [6]:It is understood that typical equipment
qualification programmes for design
extension conditions with core melting
might not always be applicable and anassessment of the operability of structures,
systems and components is acceptable.
The term ‘survivability assessment’ issometimes used for such an assessment.

Equipment qualification refers toenvironmental and seismic qualification.
Environmental qualification includes harsh
and mild environment qualification. For
seismic qualification, acceleration
corresponding to a DBE (SSE) has to beconsidered.
The regulatory requirement is to follow the
IAEA SRS N°3 and TECDOC 1818.

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestion

Date: December 2020
Validity: until next update or archiving
Version 1
Comment

ONR – UK Response

The environmental conditions are likely tobe harsher than those experienced indesign basis accidents.

NNSA – China Response

NNR – South Africa Response

ARN – Argentina Response

carried out, taking into accountenvironmental conditions such astemperature, pressure, humidity andirradiation

Because the ONR expects that thequalification be carried out in the accident
conditions identified, this often leads to theseismic qualification requirements being
defined separately to the safety function
categorisation. This may lead to higher orsimilar seismic qualification standards in
the SAA as the design basis.
16.
Are there specific In the answer please
ONR has no specific requirements related
requirements related to explain
to any of the queries a-g.
the design of severe• Any preferences ONR has no preference over passive or
accident equipment for:active safety for SAA mitigation strategies.
of passive ora. C&I for severe
ONR has no preference over in-vessel or
active safety
accident• Any preferences ex-vessel cooling strategies. ONR has
conditions?
issued design acceptance confirmation tofor in-vessel orb. Combustible gas
ex-vessel cooling both the AP1000 and EPR.
control in (a)ONR has no preference over the inclusion
strategies
containment (b)• Any requirements of a filtered containment vent in the design.
elsewhere?
for inclusion of ac. Control of thefilteredpressure in (a)containment ventprimary circuit (b)in the designcontainment?
d. Removal of decay
heat?
e. Mitigation ofmolten coredebris (a) invessel (b) exvessel?
f.
Mitigation ofradioactive
releases to theenvironment?
g. Electrical power
supplies?

The vendor gives an overall consideration,
including the safety, economy, maturity,
etc., and determines the type of severe
accident mitigation measures, such asactive or passive, in-vessel or ex-vessel
cooling, or whether a Containment
Filtration and Exhaust System is needed.
The AP1000, VVER and EPR, which useddifferent design concept/philosophy, arereviewed and accepted by NNSA.
The regulator is only responsible forreviewing whether the relevant design canmeet the safety requirements.

From Section 4 of [1]:There are not specific preferences related(e) The design shall apply the following
to the design of severe accident
measures in order of priority to the extent
equipment. It is the applicant´spracticable:
responsibility to propose the suitable(i) Passive safety measures that dotechnological solution and justify it.
not rely on control systems, active ARN is responsible for reviewing whether
safety systems or humanthe design meets the safety requirements.
intervention;(ii) Automatically initiated activeengineered safety measures;(iii) Active engineered safety measuresthat need to be manually brought
into service in response to thefault;(iv) Administrative safety measures;and(v) Mitigation safety measures.
In the context of a possible new build
programme in South Africa, the NNR also
considers guidance as provided in, forexample, IAEA SSG-54 AccidentManagement Programmes for Nuclear
Power Plants [8]:“3.100 Plant capabilities should beanalysed in connection with the in-vessel
phase of a severe accident, including
consideration of the following:(a) Hydrogen production in the vessel andits release, as input information for thedesign of the hydrogen treatment system;(b) Retention of the molten core within thevessel both by internal and external vessel
cooling;(c) The composition and configuration of
the molten core and failure of the reactor

21

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestion

Date: December 2020
Validity: until next update or archiving
Version 1
Comment

ONR – UK Response

NNSA – China Response

NNR – South Africa Responsepressure vessel as inputs to the design ofthe core catcher;(d) Reliable depressurization to allow low
pressure water injection and avoid highpressure vessel failure;(e) Long term release of fission products
from the reactor core.
3.101 For the ex-vessel phase, plantcapabilities should be analysed including:(a) Reliable depressurization of thecontainment to avoid high pressure
containment failure;(b) Sources, distribution and the potential
leak paths of combustible gases, as input
information for the design of the
combustible gas treatment system;(c) Issues relating to ex-vessel steam
explosion, high pressure melt ejection anddirect containment heating;(d) Composition and configuration of themolten core as inputs to the design of exvessel melt retention devices;(e) Fission product sources and the
distribution of fission products within thecontainment, with special attention given to
the long term behaviour of such sources
Further guidance from IAEA SSG-54 [8]:“3.27 The plant control and logic interlocks
that may need to be defeated or reset forthe successful implementation of severe
accident management strategies should be
systematically identified. It should also beverified that the potential negative effectsof such actions have been adequately
characterized and documented.
3.28 The definition and selection ofstrategies applicable to severe accidents
should consider the potential usefulness ofmaintaining strategies initiated whensignificant fuel rod degradation had not yet
occurred. For example, subcriticality of thecore orthe core debris should be maintained, anda path should be provided to transfer decay
heat from the core or molten core debris toan ultimate heat sink, where possible.”

22

ARN – Argentina ResponseMultinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicComment

ONR – UK Response

Please explain
requirements for
implementing severe
accident measures andfiltered containment
venting, including theregulators role in making
those decisions

ONR does not prescribe criteria for
initiating severe accident mitigation
strategies. The vendor must justify the useof any criteria used. ONR, however, takes
cognisance of international practice forthese criteria when performing assessmentof the safety case.
With regards the regulators role in making
decisions during emergencies - The
licensee is responsible for making
decisions during all modes of operation,
including emergencies. In the unlikely
event that ONR disagreed with a course ofaction proposed by the licensee, ONR has
the power to intervene.

The severe accident management in The NNR considers developments related There are no regulatory criteria for initiationindustry generally takes the core outlet to filtered containment venting, for example of severe accident mitigation strategies.
temperature above 650 °C as the criterion, in the context of lessons learned from the
However, the decision of opening thealso other criteria, but it is not prescribed by Fukushima Daiichi accident as presented
containment must be communicated and
NNSA.
in IAEA-TECDOC-1812, “Severe Accident approved by the regulatory body for the offThe opening of the containment venting Mitigation through Improvements in Filtered site emergency preparedness.
system should be reported and approved by Containment Vent Systems andthe nuclear safety regulatory authorities and Containment Cooling Strategies for Water
emergency management authorities for the Cooled Reactors”, 2017. It is claimed that aoff-site emergency preparedness. Some reliable containment venting systemtechnical issues of HPR1000 containment provides more effective accident
venting system is still under being management during severe accidents,
demonstrated and discussed.
especially for smaller volume containments
in relation to the rated nuclear power.

18.
What are thePlease explain what isregulatory expectations expected regarding
for management of
SAMG etc. and how thissevere accidents?
is under regulatory
control

ONR expect, so far as reasonably
practicable, that SAMGs are based upon
the SAA. An extract from ONR’s TAG NSTAST-GD-007 states that:“The SAA, in providing a systematic
analysis of all potential severe accidents
that could occur at the facility, should be a
key contributor to the development of acomprehensive suite of EOPs and SAMGs.
The suite of EOPs and SAMGs should
address all identified potential severe
accidents and cover all permitted operating
modes of the facility (e.g. strategies on an
LWR for a severe accident during refuelling
will need to be different to those that could
be used for accidents during power
operation as the vessel head will havebeen removed).
Key aspects where the SAA can provide
input to the EOPs and SAMGs include:i.
Identifying the symptoms that willallow the operators to identify thetrue state of the plant and / orimminent escalations in severity;ii.
The timescales and priorities foraction;iii.
Appropriate points for enacting
the transition from EOPs to
SAMGs;
iv.
Identifying alternative scenarios
for how the accident might
escalate and an analysis of thelikely effectiveness of different

Regulations such as “HAF103” and In the context of a possible new build
The emergency operative procedures“General Technical Requirements(GTR) on programme in South Africa:(EOP) as well as the SAMGs are
post-Fukushima
NuclearAccident From Part 3, Section 5 of [5]:mandatory documentation that the operator
Improvement
Measuresfor
NPPs “An applicant for, or holder of, a nuclear
has to submit to the regulatory body as a(Tentative)” require the development of authorization, shall ensure that:pre-requisite for the Operating Licence.
Severe Accident Management Guidelines. …
During the pre-licensing stage, SAMGs areTechnical document such as HAJ-0001- (6) A multilayer system of provisions forout of scope of the regulatory activities.
2016 (mainly based on IAEA NS-G-2.15) nuclear safety commensurate with the
In general, the EOPs are based on
gives the detail guidance of SAMG magnitude and likelihood of the potential
engineering judgment, experiences in otherdevelopment and use.
exposures involved shall be applied tosimilar plants and validated against
The vendor should develop the SAMG and radiation sources or radioactive material for simulations in a full-scope simulator on
related management procedures, and carry the purposes of –site; while SAMG strategies are based on
on training and drills and other work. …
computer simulation with a validated
Nuclear safety inspections and peer review (d) control of severe conditions in which the system code for these purposes.
are conducted to verify the effectiveness of design basis of the nuclear facility may be It is expected that the SAMG contain a
the SAMG preparation and implementation. exceeded, including the prevention of fault description of the positive and negative
progression and mitigation of thepotential consequences of the proposed
consequences of severe accidents; andactions, including quantitative data when(e) mitigation of radiological consequences available and relevant; should be simple,of significant releases of radioactive
clear and unambiguous; and should
substances that could result from accident contain sufficient information for the plantconditions.”
staff to reach a timely decision on theactions to take during the evolution of a
From Part 5, Section 3 of [5]:severe accident.
“(7) A set of design extension conditions
ARN expectations are aligned with theshall be derived on the basis of
IAEA SSG-54.
engineering judgment, deterministic
assessments and probabilistic
assessments for the purpose of further
improving the safety of the nuclear facility
by enhancing the plant’s capabilities towithstand, without unacceptableradiological consequences, accidents thatare either more severe than design basis

Question17.
Are there specificrequirements for
criteria for initiating
severe accident
mitigation strategies?

Managementof a severe
accident

Date: December 2020
Validity: until next update or archiving
Version 1
NNSA – China Response

23

NNR – South Africa Response

ARN – Argentina ResponseMultinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestion

Date: December 2020
Validity: until next update or archiving
Version 1
ONR – UK Response

Comment

v.

vi.

vii.

viii.

NNSA – China Response

strategies, including the pros andcons of each;Analysis of the expected radiationdose levels and means ofminimising exposures;
Through task analysis, whether
the procedures and SAMGs could
reasonably be expected to befollowed in the likely severely
degraded plant condition following
a severe accident;
Helping to quantify the numbers ofoperators needed to address
steps in the procedures / stages in
the SAMGs;
Other human factors aspects ofthe EOPs and SAMGs as
discussed in the previous section,e.g. the availability and use ofcommunications systems andcontrol structures.”

NNR – South Africa Response
accidents or that involve additional failures.
These design extension conditions shall be
used to identify the additional accident
scenarios to be addressed in the design
and to plan practicable provisions for theprevention of such accidents or mitigationof their consequences if they do occur.”
From Part 5, Section 6 of [5]:6. Accident management(1) Where a prior safety assessment oroperational safety assessment has
identified severe conditions in which thedesign basis of a nuclear facility may be
exceeded –(a) Accident prevention and mitigation
measures shall be applied as appropriate
in line with a graded approach;(b) Accident prevention and mitigation
measures, accident management
procedures and guidelines including
emergency planning, emergency
preparedness and emergency responseshall be established, implemented andmaintained as appropriate.
(2) An accident management programmeshall –(a) Be established, where applicable, thatcovers the preparatory measures andguidelines that are necessary for dealing
with accident conditions not considered in
the design of the facility, including severe
accident conditions;(b) Include instructions for utilisation of theavailable safety related equipment as far
as possible, conventional equipment andthe technical and administrative measures
to mitigate the consequences of an
accident;(c) Include organisational arrangements
and facilities for accident management,
communication networks and training
necessary for the implementation of the
programme; and(d) Be periodically reviewed and revised asnecessary.
(3) Arrangements for accident
management shall provide the operating
staff with appropriate systems andtechnical support in the event of accident

During GDA (pre-licensing generic design
assessment), detailed SAMGs are outsideof the scope of the assessment. The SAA,
however, forms a sound basis for the future
licensee to draft SAMGs.
ONR attaches licence conditions to every
GB licensed site, which requires thelicensee to have adequate emergency
arrangements for accident management.
This, in addition to other licence conditions,sets the requirement for emergency
preparedness.

24

ARN – Argentina ResponseMultinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-02 FOR PUBLIC USE
TopicQuestion

Date: December 2020
Validity: until next update or archiving
Version 1
ONR – UK Response

Comment

NNSA – China Response

NNR – South Africa Response
conditions not considered in the design ofthe facility. These arrangements andguidance shall address the actions
necessary following severe accident
conditions.

References

N/A

N/A

N/A

N/A

[1] NNR Draft Specific Nuclear Safety
N/A
Regulations: Nuclear Facilities[2] NNR RG-0019 “Interim Guidance on
Safety Assessments of Nuclear
Facilities”[3] National Nuclear Regulator Act (ActNo. 47 of 1999)[4] R.388: Regulations In Terms Of
Section 36, read with Section 47 of the
National Nuclear Regulator Act, 1999
Act No. 47 on Safety Standards andRegulatory Practices[5] NNR Draft General Nuclear Safety
Regulations[6] IAEA SSG-2 Rev 1, “Deterministic
Safety Analysis for Nuclear Power
Plants”, 2019[7] NNR RG-0011 “Interim Guidance for
the Siting of Nuclear Facilities”[8] IAEA SSG-54 Accident Management
Programmes for Nuclear Power
Plants, 2019[9] IAEA SSR-2/2 (Rev. 1) Safety of
Nuclear Power Plants: Commissioning
and Operation, 2016[10] NNR RG-0016, “Guidance on the
Verification and Validation of
Evaluation and Calculation Models
used in Safety and Design Analysis”[11] IAEA SSR-2/1 (Rev. 1) Safety of
Nuclear Power Plants: Design, 2016[12] IAEA -TECDOC-1791 Considerations
on the Application of the IAEA Safety
Requirements for the Design ofNuclear Power Plants, 2016[13] NNR Position Paper PP-0014
Considerations of External Events for
New Nuclear Installations

25

ARN – Argentina Response