Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)

Multinational Design Evaluation Programme (MDEP)Technical Report
TR- HPR1000WG-03

Related to: HPR1000 Working Group’s activities

Technical Report: HPR1000 HAZARDS

Participation
Countries involved in the MDEP working
group discussions:

China, U.K., South Africa and Argentina

Countries which support the present
common position
Countries with no objection:
Countries which disagree
Compatible with existing IAEA related
documents

N/A
Yes

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)Contents
No table of contents entries found.
Contents
Section
I.
II.
III.
IV.
V.
VI.

Introduction
Overview of approaches to hazards
Pipe Breaks
Dropped loads
Combined hazards
Conclusions

Page
3
3
11
15
17
21

Appendix for Specific Guidance (Questionnaire Responses)

232

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)I.

INTRODUCTION

During the second HPR1000 Working Group (HPR1000WG) meeting [Ref. 1 ], theparticipants expressed an interest in understanding the similarities and differences inregulatory approaches to hazards assessment of the member countries, and thepotential implications of these regulatory approaches on the design of the HPR1000
technologies. A hazards technical expert’s subgroup (TESG) was subsequently
established to engage on hazards-related topics, and to identify common positions,where applicable.
This technical report is based on engagements between representatives of the Hazards
TESG, and the responses provided to a questionnaire that was developed to capture theregulatory approaches used in relation to identifying, characterising, screening, andassessing hazards in each member country. The questionnaire developed by the Hazards
TESG, with each country’s responses, is provided in the appendix to this document.
The purpose of this report is to identify the similarities and differences in regulatory
approaches, and where applicable, to identify common positions for safety in relation tohazards and/or the conclusions of the safety analysis for the HPR1000 design. This reportprovides a high-level summary of each country’s regulatory philosophy (Section II) andthen due to the broad nature of hazards provides several pertinent, example hazards
that illustrate how these regulatory approaches are applied in practice. These examples
are used to highlight similarities and differences in regulatory approaches, and to identify
any implications such as the expectation for additional analyses. The report concludes
by explicitly highlighting common practice and summarising any potential implicationsof differences in regulatory practice.
The scope of this report is limited due to the varying status of each participating nation’s
regulatory assessment of the HPR1000 reactor technologies. This report does not provide
commentary

on

the

implications

of

any

differencesin

regulatory

approaches/expectations for hazards on the design of the HPR1000 plant and its
structures, systems, and components.

3Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)

II. OVERVIEW OF APPROACHES TO HAZARDSSUMMARY
The first meeting of the Hazards TESG took place at the third HPR1000 WG meeting [Ref.
2]. At this meeting the hazard-related topics of interest were discussed and agreed by
the members of the Hazards TESG. The regulatory approaches to certain topics wereidentified as being significantly different between members, such that it was considered
unlikely that a common position could be achieved. For example, the design basis event
expectations for external hazards vary significantly between members of the Hazards
TESG, and in some instances the expectations for derivation of a design basis event also
varies between different external hazards (e.g. return periods). These topics were
therefore excluded from further consideration. It was noted that there were morecomparable expectations for internal hazard design basis events. Further, following theevents at Fukushima-Daiichi all regulators have moved to a position where designs are
expected to include resilience against rare and severe hazards, which are additional todesign basis events, and represent less frequent events and more challenging accident
conditions.
As a result of these discussions, the following topics were identified for further
consideration through the development of a questionnaire. The associated questions
agreed by the TESG are listed in Annex 1 along with each member response. The topics
included in the questionnaire are outlined below:
High Energy Pipe FailureDropped Loads

Internal missiles

Combined hazards in areas of high risk

Multi-hazard barriers

Expectations on layout (including exceptions to segregation)

Fire modeling (including validation and verification of the analysis)

Beyond design basis events

Maximum credible events

4Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)

The approach of each Regulator to these hazard topics and the questionnaire responses
were discussed during the fourth HPR1000 WG meeting [Ref. 3]. The vendor 1 for the
HPR1000 reactor technology provided a presentation that described the hazards
considered in the HPR1000 design, and the associated design bases [Ref. 4], based on
the relevant Chinese codes and standards. The vendor and NNSA consider the standards
that have been applied to be consistent with the guidance provided in IAEA safety
standards.
All national regulators participating in the HPR1000 WG ensure their national guidance
documents are aligned with IAEA documentation relevant to hazards. Therefore, at a
principles level, the regulatory expectations for the selected hazards are similar between
the members of the Hazards TESG. For example, all regulators expect a range of analysis
approaches to be used to evaluate hazards and their effects on a design including:deterministic approaches, design basis analysis, analysis of design extension conditions
without significant fuel degradation (including demonstrating an absence of cliff edge
effects), probabilistic safety analysis and severe accident analysis. The technicaldiscussions also demonstrated that there are differences in the application of these highlevel expectations for most hazards, and in particular where detailed methodologies
were discussed for internal hazards. These differences are relevant to the assumptions
used in the identification, screening, and characterisation of each hazards (including
combinations), and also the analysis methods employed.
The appendix provides a detailed summary of the Regulatory expectations and relevant
good practice that is adopted for specific hazards in response to the questionnairedeveloped by the Hazards TESG. This table provides a clear overview of commonalityand differences between each member nation and forms the basis for this report.
Using the detailed information from the appendix, the remainder of this section presents
the general approach of each Regulator to hazards. In the following sections (III – V)several pertinent hazards are reviewed as examples of how the various regulatory
approaches are applied in practice. These examples highlight similarities and differences

1

The Vendor is a representative of the two design authorities for HPR1000 reactor technology; China
General Nuclear, the designer of option 1, and China National Nuclear Corporation, the designer of
option 2.

5Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)in regulatory approaches to identify any implications for the HPR1000 design, such as the
expectation for additional analyses.
CHINA
The Chinese nuclear Regulator (NNSA) operates a prescriptive regulatory approach.
High-level requirements are provided in the HAF documents (safety requirements), withthe detailed technical requirements provided in the supporting HAD documents (safety
guides). Consideration of hazards (and combinations) is a requirement. The standards
relevant to hazards are:

HAF101-1991 Safety Regulation for Nuclear Power Plant Sitingo

HAD101/01-1994 Earthquake Problems in Relation to Nuclear Power Plant
Sittingo

HAD101/03-1987 Site Selection and Evaluation for Nuclear Power Plants with
Respect to Population Distributiono

HAD101/04-1989 External Human Induced Events in Relation to Nuclear Power
Plant Sitingo

HAD101/06-1991 Relationship between Nuclear Power Plant Siting andHydrological GeologyoHAD101/09-1990 Determination of design basis Flood for Nuclear Power Plant
Sited by Coasto

HAD101/10-1991 Extreme Meteorological Events in Nuclear Power Plant Siting(Excluding Tropical Cyclone)o

HAD101/11-1991 design basis Tropical Cyclone for Nuclear Power Plantso

HAD101/12-1990 Foundation Safety Problems of Nuclear Power Plants

HAF102-2016 Safety regulation for design of nuclear power plantso

HAD102/04-2019 Protection Design against Internal Hazards (other than Fireand Explosion) in Nuclear Power Plantso

HAD102/05-1989 External Man-Induced Events in Relation to NPP Design

6Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)o

HAD102/11-2019 Protection Design against Fire and Explosion in Nuclear Power
PlantsChinese standards are benchmarked with IAEA documentation to ensure consistency ofapproach.
UNITED KINGDOMIn the UK, the Office for Nuclear Regulation (ONR) regulates nuclear safety, security,
safeguards, transport, and conventional health and safety on licensed sites according
to the UK goal setting regulatory framework. In line with that framework ONR applies agoal setting regulatory philosophy that is consistent with the UK’s health and safety law.
Fundamental to this approach is the legal duty for duty holders to reduce risks so far as isreasonably practicable (SFAIRP). As part of this, ONR looks for operators of licensed
nuclear installations to demonstrate that the normal requirements of good practice inengineering, operation and safety management are met and that risks in operation are
reduced to be As Low As Reasonably Practicable (ALARP). This places duties on both thedesign organisations and on future licensees and operators.
ONR publishes its high-level expectations for nuclear safety in the Safety Assessment
Principles (SAPs). Expectations for hazards are explicitly covered by a total of 19 SAPs;
EHA.1 – EHA.19, but there are many other related and relevant SAPs. The ONR SAPs are
considered fully in line with IAEA guidance and standards. The SAPs cannot reflect thebreadth and depth of the entire suite of IAEA publications and so ONR explicitly identify
those documents as relevant good practice within technical assessment guides (TAGs).
The TAGs provide more specific, technical guidance on a range of safety topics. These
provide guidance to ONR’s inspectors in making judgements on the adequacy of adutyholder’s safety documentation against the ALARP principle. Relevant technicalassessment guides for hazards include:

NS-TAST-GD-013 for External Hazards



NS-TAST-GD-014 for Internal Hazards

In addition to the SAPs and technical assessment guides, ONR has also publishedadditional technical guidance for new reactor designs wishing to be assessed throughthe UK’s Generic Design Assessment (GDA) process.

7Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)

ONR-GDA-GD-007 - New Nuclear Power Plants: Generic Design Assessment
Technical Guidance

The GDA process enables ONR and other regulators to assess the safety, security, andenvironmental implications of new reactor designs, separately from applications to build
them at specific sites. GDA is a stepwise process, with the assessment getting increasingly
detailed at each step following the claims, arguments, and evidence (CAE) to safety
documentation. At the time of writing the generic UK HPR1000 design is being assessedby ONR through its GDA process, to determine if a Design Acceptance Certificate (DAC)
can be issued. A nuclear site licence would still need to be obtained by any operator of
HPR1000 technology before the reactor design could be deployed on a specific site inGreat Britain.
Demonstrating that risks related to hazards are reduced to be ALARP does not require in
all cases an analytical quantification of risk and benefits, but operators of licensed
installations use relevant good practice (RGP) to demonstrate the adequacy of theirapproach against the ONR SAPs, including those relevant to hazards. RGP is the minimum
requirement by which the operator can demonstrate the legal requirement of reducing
safety risks to be ALARP. The ONR SAPs recognise IAEA publications as RGP via the TAGs.
The use of both a goal setting approach and RGP provides operators of licensed sites
the flexibility to adopt the most relevant guidance for any specific scenario, so long as
this is adequately justified in their safety documentation.
SOUTH AFRICA
The South African nuclear Regulator’s (NNR) approach to the regulation of nuclear safety
and security takes into consideration:the potential hazards associated with the facility or activity;

the need for the authorisation holder to establish safety related programmescommensurate with nuclear and radiation risks; andthe requirement to exercise regulatory control over technical aspects such as thedesign and operation of a nuclear facility.

The approach highlights the fundamental principle that the authorisation holder retains
the primary responsibility for safety of its facilities and activities. The regulatory philosophy
adopted by the NNR is a hybrid employing methodologies and principles based on the8Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)approach taken in the regulatory framework, the maturity of the authorisation holder,
and international developments related to regulation and emerging safety standards
and issues.
The NNR has adopted a process-based approach in regulating facilities and activities.
This entails identifying key processes to manage nuclear and radiation safety for facilities
and activities. This approach is supported by the NNR requiring the use of a risk analysis
which is used for regulatory decision making related to events that impact adversely on
nuclear and radiation safety.
The authorisation holder is required to demonstrate that safety related aspects such as
ALARA are applied to the satisfaction of the NNR. The NNR requires authorisation holders
to demonstrate application of good engineering practice and justify the use of codesand standards.
The NNR’s Regulatory Framework consists of legally binding requirements by International
Safety Conventions, laws passed by Parliament that govern the regulation of South
Africa’s nuclear industry, regulations, authorisations, conditions of authorisations,requirements, and guidance documents that the NNR uses to regulate the industry.
Requirements are developed in conjunction with the applicable authorised action andeffectively cover all the relevant requirements on the holder.
The NNR enforces these requirements on all applicants and authorisation holders. Certain
requirements in the legislation are prescriptive to the extent that no further elaboration isnecessary. Other requirements are broad in nature.
The NNR establishes additional requirements based on international best practices. These
requirements are registered either directly in the authorisations or in “Requirements
Documents”.
The NNR Safety Standards are premised on international standards such as the IAEA
Safety Standards, the UK NII Safety Principles and the WENRA Reference levels. The safety
standards provide the principal safety criteria relating to risk criteria, and dose limits fornormal operating conditions, applicable to members of the public and workers.
The safety standards further lay down principal radiation and nuclear safety requirements
which are applied to all nuclear installations and other regulated actions, and include
the following:9

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)

Defense-in-depth



ALARA



Good engineering practice

Quality management



Accident management and Emergency PreparednessSafety Culture

Graded approach

The radiological dose and risk limits for the public and workers relate directly to theobjectives of nuclear and radiation safety and are therefore considered the mostfundamental yardsticks against which to assess nuclear safety, contributing towards amore consistent and transparent basis for regulatory decision making. The dose limits are
consistent with the IAEA Basic Safety Standards.
For the existing Koeberg nuclear power station, the applicable laws, regulations, codes,
and standards that were used in its design, construction and manufacture were basicallythose used in French reference stations. Whenever French safety rules did not cover thescope of South African or US rules, the US rules, according to how they were interpreted
for the reference station, and the South African rules were applied. Where otherinternational regulations apply for Koeberg, they are referenced in the Koeberg SAR.
Amongst the many general nuclear and radiation safety principles that underpin andform the basis of the NNR Safety Standards, the following one is of relevance to the topic
of this report:
The authorisation holder must demonstrate effective understanding of the hazards andtheir control for an action or facility through a comprehensive and systematic process ofsafety assessment. The safety assessment must incorporate both deterministic andprobabilistic approaches where appropriate.
ARGENTINA
The Argentinian nuclear Regulator (ARN) operates a goal setting regulatory approach.
High-level regulatory requirements and expectations are established in the “AR”
regulations which are harmonised with the IAEA safety standards. AR regulations have a“performance” based character by which the way of achievement of safety objectives,is based on the appropriate licensee’s decision making. Licensee has flexibility in

10Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)adopting additional guidance for development of submissions as long as they
demonstrate to be adequate and its implementation justified.
The relevant AR regulations include the following:

AR 10.10.1 Site Evaluation for Nuclear Power Plants,

AR 3.1.3 Radiological Criteria for Accident Conditions in Nuclear Power Plants,

AR 3.2.1 General Safety Criteria for Design of Nuclear Power Plants,

AR 3.10.1 Protection against Earthquakes in Nuclear Power Plants.

III. PIPE BREAKSThis section compares the regulatory approaches of the HPR1000 Hazards TESG withrespect to pipe breaks, to identify areas of common practice and key differences. The
implications of these differences in regulatory approach are considered with respect tothe design of the HPR1000.
The pipe breaks hazard includes high, medium and low energy pipe systems. Of these,high energy pipe failures are the most energetic and usually associated with bounding
load cases and consequential hazards. Consequently, the remainder of this section
describes each member nation’s regulatory expectations relating to high energy pipe
failures. It should be noted that other (medium and low) energised pipe systems mayneed to be analysed under different regulatory regimes, to evaluate the consequencesof consequential hazards, such as internal flooding.
SCOPE: EXCLUSIONS AND SCREENING CRITERIAAll regulators in the Hazards TESG consider IAEA guidance [Ref. 5] provides a suitabledefinition of a high energy system. This guidance defines a system as being high energy
if it operates at a pressure equal or greater than 2.0 MPa and/or the operating
temperature is 100oC or greater in the case of water or equivalent in line (other limits may
apply for other fluids). Some nations may choose more conservative parameters that willlead to additional systems being screened-in for assessment (e.g. US NRC NUREG 0800
defines high energy pipelines as having a pressure equal or greater than 1.9 MPa and/or
the operating temperature is 95°C), but it is unlikely that any screening criteria will be
more optimistic than the IAEA guidance. Furthermore, most regulators require allenergised systems (i.e. both low and medium energy systems) to be assessed, albeit, the11Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)level of detail may vary depending on the nature of the hazard, design detail and use ofbounding hazard scenarios.
Exclusions and screening criteria are used to bound the scope of the HEPF and represent
a significant difference between the approaches of the Hazards TESG members. Thereare clear differences between the regulatory approaches for exclusionary criteria, with
the Chinese Regulator allowing for exclusions to be identified and the UK Regulator not
applying any exclusion for HEPF.
For example, the acceptability of leak-before-break arguments as an exclusionary
criterion varies between Hazards TESG members. Similar debate has been held by other
MDEP WGs [e.g. Ref. 6 ]. There are also differences between regulators on theacceptability of time at risk, utilisation, and geometry arguments for exclusions. Those
regulators that do not accept exclusionary arguments as primary safety claims would
expect an assessment of the consequences of HEPF for relevant systems from the
HPR1000, assuming a full pipe break, unless an alternative justification could be provided
for their continued exclusion or they are screened from further consideration based on
appropriate screening criteria. It is noted that IAEA SSG-64 [Ref. 5] considers theundertaking of consequence analysis of a full pipe break as good practice todemonstrate the robustness of a design.
With regards to screening, the regulators agree that both deterministic and probabilistic
screening criteria are appropriate for use. In applying the screening criteria consideration
should be given to the plant configuration, geometry, and location of SSCs important tosafety. Potential consequential internal hazards should also be identified forconsideration in the analysis. Hazard combinations may be screened out when theprobability of occurrence is below a threshold (typically 10-7 per annum or lower) but
such approaches should be sufficiently justified. However, good practice is moving
beyond simple frequency screening. For example, Appendix 1 of SSG-64 (Ref. 5)highlights multiplying numbers together should be treated with caution and reminds thereader that the first hazard may affect the frequency or damage potential of a second
hazard. Furthermore, it may still be reasonable to enhance robustness of a design evenfor a particular combination of hazards with low frequency if the potential consequences
warrant such design enhancements.

12Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)

The screening process can be used to identify appropriate bounding scenarios, which
can then be applied in the subsequent analysis to ensure that the design is robust against
the HEPF hazard (and associated combinations).
One topic discussed by the Hazards TESG, is that the UK Regulator allows for identificationof highest integrity components (HIC); items whose failure is considered to be lessfrequent than 10-7. However, this is not an exclusionary criterion in the normal sense. To
satisfy the HIC claim items are subject to robust assessment of detailed evidence, over
and above what is considered relevant good practice and including evaluation of theconsequences of failure. Only once all necessary evidence has been provided andassessed will a claim of HIC be accepted; and the items can then be screened out offurther analysis as a hazard contributor.
Irrespective of the HIC designation the expectations of internal hazards remain, and any
hazards that could impact the HIC should be identified and assessed. It is the UK’s
expectation that a new nuclear power plant (NPP) design should demonstrate that theplant layouts are optimised to eliminate all potential hazards to HICs, so far as isreasonably practicable. Where this is not practicable through the optimisation of thelayout, then robust safety measures should be adopted to protect against and/or
mitigate any hazard effects. Any hazards that remain, are within the design basis
threshold and still provide a challenge to the HIC should be quantified andconsequences conservatively assessed to demonstrate that the integrity of the HIC
remains and the risks are demonstrated to be ALARP.
All regulators agree that safety trains should be segregated where practicable orprotected, to prevent consequential failures resulting from hazards, including pipe
failures. Where divisional barriers are included for protection of safety trains then theseshould be designed to withstand bounding load cases, which should include
consideration of combined hazard loadings.
ANALYSIS METHODS
Following the application of exclusionary and screening criteria, the remaining HEPF
hazards screened-in to the assessment should be analysed. The HPR1000 design has
been analysed for several HEPF hazards.

13

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)

All regulators agree that it is for the designer / vendor to demonstrate that the specificdeterministic safety analysis methods used as part of the design basis analysis are suitable
and sufficient. It is expected that both global and local effects should be considered,including combined consequential effects. In doing so the designer / vendor should
provide appropriate characterisation of the event sequences to identify all simultaneousloads on the protective barriers, safety measures and SSCs. For SSC substantiation (thegeneration of evidence that demonstrates a claim on SSCs can be achieved, such as
by calculation, modelling or research) the design basis analysis should consider
consequential hazards resulting from pipe interactions. The response of both SSCs andbarriers to combined loads (e.g. pipe whip, jet impact, steam release and flooding etc.)
should be evaluated. The analysis should be suitably conservative, use appropriate
codes and tools, supported by robust justification of their relevance, and appropriately
verified and validated for the application applied.
With respect to the detailed analysis, there exist some similarities and differences
between regulatory approaches and how conservatism is included in the design basis
analyses. It is generally accepted that the initiating hazard and associated faults should
be assumed to occur in the most onerous, normally permitted operating conditions andwhere appropriate, the bounding unmitigated fault scenarios identified via the screening
process should be applied. However, arguments relating to leak-before-break are notaccepted as primary safety claims by some members of the Hazards TESG.
Deterministic safety analysis for design extension conditions without significant fueldegradation should also be provided to demonstrate the absence of cliff edge effects
and identify the margins available before loss of safety functions. The Chinese Regulator
has satisfied themselves that the HPR1000 design considers cliff edge effects. The UK
Regulator would expect for hazards with a frequency below the design basis threshold,analysis to be undertaken on a best estimate basis. The UK Regulator would also expect
sensitivity analysis to be provided for systems with operating limits and conditions near the
initial screening criteria to demonstrate the absence of cliff edge effects on other SSCs.
SUMMARY OF DESIGN AND POTENTIAL IMPACT
The analysis provided for HEPF in the HPR1000 design conservatively assumes any SSCs
present in the room where the hazard occurs are lost, and a range of hazard
combinations are considered. Other protective, defense-in-depth measures include

14

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)barriers, anti-whip devices and restraints. However, due to the differences in regulatory
approaches it is recognised that additional analysis may be required to satisfy the
specific expectations of the different regulators.
IV. DROPPED LOADSThis section compares the regulatory approaches of the HPR1000 Hazards TESG withrespect to dropped loads to identify areas of common practice and key differences. The
implications of these differences in regulatory approach are considered with respect tothe design of the HPR1000.
SCOPE: EXCLUSIONS AND SCREENING CRITERIA
Unlike the HEPF hazard, there is less agreement on the scope of the dropped loads
hazard between members of the Hazards TESG. It is generally accepted thatconsequences of dropped loads for lifting equipment should be considered, as well asother falling objects that may occur consequentially as a result of structural failurescaused by external and/or internal hazards, or human error (such as incorrect operation,slinging or attachment of a load to lifting equipment). Dropped loads can impact SSCs
providing safety functions and should therefore be considered as a potential initiator of
fault sequences with nuclear safety consequences. HAD102/04 provides therequirements considered for the HPR1000 design and there has been some considerationof dropped loads in the design.
All regulators expect potential dropped load hazards to be suitably identified andcharacterised. However, there is clear difference between the regulatory approaches
for exclusionary criteria of dropped loads and screening criteria. The Chinese Regulator
requires vendors / designers to postulate dropped loads for every lifting or handlingdevice. However, it is generally expected that the vendors / designers will be able todemonstrate that the reliability of the lifting equipment is such that the hazard can beeffectively discounted. This is because the Chinese Regulator permits the use of single
failure proof cranes arguments to exclude cranes, and associated drop load hazards
from further analysis. Defense-in-depth is expected to be provided including via theconfiguration of handling equipment avoiding SSCs and the integrity of items being lifted,
such as fuel casks.

15

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)

In comparison the UK Regulator expects consideration of the consequences fromdropped loads for all lifting operations that occur in the vicinity of nuclear safetysignificant SSCs that would be susceptible to failure in the event of a dropped load
occurring. This includes, for example swing loads and crane collapse. For that lifting
equipment not analysed for dropped loads in the HPR1000 design, the UK Regulator
would expect them to be considered in the GDA, and if necessary additional analysis tobe undertaken to demonstrate that the risks from dropped load are reduced to be as
low as reasonably practicable.
Those cranes and objects that could potentially fall and are not excluded from theassessment, depending on the regulatory jurisdiction and approach, should then enter
the screening process. Regulators agree that both deterministic and probabilistic
screening criteria are appropriate for application. For example, dropped loads can bescreened from the analysis if the consequences can be shown to be negligible, or if thefrequency of occurrence is below a threshold (typically an event frequency or a fault
sequence frequency below once in ten million years (10-7)). The screening process is
expected to retain all faults associated with both types of hazard (dropped loads andfalling objects) that have the potential to make a significant contribution to the overallrisks from the facility and then analyse the potential consequence of these faults.
ANALYSIS METHODS
Following the application of exclusionary and screening criteria, the analysis of theremaining dropped loads and falling objects should be analysed. The HPR1000 has
analysed a number of dropped loads, associated with cranes, and falling objects. It isalso noteworthy that the Chinese Regulator has specifically undertaken additional
analysis of dropped loads in the fuel building [Ref. 7] to show that the risks are tolerable.
It is generally agreed that deterministic analysis should be used for those screened-in
dropped loads. There are varying expectations as to how this analysis should beundertaken and how conservatism is included. In general, the Chinese Regulator would
typically expect that vendors / designers demonstrate that lifting equipment is sufficiently
reliable to claim single failure proof criterion, and therefore the safety case will focus on
defense-in-depth claims. In comparison the UK Regulator will expect analysis of the worstcase, unmitigated, fault condition, (i.e. a drop from the maximum height) with effects
considered for all SSCs that could potentially be impacted. This includes potential effects

16

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)of dropped loads on barriers such as penetration, spalling, cone cracking andperforation.
All regulators expect defense-in-depth to be demonstrated against dropped loads. Thiscan include, but not be limited to:

A consideration of whether the lift can be practicably eliminated.

Movement plans that avoid, where reasonably practicable to do so, the lifting
over/near safety significant SSCs, and the height of the lift minimised.

Measures taken to prevent the lifting of excessive loads.



Items / packages containing nuclear matter / radioactive materials are designed toretain their integrity following an impact resulting from a dropped load.

Lifting equipment can only be used in permitted states.

All regulators in the Hazards TESG agree that the analysis of dropped loads should resultin the determination of the limits and conditions of operation of, for example, the lifting
equipment, detailed load paths, and systems and administrative controls that need to
be in place to control the lifts. Such limits and conditions would need to be followed by
the plant operator.
SUMMARY OF DESIGN AND POTENTIAL IMPACT
The HPR1000 considers dropped loads and falling objects and has considered thesehazards in the defense-in-depth of the plant. However, it is recognised that the due tothe different regulatory expectations in relation to exclusionary criteria that additional
analysis may be required to satisfy the expectations of the different regulators.
V. COMBINED HAZARDSThis section compares the regulatory approaches of the HPR1000 Hazards TESG withrespect to hazard combinations to identify areas of common practice and key
differences. The implications of these differences in regulatory approach are consideredwith respect to the design of the HPR1000.
SCOPE: EXCLUSIONS AND SCREENING CRITERIA
The identification, screening and analysis of combined hazards is a multidisciplinary
subject that requires a detailed understanding of the layout and hazards within the NPP

17

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)design. One of the key sources of multi-hazards is the failure of high energy pipes (seeHEPF section above) that can result in a number of consequential hazards including: pipe
whip, jet loads, steam release, blast effects and internal flooding. Therefore, the NPP
design needs to demonstrate capacity to withstand the combined effects from the
combined hazard loads particularly for those areas of highest risk, such as areas where
HIC exist.
All regulators involved with the HPR1000 MDEP WG recognise the importance of assessing
the combination of events that could impact SSCs important to safety. For the HPR1000
design this is captured in the Chinese guidance HAF-102-2016 and sets out the
expectation that where analysis identifies combination of events that can lead tooperational, or accident condition the event shall be considered in the design basis of
the plant. This guide prescribes specific regulatory expectations on the methodology ofcombined hazards and there are also related requirements in the Safety Guide
HAD102/17-2006 “Evaluation and verification of the Safety of Nuclear Power Plants”.
The UK Regulator has specific guidance on the expectations for assessment of
combination hazards, where it defines the following classifications, which are consistent
with those adopted in Ref. 5:Unrelated (independent) hazards: when more than one internal and/or external
hazard applies simultaneously. This can be the case, for example, of nominallyfrequent events such as internal fire and flooding when there is no causation link
between them.

Consequential Hazards: an internal or external hazard directly poses one or more
additional hazards to plant and structures (e.g. seismic hazard leads to an internalfire that activates a water-based fire suppression system leading to water spray andflooding effects).



Correlated Hazards: A common cause results in multiple hazard(s) that occur
simultaneously. An example of this would be pressure part failure giving rise to pipe
whip impact and flooding.

All regulators recognise the importance of adequate screening highlighting the relianceof deterministic and probabilistic methods. The UK Regulator provides specific guidance18

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)on screening techniques to demonstrate the NPP design considers relevant hazard
combinations.
All regulators agree on the adoption of redundancy and segregation to ensure thathazards cannot lead to the loss of multiple safety trains. To achieve this, all regulators
strive to ensure that the plant design meets the guidance in IAEA SSG-64 (Ref. 5) andnational design practices ensuring that hazards are considered in the design, andoptimisation of plant layout minimises the effects of hazards.
For the optimisation of layout and hazard protection all regulators recognise theimportance of civil barriers (including protecting penetrations through those barriers) forthe provision of passive means to provide protection against the maximum credibleloads. There is a general regulatory requirement / expectation that barriers required fornuclear safety should be demonstrated to maintain their integrity under all hazard
conditions (including combinations) and deliver their safety functions. This sets out theneed for barriers to be substantiated to withstand multiple hazards.
ANALYSIS METHODSAll regulators expect hazard analysis and the identification of combined hazards via a
combination of deterministic and probabilistic approaches. The assessment of
combined loads is universally agreed to be essential in demonstrating the safety of a NPP
design. Bounding load cases are considered suitable for use in the analysis, including
those resulting from hazard combinations, so long as they are suitably justified.
For example, the UK Regulator recommends considering the worst-case unmitigatedhazard conditions, (e.g. most onerous loads including combinations of loads), as astarting point for the assessment. Doing so (e.g. by assuming safety measures are absent
or fail to operate) can reveal the most onerous event consequences and hence ensurethat the nuclear safety significance of measures and assumptions on which the design
depends are appropriately recognised. Where gaps / weaknesses are identified in thedesign additional measures (engineering or procedural) may be required to reduce thehazard loads or effects. ONR SAPs paragraph 155 provides a hierarchy of safetymeasures, with a preference for those towards the top of the hierarchy (e.g. passive
safety measures compared with mitigative measures). It should be noted that thishierarchy does not prevent other measures being implemented as part of the plant’s
defense-in-depth. It is the UK Regulator’s expectation that the safety case clearly19Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)presents the full range of options considered as part of optioneering process todemonstrate that the measures adopted reduce the risks to be as low as reasonably
practicable. This stepwise approach provides a basis to understand the hazards andassociated risks to nuclear safety for the NPP design and to enable proportionate
assessment of the safety case claims, arguments and evidence (as provided by duty
holders to demonstrate that the risks from hazards have been reduced to ALARP).
Analysis of the plant against the derived load cases should be undertaken to enableassessment of the tolerability of the NPP design. Consideration of loads resulting fromhazard combinations is important in ensuring that the design of passive, multi-hazard
barriers is adequate. It is expected that these barriers should be substantiated to be
tolerant of bounding hazard loads including combination of hazards. Furthermore, theanalysis should underpin the identification and the importance of functional
requirements of safety measures that address the hazard.
The regulators expect that the design layout should in the first instance be optimised toeliminate hazards. Where this is not reasonably practicable the design should
demonstrate an iterative approach for reducing hazard risks applying a hierarchy ofsafety measures and defense-in-depth. This approach should adequately demonstratethat hazard effects have been considered and priority given to ensuring segregation of
key safety systems through the provision of passive barriers. The analysis should ultimately
demonstrate that the layout is optimised such that the risks to SSCs from hazards andhazard combinations are as low as is reasonably practicable. Any areas of exception(i.e. where multiple safety trains pass through a single room) need to be identified andsuitably justified to show that there is no significant increase in risk.
SUMMARY OF DESIGN AND POTENTIAL IMPACT
The HPR1000 design considers hazard combinations based on the relevant HAF and HAD
codes. The design includes the provision of passive barriers to protect SSCs against theeffects of hazards and hazard combinations. This includes segregation of the various
safety trains where reasonably practicable to do so. However, due to the differences inregulatory approaches it is recognised that additional analysis may be required to satisfy
the specific expectations of the different regulators.

20

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)

VI. CONCLUSIONSThis technical report presents a summary of the regulatory approaches relevant tohazards of the members of the HPR1000 Hazards TESG. It is based on the detailed
information provided by members of the Hazards TESG in response to the questionnaire
provided in the appendix. The responses to the questionnaire have been compared to
identify areas of common regulatory approach and differences.
Overall, all member countries ensure that their national guidance documents arealigned with IAEA guidance relevant to hazards. Therefore, at a principal level, theregulatory expectations for hazards are similar between the members of the Hazards
TESG. However, there are some notable differences in the application of these high-level
principles with respect to identification, screening, and characterisation of hazards andin the detailed application of regulatory approaches for assessment purposes.
The differences between regulatory approaches have been explored for a number of
pertinent, typical hazards and the potential impact of these differences for the design of
the HPR1000 reactor discussed. Given the varying status of each member’s regulatory
assessment of the HPR1000 reactor design it has not been possible to identify any specificdesign changes that may result from different regulatory expectations relevant tohazards. However, it is possible to identify where additional analysis may be required toensure the design meets national expectations. For example, the UK Regulator does not
accept leak-before-break arguments as a principal means of demonstrating adequate
safety. Consequently, additional analysis is needed to demonstrate that theconsequences of a HEPF have been adequately accounted for and that the risks for thedesign are as low as reasonably practicable.
With respect to common practice, all members agree that:I.

IAEA guidance is considered good practice and each member’s guidance isaligned with IAEA documentation relevant to hazards.

II.

Identification,

characterisation,andscreeningofhazards(including

combinations) is good practice.
III.

Individual hazards and combinations of hazards are considered in the design of
the HPR1000 design, albeit individual national regulators may expect some
additional hazards / combinations to be considered.

IV.

Application of bounding hazard scenarios is an appropriate approach.
21

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)

V.

Application of suitable screening criteria to bound the hazards analysis isconsidered appropriate.

VI.

Various approaches should be used to analyse hazards at different annual
probability of exceedance including: deterministic approaches, design basis
analysis, beyond design basis analysis (including demonstrating an absence ofcliff edge effects), probabilistic safety analysis and severe accident analysis.

REFERENCES

1

Minutes of second meeting of HPR1000 WG

2

Minutes of third meeting of HPR1000 WG / first meeting of Hazards TESG

3

Minutes of fourth meeting of Hazards TESG

4

Vendor Presentation at fourth meeting of Hazards TESG

5

IAEA Safety Standards:
SSG-64: Protection against Internal Hazards in the Design of Nuclear Power Plants.
SSR 2/1: Safety of Nuclear Power Plants: Design, Rev 1.
TecDoc 1791: Considerations on the Application of the IAEA Safety Requirements for the
Design of Nuclear Power Plants.
SSG-67: Seismic Design for Nuclear Installations
SSG-68: Design of Nuclear Installations Against External Events Excluding Earthquakes

6

MDEP Technical Report TR-VVERWG-02, Regulatory approaches and oversight practices
related to reactor pressure vessel and primary components

7

NNSA, Presentation on Fuel Building Dropped Loads Assessment, Presented during the 5th
Meeting of the Hazards TESG.

22

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)

APPENDIX FOR SPECIFIC GUIDANCE
Hazards TESG Technical Report
The following questionnaire was developed by members of the hazards TESG following the 3rd meeting of the HPR1000 WG and the responses were discussed during the 4th HPR1000 WG meeting held at Fangchenggang,
China in September 2019.
The Hazards TR is based on the detailed information contained in the table below.
HazardHigh energypressure
failureNNSA Response
How is the scope of hazards analysis defined?

ONR Response
How is the scope of hazards analysis defined?

NNR Response
How is the scope of hazards analysis defined?

a. Pipes containing water or steam @ pressure ≥ 2MPa (g)during normal operation; or pipes is not less than 100℃
b. Gas pipes pressurised above atmospheric pressure.

For high energy criteria we agree with the same initial
criteria, but expect that HE system near these values are
considered in sensitivity analysis to determine cliff edge
effects.

For the existing nuclear power plant, plant piping
systems or portions of systems that are pressurised above
atmospheric pressure during normal plant conditions areclassified as either high or moderate energy piping.
High energy piping includes those systems or portions ofsystems in which the maximum operating temperature
exceeds 93ºC or the maximum operating pressure
exceeds 1.9 MPa for more than 2% of the time during
normal plant operation.
Moderate energy piping includes those piping systems
or portions of systems pressurised above atmosphericpressure during normal plant conditions and not
identified as high energy piping.

Are there any exclusions and what is the reason?
Are there any exclusions and what is the reason?
a. Pipes using Leak-Before-Break (LBB) technology.
b. Pipes covered by 2% criterion (2% criterion: the safetyclassified piping system with a nominal diameter no lessthan 50 mm which are in operation as high energy piping
systems less than or equal to 2% of the plant life areconsidered as moderate energy piping system).
c. Pipes within Containment Penetrations Area meeting
appropriate provisions, according to SRP BTP3-4.
d. Pipes with a nominal diameter less than 25 mm.
What are the regulatory expectations for:The methodologies used in the deterministic analysis byvendors?
NNSA does not specify a detailed analysis methodology.
However, vendors should demonstrate the methodologies
are reasonable and feasible.
The process for identification, screening andquantification of credible bounding events (including
credible combined hazards) within the DBA?
A full range of screening is conducted according to theabove mentioned scope of hazards analysis defined.
Quantitative analysis is conducted if the exclusion
requirements are not met.
The assessment of High energy pipe failures includes thefollowing steps:Data collection: the high energy pipe failure sources
are identified according to the criteria mentioned
above.

ONR does not apply any exclusions for HEPF and all pipes(Medium & Low energy) should be included in theassessment. For example:

Leak-before-break - Not generally accepted as
primary safety claim in UK Safety Cases.
Exclusions due to low utilisation or time at risk
assumptions would not be accepted as the basis not
to provide visibility of the hazard consequences (e.g.
1% or 2% criteria).

What are the regulatory expectations for:The methodologies used in the deterministic analysis?
ONR expects HEPF methodologies to include:
Assessment of the Dynamic effects / Local Loads on
Reinforced Concrete / Steel from hazards including:
Pipe whip;
Jet impingement;Missiles;
Blast.
Assessment of the Global / Environmental Loads on
Reinforced Concrete / Steel from hazards including:
Pressure effects due to hot gas or steam release;Temperature effects due to hot gas or steam release;Flooding;
Other - moisture/ condensation, toxicity.
Use of appropriate codes and tools should be supported
by robust justification of their relevance and are

23

ARN Response
How is the scope of hazards analysis defined?
Are there any exclusions and what is the reason?
Depending on the characteristics of the pipes
under consideration (internal parameters,
diameter, stress values, fatigue factors), thefollowing types of failure should be considered:(a) High energy pipes (except for those qualified
for leak-before-break, break preclusion or for low
probability of failure) can suffer fromcircumferential rupture or longitudinal through wall
crack, or both. The high energy of the contained
fluid means that dynamic effects, such as pipe
whip, or jets is more important.

For possible new nuclear power plants, the NNR may be
guided by the latest guidance from IAEA SSG-64“Protection against Internal Hazards in the Design ofNuclear Power Plants” on Pipe Breaks (for example,
Para. 4.110 and its footnote) or by appropriately justified
submissions from the authorisation applicant.

(b) Low energy pipes can also suffer through wall
cracks, either longitudinal or circumferential,
although cracks would in some cases be morestable, given the energy of the fluid, and dynamic
effects would be less significant. By exception, forlow energy pipes, it could be possible to justify
limiting the break size to that of a leak with limitedarea.

More information on the regulatory framework forpressure equipment appears in NNR Position Paper PP0012 Manufacturing of Components for Nuclear
Installations.

For ARN, high energy pipe is defined as a pipe withan internal operating pressure equal to or
exceeding 2.0 MPa or an operating temperatureequal to or exceeding 100°C in the case of water.

Are there any exclusions and what is the reason?

It is accepted to postulate only a limited leak (andnot a break) if it can be demonstrated that thepiping system considered is operated under ‘highenergy’ parameters for a short period of time (e.g.
less than 2% of the total operating time) or if its
nominal stress is reasonably low (e.g. a pressure ofless than 50 MPa).

The following text from Section 5 of NNR Draft Specific
Nuclear Safety Regulations: Nuclear Facilities implies that
all categories of pipes should be included in theassessment:“(2) Internal and external hazards(a) Internal and external events shall be identified basedon a comprehensive hazard analysis.
(b) All foreseeable internal hazards and external
hazards, including the potential for human induced
events directly or indirectly to affect the safety shall beidentified and their effects shall be evaluated. Hazards

A pipe break need not be assumed if a successful
qualification for leak-before-break, for breakpreclusion or for low probability of failure has beenTechnical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
Hazard

NNSA Response
Consequence analysis: Impact on the delivery offundamental safety functions after HEPF is performed
comprehensively.
If the consequence is not acceptable, the safetymeasures will be applied, such as pipe whip restrain.

Combining correlated, consequential and independent
hazards (i.e. on a frequency basis, and positively andnegatively related external hazards)?
For HEPF, combined consequential effects are identified
and analysed based on detailed system and layout
design. For example, the SSCs affected by combinationof pipe whip and jet impingement are identified andevaluated in design.
The process for identification and quantification of hazard
combinations for beyond design basis?
According to domestic and international regulations or
RGP, combined internal hazards for beyond design basis
have not been considered in design. But the assessment of
independent internal hazards combination for beyond
design basis analysis could be performed as cliff edge
analysis.
HPR1000 considered the beyond design basis external
hazards as well as Fukushima accident experience
feedback. The beyond design basis external flooding(design basis flooding level combines with the once in a
thousand year rainfall) is considered.
Ensuring conservatism in the analysis and the various
sources of uncertainties (e.g. assumptions, design
information or analytical model)?
Adopt the methodology consist with the wildly recognised
practice, and used the conservative assumptions in theanalysis.

ONR Response
appropriately verified and validated for the application
applied. Appropriate codes and standards include:
Use of the ANSI/ANS 58.2-1988 and NUREG 0800 rules
generally OK as a starting position but additional
expectations are documented in NS-TAST-GD-14 (e.g.
failures to be postulated at any location which would
give rise to bounding consequences) and the
responses to the following questions.
Impact on concrete barriers (local and global) shouldbe evaluated using appropriate analytical models(e.g. LS-DYNA) and design codes (e.g. ACI 349-13).
The process for identification, screening andquantification of credible bounding events (including
credible combined hazards) within the DBA?
ONR expects that relevant and proportionate screening
criteria are applied, within the expectations of designbasis analysis. The analysis will be based on pipework
layouts and room dimensions, geometry and SSC layouts.
Simplification and assumptions may be made for ease ofanalysis depending on the stage at which the design is(e.g. assuming longest length of unrestrained pipe equal
to room dimensions etc.)
This can be applied through:
Deterministic Screening
Hazard sequences can be either grouped based on
the challenges to specific protection features e.g.
each individual multi-hazard barrier; orHazard sequences can be grouped based on the
combined challenge to each safety function.
Probabilistic screening•

The use of probabilistic analysis?
The frequency of internal hazard has been used to judge
the possibility of independent hazard combination. In
combined internal hazards definition, two independent
hazard combinations are not considered because of low
frequency of internal hazard in HPR1000.

•

Hazard combinations may be screened out because
the frequency of occurrence is considered to be
extremely low; below 1 in 10 million years (10-7 perannum).
Whilst it may be acceptable to consider that two
independent, low frequency hazards in the designbasis have a very low probability of occurrence
during each other’s plant mission time, the combined
consequential effects should be checked for cliffedge effects not otherwise captured in the safety
case.

Combining correlated, consequential and independent
hazards (i.e. on a frequency basis, and positively andnegatively related external hazards)?

24

NNR Responseshall be considered for determination of the postulated
initiating events and generated loadings for use in thedesign of relevant items important to nuclear safety.
(c) …”
For possible new nuclear power plants, the NNR may be
guided by the latest guidance from IAEA SSG-64“Protection against Internal Hazards in the Design ofNuclear Power Plants”, for example:“4.111. It may be acceptable to postulate only a limited
leak (and not a break), if it can be demonstrated thatthe piping system considered is operated under ‘highenergy’ parameters for a short period of time (e.g. lessthan 2% of the total operating time). Some States haveidentified criteria for excluding certain pipe segmentsfrom break analysis (see para. 4.136). Alternatively, anassessment of the consequences assuming a full pipe
break can be viewed as a good practice todemonstrate the robustness of the design.”

ARN Response
performed for the piping under consideration,
resulting in a sufficiently low frequency of theoccurrence of a spontaneous break.
In general, a fracture mechanics analysis should be
performed to calculate the leak size. In lieu of suchan analysis, a subcritical crack corresponding to aleak size of 10% of the flow cross-section should be
postulated.
What are the regulatory expectations for:The methodologies used in the deterministic
analysis by vendors?
ARN does not specify a detailed analysis
methodology. However it is required that thevendors apply a conservative methodology for
AOO’s and DBAs while a best estimate analysis plus
uncertainty approach must be used for DECs.

What are the regulatory expectations for:The methodologies used in the deterministic analysis?
From Section 7.1.1 of NNR RG-0019 “Interim Guidanceon Safety Assessments of Nuclear Facilities”:‘4) Deterministic safety analysis should be used toanalyse AOO’s, DBA’s and DBEC’s.
5) For AOO’s and DBAs the safety analyses should bedemonstrably conservative with respect to the figures ofmerit or safety criteria.
6) For DBECs, best estimate analyses plus uncertainty or
sensitivity analyses, may be justified.
7) Guidance on “Deterministic Safety Analysis for
Nuclear Power Plants” can be found in the IAEA Specific
Safety Guide, SSG-2.”’
From Section 7.1.2 of NNR RG-0019:“(8) Deterministic safety analysis(a) Deterministic safety analysis shall be included in thesafety assessment, covering both operational states andaccident conditions.
(b) The objective of the deterministic safety analysis shallbe to:(i) Demonstrate compliance with safety
requirements such as the requirement for
ensuring the integrity of barriers against theIn addition, deterministic analysis shall mainly
provide:(a) Establishment and confirmation of the designbases for all items important to safety;(b) Characterisation of the postulated initiating
events that are appropriate for the site and thedesign of the plant;(c) Analysis and evaluation of event sequencesthat result from postulated initiating events, toconfirm the qualification requirements;(d) Comparison of the results of the analysis withacceptance criteria, design limits, dose limits andacceptable limits for purposes of radiation
protection;(e) Demonstration that the management of
anticipated operational occurrences and designbasis accidents is possible by safety actions for the
automatic actuation of safety systems in
combination with prescribed actions by theoperator;(f) Demonstration that the management of design
extension conditions is possible by the automatic
actuation of safety systems and the use of safety
features in combination with expected actions by
the operator.
The process for identification, screening andquantification of credible bounding events

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response

ONR Response
As part of HEPF analysis ONR expects that analysis ofdynamic and global effects includes assessment of:Combined consequential effects due to domino
effect / pipe to pipe interactions.
Combined consequential effects due to single pipe
failure on barriers and SSCs (e.g. pipe whip andsteam release or pipe whip, jet and flood).

For SSC substantiation the following should be considered:The barrier response to combined loads (e.g. pipe
whip, jet impact, hydrostatic load and etc.) requires
appropriate characterisation of the event sequencesand duration to identify all simultaneous loads on
barriers.
Consequential pipe to pipe interactions should be
evaluated and the combined effects on barriers and/ or safety classified SSCs should be evaluated.
Appropriate design criteria should be madeavailable.
Impact on safety classified SSCs should be evaluated,
as appropriate.

Decision making on appropriate engineering protection
should be make in accordance with the ALARP principle,
where accepted good practice is considered as well as
residual levels of risk.
The process for identification and quantification of hazard
combinations for beyond design basis?
Fault sequences initiated by internal and external hazards
beyond the design basis should be analysed applying anappropriate combination of engineering, deterministic
and probabilistic assessments. Analysis of beyond designbasis events should:






Confirm the absence of ‘cliff edge’ effects justbeyond the design basis.
Identify the hazard level at which safety functions
could be lost (i.e. determine the beyond design basis
margin) (non-discrete hazards only).
Provide an input to probabilistic safety analysis ofwhether risks targets are met.
Ensure that safety is balanced so that no single typeof hazard makes a disproportionate contribution to
overall risk.
Provide an input to severe accident analysis (nondiscrete hazards only).

Ensuring conservatism in the analysis and the various
sources of uncertainties (e.g. assumptions, design
information or analytical model)?

25

NNR Response
release of radioactive material and various
other acceptance criteria;(ii) Determine whether there are adequate
safety margin in the design and operation of a
facility, or in the conduct of an activity;(iii) Derive or confirm operational limits andconditions that are consistent with the designand safety requirements for the facility;(iv) Assist in establishing and validating
emergency operating procedures andaccident management procedures andguidelines; and(v) Confirm that modifications to the design or
operation of the reactor facility have nosignificant adverse impact on safety.
(c) The selected events shall be categorised, based on
the results of probabilistic safety assessment andengineering judgement.

ARN Response(including credible combined hazards) within the
DBA?

From Section 7.4 of NNR RG-0019:

Combining correlated, consequential andindependent hazards (i.e. on a frequency basis,and positively and negatively related external
hazards)?

“4) The applicant should begin the safety analysis with
an identification of all hazards (chemicals, radiologicalmaterials, fissile materials, etc.) that may present a
potential threat to the public, facility workers, or theenvironment (Appendix 1).
5) Based on a systematic analysis of each plant process,the safety analysis process hazard analysis (PHA)
identifies a set of individual accident sequences orprocess upsets that could result from the hazards. The
applicant’s safety analysis methodology should
therefore generally address:b) Hazard identification;c) PHA (accident identification);d) Initiating event identification;e) Accident sequence construction andevaluation;f) Consequence determination; andg) Likelihood categorisation for determining
compliance.”
Combining correlated, consequential and independent
hazards (i.e. on a frequency basis, and positively andnegatively related external hazards)?
Design bases should be derived for each credible eventand credible combination of events by adopting
appropriate methodologies.

ARN does not specify any specific criteria for
identification, screening and quantification of
events within DBA. It is an applicant decision tosubmit the process methodology for review andacceptance. However it is expected that theprocess include both, deterministic andprobabilistic approach.
When using probabilistic approach, the frequencyof occurrence lower than 10-7 per year is mainly
used as cut-off value for screening out.
For deterministic approach, consideration oflayout, room dimensions are taken into
consideration.

For ARN, it is not feasible to identify a priori a set ofhazard combinations that should be required in thedesign of a plant.
Instead, a performance-based approach in thisregard is expected from the applicant. Thisapproach, regardless of the specific methods orcriteria being used, should be comprehensive andsystematic.
The objective is to identify which hazard
combinations need to be considered and what
design features are necessary to address them.
Hazard identification processes could lead to longlists of potential combinations and therefore
pragmatic approaches should be utilised. While
combinations involving two (or even more)
simultaneous hazards could be postulated,screening criteria should be developed to ensurethat the list represents a credible and reasonable
set of plant challenges. The screening criteria canbe deterministic or probabilistic. Examples ofscreening criteria include:(a) The event combination is not credible;

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response

ONR Response
To demonstrate a conservative analysis ONR expects thefollowing:Double ended guillotine failure should be assumed(gross failure).

Break location – Both terminal ends and intermediate
points should be considered (e.g. high stress/ fatigue
areas, weld points), and also other locations
representing bounding consequences e.g. potential
impact on HIC, or other SSCs.

Failure of plant occurs at its most onerous state, e.g.
Analysis in highest energy mode.
Impact on barrier penetrations (cable, pipework,
doors, relief panels and etc.) should be evaluated.
The barrier response to combined loads (e.g. pipe
whip, jet impact, hydrostatic load and etc.) requires
appropriate characterisation of the event sequencesand duration to identify all simultaneous loads on
barriers.
The use of probabilistic analysis?
ONR expects that the analysis should apply anappropriate combination of engineering, deterministic
and probabilistic methods in order to:Understand the behaviour of the facility in responseto the hazard; andConfirm high confidence in the adequacy of thedesign basis definition and the associated fault
tolerance of the facility.

NNR Response
See also the response to the next question about how
unreasonable or not credible combinations of hazards
might be excluded.

ARN Response(b) The event combination, even if credible, would
not lead to conditions beyond what has alreadybeen assumed in the design.

The process for identification, screening andquantification of credible bounding events (including
credible combined hazards) within the DBA?

The process for identification and quantification of
hazard combinations for beyond design basis?

From Section 7.2 of NNR Position Paper PP-0014
Considerations of External Events for New Nuclear
Installations:“The following criteria could be used to eliminate
postulated hazards being included in the safetyassessment:(1) A phenomenon which occurs slowly or withadequate warning with respect to the time required totake appropriate protective action.
(2) A phenomenon which in itself has no significant
impact on the operation of a nuclear power plant andits safety assessment.
(3) A phenomenon which by itself has a probability ofoccurrence less than the 10-8 per year (event sequencefrequency).
(4) Locate the nuclear power plant sufficiently distantfrom the postulated phenomenon to mitigate its effects.
(5) A phenomenon which is included or enveloped bydesign for another phenomenon. For example, storm
surge and seiche are included in lake flooding; toxic gas
is included in pipeline accident or industrial or militaryfacility accident.
Alternative screening methods prescribed in PRA
standards can be used provided they aredemonstrated to be compatible with the NNR licensing
criteria as well as having a sound technical anddefensible basis.”

A set of DECs should be derived and justified as
representative, based on a combination ofdeterministic and probabilistic assessments as wellas engineering judgement.
Ensuring conservatism in the analysis and thevarious sources of uncertainties (e.g. assumptions,design information or analytical model)?
ARN expectation includes but is not limited to thefollowing:- The frequency of a double ended guillotine breakof high energy piping should be derived fromoperating experience or fracture mechanics
calculations. This frequency might also be available
from evaluations made for the purposes ofprobabilistic safety assessment.
- A large longitudinal through wall crack in highenergy piping resulting in a break or large leakage
area should be considered if longitudinal welds arepresent.
- Complete instantaneous breaks of high energy
pipes should be postulated.
- For small diameter piping systems, breaks should
be postulated at all locations because they aresensitive to vibration-induced failure.

The process for identification and quantification of
hazard combinations for beyond design basis?

The use of probabilistic analysis?

From Section 3 of NNR Draft General Nuclear Safety
Regulations:

ARN expects deterministic and probabilistic
assessments as well as engineering judgement.

“(4) The safety analysis shall include(f) External events and credible combination of
events which lead to radiological exposure;”
From p.26 of IAEA SSR-2/1 (Rev. 1) Safety of Nuclear
Power Plants: Design, 2016:26

For ARN, it is not feasible to identify a priori a set ofhazard combinations that should be required forbeyond design basis.

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response

ONR Response

NNR Response“Combinations of events and failures
5.32. Where the results of engineering judgement,
deterministic safety assessments and probabilistic safetyassessments indicate that combinations of events could
lead to anticipated operational occurrences or to
accident conditions, such combinations of events shallbe considered to be design basis accidents or shall be
included as part of design extension conditions,depending mainly on their likelihood of occurrence.
Certain events might be consequences of other events,
such as a flood following an earthquake. Suchconsequential effects shall be considered to be part ofthe original postulated initiating event.”
Ensuring conservatism in the analysis and the various
sources of uncertainties (e.g. assumptions, design
information or analytical model)?
From Section 5 of NNR Draft Specific Nuclear Safety
Regulations: Nuclear Facilities:“(5) Uncertainty analysis(a) An uncertainty and sensitivity analysis shallbe performed and taken into account in thedeterministic and probabilistic safety analysis
and conclusions drawn from it.
(b) Uncertainties in the various safety analyses
shall be characterised with respect to theirsource, nature and degree, using quantitative
methods, professional judgement or both.
(c) Design base accident analyses shall bedemonstrably conservative with respect to theacceptance criteria or safety requirement
being analysed against.”
From Section 7.1.1 of NNR RG-0019:‘5) For AOO’s and DBAs the safety analyses should bedemonstrably conservative with respect to the figures ofmerit or safety criteria.’
From Section 7.2.1 of NNR RG-0019:“7.2.1 Conservative Analysis
1) A conservative (enveloping) analysis shouldbe performed for design basis accidents.
2) In instances where the conservative analysis
shows noncompliance with the safety criteria, abest estimate analysis may be performed for27

ARN ResponseTechnical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response

ONR Response

NNR Response
those specific factors, which contributesignificantly to noncompliance.
3) The level of confidence in the best estimate
analysis for such factors must be justified bymeans of an uncertainty analysis and sensitivity
analysis.”

ARN Response

The use of probabilistic analysis?
From Section 7.1.2 of NNR Draft General Nuclear Safety
Regulations:“(9) Probabilistic safety analysis(a) A probabilistic safety analysis shall be
conducted to demonstrate compliance withnumerical risk criteria unless it can be justified
that no credible accident conditions exist.
(10) All activities with regard to safety analysis and risk
management shall be conducted in accordance withrecognised industry standards and practices as agreed
with the Regulator.”
From Section 7.1.2 “Probabilistic safety analysis” of NNR
RG-0019:“5) Either a best estimate analysis, with uncertainties, ora conservative analysis may be performed.”
From Section 7.1 “General approach for External Events”
of NNR RG-0011 “Interim Guidance for the Siting of
Nuclear Facilities”:“…
6) Appropriate methodologies should be adopted forestablishing the hazards from important external
phenomena.
7) The methodologies used should be thecurrent and state of the art, and should bejustified as being compatible with thecharacteristics of the region.
8) Preferential consideration should be given to
applicable probabilistic methodologies.
9) It should be noted that probabilistic hazard
curves are generally required to conduct
external
event PSAs.
…”
Droppedloads

How is the scope of hazards analysis defined?
Are there any exclusions and what is the reason?

How is the scope of hazards analysis defined?

How is the scope of hazards analysis defined?

28

How is the scope of hazards analysis defined?
Are there any exclusions and what is the reason?

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response
No. NS-G-1.11 Protection against Internal Hazards otherthan Fires and Explosions in the Design of Nuclear Power
Plants
2.18. In this systematic analysis, among the importantsecondary effects the following should be evaluated:
Falling objects. There may be circumstances in which apipe whip or a missile can damage the supporting
structure of a heavy object located above a safetysystem such that an object falls, possibly causing further
damage. It may in certain cases be possible to show thatthe falling object cannot cause unacceptable damage.
If not, either the supporting structure should be modified
to withstand the missile impact or means should be
provided to prevent such an impact.
HAD102-04 3.2.2 Dropping of heavy equipment.
If heavy items of plant equipment are located atsignificant heights, an evaluation should be made of thepossible hazards associated with dropping such
equipment, if the probability of this event is not negligible.

ONR Response
ONR expects the assessment of the consequences ofdropped loads, from all lifting operations on susceptible
nuclear safety significant SSCs. In general the scope ofassessment should consider:







Whether as a result of lifting operations specifically, or
intended or unintended drop of plant from height
have been identified and considered.
The analysis of dropped loads results in thedetermination of the limits and conditions ofoperation of, for example, the lifting equipment,
detailed load paths, and systems and administrative
controls that need to be in place.
Claims on “high integrity cranes” without the requisite
consequences analysis of the dropped loads are notaccepted.
The maximum fault condition height e.g. double
blocking height and mass should be assumed.
The various potential effects of dropped loads on
barriers should include penetration, spalling, cone
cracking and perforation.

Are there any exclusions and what is the reason?
There are no exclusions from assessment.

Scope of Analysis
What are the regulatory expectations for:
Dropped loads assumed to occur as a result of a lifting
device failure if the lifting devices can no longer control
the loads;
Dropped loads are postulated from every lifting or
handling device except the ones which are satisfied with‘single failure proof’.

The methodologies used in the deterministic analysis byvendors?
Exclusions during Dropped Loads safety evaluation
The reliability of the lifting equipment should be such thatdropping of the load can be effectively discounted, forexample, by the use of single failure proof cranes.

Dropped loads of spent fuel cask are mainly consideredin the design (PSAR 3.5.1.1.3 ).
The design of spent fuel cask crane takes into accountsingle failure and redundancy design, and is equippedwith necessary safety devices, which has high safety
reliability. The lifting mechanism of spent fuel cask craneadopts a double wire rope winding system and multiple
brakes as redundancy protection measures. The design ofthe double wire rope winding system can ensure that the

The worst-case unmitigated maximum fault condition
height e.g. double blocking height and mass should
be assumed.
Effects to all interacting SSCs should be assessed e.g.:o The various potential effects of dropped loads on
barriers should include penetration, spalling, cone
cracking and perforation.
o Demonstration Items / packages containing
nuclear matter are designed to retain theirintegrity following the worst-case impact.
Demonstration that Optioneering has been
undertaken to identify whether the lifting activity is
actually necessary, and to identify the preferred
method and equipment for undertaking the lift.
Assessment to determine if lifting over/near safetysignificant SSC’s can be avoided, and the height of
the lift minimised so far as is reasonably practicable.

The process for identification, screening andquantification of credible bounding events (including
credible combined hazards) within the DBA?

29

NNR Response
The following text from Section 5 of NNR Draft Specific
Nuclear Safety Regulations: Nuclear Facilities mentions
falling objects:“(2) Internal and external hazards…
(c) The design of a facility shall take due account ofinternal hazards such as fire, explosion, flooding, missile
generation, collapse of structures and falling objects,
pipe whip, jet impact and release of fluid from failed
systems or from other facilities on the site. Appropriate
features for prevention and mitigation shall be provided
to ensure that safety is not compromised.”
For further guidance, the NNR considers that therecommendations of the following IAEA publications,address the hazard of dropping heavy equipment as aresult of internally initiated events:
IAEA SSG-64 “Protection against Internal Hazards in the
Design of Nuclear Power Plants,
The section on heavy load drop starting at para. 4.173 of
IAEA SSG‑62, “Design of Auxiliary Systems and Supporting
Systems for Nuclear Power Plants”,
IAEA SSG‑63, “Design of Fuel Handling and Storage
Systems for Nuclear Power Plants”.
Furthermore, IAEA SSG‑67, “Seismic Design for Nuclear
Installations”, and IAEA SSG‑74, “Maintenance, Testing,
Surveillance and Inspection in Nuclear Power Plants”,
provide recommendations on seismic design andqualification, and on maintenance, surveillance andin‑service inspection, respectively, that together will leadto high integrity lifting systems in operation.
Are there any exclusions and what is the reason?
The following text from Section 5 of NNR Draft Specific
Nuclear Safety Regulations: Nuclear Facilities implies thatin principle all categories of dropped loads should beconsidered in the assessment:“(2) Internal and external hazards(a) Internal and external events shall be identified basedon a comprehensive hazard analysis.
(b) All foreseeable internal hazards and external
hazards, including the potential for human induced
events directly or indirectly to affect the safety shall beidentified and their effects shall be evaluated. Hazards
shall be considered for determination of the postulated
initiating events and generated loadings for use in thedesign of relevant items important to nuclear safety.
(c) …”

ARN Response
ARN’s expectations are aligned with IAEA safety
standards. With respect to hazards analysis, it isexpected that the applicant assess theconsequences of the dropped loads on items
important to safety.
For ARN is acceptable that drops are more likely tooccur from the handling of plant equipment orfrom fuel handling lifts. Also, if heavy items of plant
equipment are located at significant heights, anevaluation should be made of the possible hazards
associated with dropping such equipment. In allcases, exclusion from assessment has to be justified
based on the fact that the probability of such
event is negligible.
What are the regulatory expectations for:The methodologies used in the deterministic
analysis by vendors?
ARN does not specify a detailed analysis
methodology. However, based on NUREG 0612
expects that the analyses of postulated load drops
should as a minimum include the following
considerations:
The load is dropped in an orientation thatcauses the most severe consequences.

The load may be dropped at any locationin the crane travel area where movement
is not restricted by mechanical stops orelectrical interlock.

The analysis should postulate the"maximum damage" that could result, i.e.,
the analysis should consider that all energy
is absorbed by the structure and/or
equipment that is impacted.
Credit may not be taken for equipment tooperate that may mitigate the effects of
the load drop if the equipment is not
required to be operable by the technicalspecifications when the load could be
dropped.
The process for identification, screening andquantification of credible bounding events(including credible combined hazards) within the
DBA?
ARN does not specify any specific criteria for
identification, screening and quantification of
events within DBA. It is an applicant decision toTechnical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response
loads evenly distribute in the two wire ropes and when
one wire rope is broken, the other one is able to maintainthe rated load and maintain the balance of the pulley
block.
Nevertheless, the following defence-in-depth safetymeasures have been taken in equipment layout andbuilding structure: The crane layout does not operate
above the spent fuel pool, and, the autoclaved aerated
concrete is located at the bottom of loading andcleaning well and loading well.
What are the regulatory expectations for:The methodologies used in the deterministic analysis byvendors?
Deterministic analysis:
1. Measures are taken to prevent the lifting of excessive
loads;
2. Conservative design measures are applied to prevent
any unintentional dropping of loads that could affectitems important to safety;
3. The plant layout permits safe movement of theoverhead lifting equipment and of items beingtransported;
4. lifting equipment can be used only in specified plantstates (by means of safety interlocks on the crane);
5. Lifting equipment for use in areas where items importantto safety are located is seismically qualified.
The process for identification, screening andquantification of credible bounding events (including
credible combined hazards) within the DBA?

ONR Response
An effective process should be applied to identify andcharacterise all external and internal hazards that could
affect the safety of the facility.

NNR Response
Similar to a previous response, the following criteria
could be used to eliminate postulated hazards being
included in the safety assessment:

Hazards should be identified in terms of their severity andfrequency of occurrence and characterised as having
either a discrete frequency of occurrence (discrete
hazards), or a continuous frequency-severity relation (nondiscrete hazards). All hazards should be treated as
initiating events in the fault analysis.

(1) A hazard which occurs slowly or with adequate
warning with respect to the time required to takeappropriate protective action.
(2) A hazard which in itself has no significant impact on
the operation of a nuclear power plant and its safetyassessment.
(3) A hazard which by itself has a probability ofoccurrence less than the 10-8 per year (event sequencefrequency).
(4) A hazard which is included or enveloped by design
for another hazard.

The identification process should include reasonably
foreseeable combinations of independently occurring
hazards, causally-related hazards and consequential
events resulting from a common initiating event.
Screening criteria should be defined in terms of frequencyof occurrence and potential consequences as follows.
Discrete hazards may be excluded that:(a) have no significant identified consequential effect on
the safety of the facility;or(b) Have a total initiating event frequency that isdemonstrably below once in ten million years per annum.
Non-discrete hazards may be excluded where:(a) their associated faults have no significant
consequential effect on the safety of the facility;or(b) Their frequency of exceedance on their hazard curveis below once in ten million years.

All the lifting devices except the ones which are satisfied
with single failure proof are carried out for dropped loads
evaluation.

Screening should retain all faults associated with bothtypes of hazard that have the potential to make asignificant contribution to the overall risks from the facility.

HAD102-04 3.2.2 Dropping of heavy equipment

For each internal or external hazard which cannot be
excluded on the basis of either low frequency orinsignificant consequence, a design basis event should
be derived.

If heavy items of plant equipment are located atsignificant heights, an evaluation should be made of thepossible hazards associated with dropping such
equipment, if the probability of this event is not negligible.
Combining correlated, consequential and independent
hazards (i.e. on a frequency basis, and positively andnegatively related external hazards)?
HAD102-04 3.2.2 Dropping of heavy equipment

For external hazards, the design basis event should bederived conservatively to take account of data andmodel uncertainties. The thresholds set for design basis
events are 1 in 10 000 years for external hazards and 1 in
100 000 years for internal hazards.
For non-discrete hazards, consideration may be given toarguments to derive design basis events from a higher

30

Alternative screening methods prescribed in PRA
standards can be used provided they aredemonstrated to be compatible with the NNR licensing
criteria as well as having a sound technical anddefensible basis.
What are the regulatory expectations for:The methodologies used in the deterministic analysis byvendors?
Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.
The process for identification, screening andquantification of credible bounding events (including
credible combined hazards) within the DBA?
Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.
Combining correlated, consequential and independent
hazards (i.e. on a frequency basis, and positively andnegatively related external hazards)?

ARN Response
submit the process methodology for review andacceptance. Following IAEA DS 494, during plantdesign, internal hazards should be identified on thebasis of a combination of engineering judgement,
lessons learnt from similar plant designs andoperational experience, deterministic andprobabilistic considerations.
The identification and the characterisation include
the consideration of hazard initial conditions (e.g.
plant shutdown modes), the definition of themagnitude and the likelihood of the hazards, thelocations of their sources, the environmental
conditions produced and the possible impacts on
SSCs important to safety.
The hazard identification and characterisation
process should be rigorous, supported by plant
walk-down for verification, and well documented.
Combining correlated, consequential andindependent hazards (i.e. on a frequency basis,and positively and negatively related external
hazards)?
The process for identification and quantification of
hazard combinations for beyond design basis?
Ensuring conservatism in the analysis and thevarious sources of uncertainties (e.g. assumptions,design information or analytical model)?
As stated in IAEA DS 494, assessment is required tobe made to demonstrate that those internal
hazards relevant to the design of the nuclear
power plant are considered, that provisions forprevention and mitigation are designed with
sufficient safety margins to cover the uncertainties
in the identification and characterisation of internal
hazard effects, as well as for avoidance of cliffedge effects.
The use of probabilistic analysis?

Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.
The process for identification and quantification of
hazard combinations for beyond design basis?

ARN expects deterministic and probabilistic
assessments as well as engineering judgement.

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response
Generally, the cause of the dropping of heavy equipment
would be an external phenomenon such as anearthquake or an aircraft impact, but it may also behuman error.
For dropping of heavy equipment: At present, dropping ofheavy equipment is considered as a single orindependent load condition, and no combination withother external event s.
The process for identification and quantification of hazard
combinations for beyond design basis?
At present, there is no regulatory requirement for droppingof heavy equipment to consider beyond design basis.
Ensuring conservatism in the analysis and the various
sources of uncertainties (e.g. assumptions, design
information or analytical model)?
The identification of hazards sources is based on actual
design and all sources have been considered in
evaluation. The methodology of evaluation including
assumption and formula is conservative.
The use of probabilistic analysis?
N/A

ONR Response
frequency of exceedance if the facility (or the relevant
parts of it) cannot give rise to significant unmitigatedconsequences.

NNR Response
At present, there is no regulatory requirement for
dropping of heavy equipment to consider for beyond
design basis.

Combining correlated, consequential and independent
hazards (i.e. on a frequency basis, and positively andnegatively related external hazards)?

Ensuring conservatism in the analysis and the various
sources of uncertainties (e.g. assumptions, design
information or analytical model)?

Hazards should be identified in terms of their severity andfrequency of occurrence and characterised as having
either a discrete frequency of occurrence (discrete
hazards), or a continuous frequency-severity relation (nondiscrete hazards). All hazards should be treated as
initiating events in the fault analysis.

Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.

The identification process should include reasonably
foreseeable combinations of independently occurring
hazards, causally-related hazards and consequential
events resulting from a common initiating event.

The process for identification and quantification of hazard
combinations for beyond design basis?
See Comments in HEPF section.
Ensuring conservatism in the analysis and the various
sources of uncertainties (e.g. assumptions, design
information or analytical model)?
Analysis of design basis fault sequences should use
appropriate tools and techniques, and be performed ona conservative basis (as defined in the methodology
section above) to demonstrate that consequences are
ALARP.
The fault sequence analysis should demonstrate, so far as
is reasonably practicable, that the correct performanceof the claimed passive and active safety systems
ensures that:a) None of the physical barriers to prevent the escape or
relocation of a significant quantity of radioactive material
is breached or, if any are, then at least one barrier
remains intact and without a threat to its integrity;b) There is no release of radioactivity; andc) No person receives a significant dose of radiation.
In addition to the inclusion of conservative assumptions, it
should be demonstrated that a small change in a DBA

31

ARN ResponseTechnical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response

ONR Response
parameter will not lead to a disproportionate increase inradiological consequences, ie there should be no cliffedge effect. The severity and frequency of the initiating
event should be amongst the parameters considered.
The aim is to be conservative without being overly
pessimistic.

NNR Response

ARN Response

The use of probabilistic analysis?
ONR expects that the analysis should apply anappropriate combination of engineering, deterministic
and probabilistic methods in order to:Internal
missilesUnderstand the behaviour of the facility in responseto the hazard; andConfirm high confidence in the adequacy of thedesign basis definition and the associated fault
tolerance of the facility.

Missiles analysis (such as from valves and turbine
disintegration) How is the scope of hazards analysis
defined?

Missiles analysis (such as from valves and turbine
disintegration) How is the scope of hazards analysis
defined?

Missiles analysis (such as from valves and turbine
disintegration) How is the scope of hazards analysis
defined?

Missiles analysis (such as from valves and turbine
disintegration) How is the scope of hazards analysis
defined?

（HAD102/04，SRP3.5.1.1）

ONR expectations for missile analysis include:

The following text from Section 5 of NNR Draft Specific
Nuclear Safety Regulations: Nuclear Facilities mentions
missile generation:“(2) Internal and external hazards…
(c) The design of a facility shall take due account ofinternal hazards such as fire, explosion, flooding, missile
generation, collapse of structures and falling objects,
pipe whip, jet impact and release of fluid from failed
systems or from other facilities on the site. Appropriate
features for prevention and mitigation shall be provided
to ensure that safety is not compromised.”

ARN’s expectations are aligned with IAEA:
Sources of possible missiles should be identified,included but not limited to:
Valves in fluid systems that operate at highinternal energy should be evaluated as
potential sources of missiles
Failure of high speed rotating equipment
include:(a) Fan blades;(b) Turbine disc fragments or blades;(c) Pump impellers;(d) Flanges;(e) Coupling bolts.
- Failure of pressure vessels

a. Missiles from component over speed failures;
b. Missiles generating from high energy fluid system failures;c. Missiles caused by or as a consequence of gravitational
effects. (managed in dropped load)
Are there any exclusions and what is the reason?
a. The probability of generating missiles is small enough tobe accepted without considering the consequences.
b. Although the probability of generating missiles is slightly
higher, the comprehensive consequences can be
accepted from the view of safety.
Through using the appropriate design standards,
specification of materials and equipment, carrying out
strict quality assurance requirements, quality control
inspection
duringmanufacture,operation
andmaintenance, equipment and components apply nuclear
related standards (e.g., RCC-M 1,2,3,or ASME 1,2,3),
probability of occurrence of internal missiles can be
exclude from the creditable missile source list.
What are the regulatory expectations for:The methodologies used in the deterministic analysis byvendors?











All possible internal missiles sources should be
identified: from pressurised vessels, pipework andcomponents, rotating machinery and systems whichcontain explosive mixtures.
All assumptions should be made explicit. The
consequences depend on key assumptions made in
the evaluation of the missile energy such as size andgeometry of the fragments ejected, the trajectory of
the missiles and any credited loss of energy throughinteraction with equipment or structures (e.g. rotatingmachinery casing, walls).
Trajectory of missiles is subject to high levels of
uncertainty as a result of the uncertainty inherent to
the missile fragment formation, therefore appropriate
sensitivity analysis should be undertaken to
demonstrate there are no cliff edge effects.
Bounding arguments should be presented e.g.
consider that damage from internal missiles may
occur in any direction from the source / loss of SSCs in
the same location.
Probabilistic arguments alone are not accepted to
exclude assessment of missile sources or impacts/
strike on SSCs or nuclear safety significant plant.

Failure conservatively postulated e.g. disk ruptures toresult in several fragments which would impact

32



The frequency, the possible magnitude ofkinetic energy and the likely size and trajectoryof missiles should be estimated. The possible
targets and their effects on items important tosafety should be assessed.

Are there any exclusions and what is the reason?
Are there any exclusions and what is the reason?
See comments in Drop load section above.

ONR expectations for Turbine disintegration:
For further guidance, the NNR considers that therecommendations of the following IAEA publication
address the hazard of internal missiles as a result ofinternally initiated events:
The section on internal missiles starting at para. 4.78 of
IAEA SSG-64 “Protection against Internal Hazards in the
Design of Nuclear Power Plants”.

ARN does not have any criteria for exclusions. It is
up to the applicant to justify exclusions fromassessment.

What are the regulatory expectations for:
What are the regulatory expectations for:

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response
NNSA focuses on the adequate protections from missiles,and do not specify a detailed analysis methodology. Since
the methodologies used in the deterministic analysis byvendors are not the same, NNSA require vendor
demonstrate the methodologies are reasonable andfeasible.
The assessment of internal missiles mainly includes thefollowing steps:Data collection: the missile sources are identified
according to the screening criteria mentioned
above.

Consequence analysis: Impact on the delivery offundamental safety functions after internal missile isperformed comprehensively.
If the consequence is not acceptable, the safetymeasures will be applied, such as enhancement thebuilding structure or modifying the layout, etc.
The process for identification, screening and quantificationof credible bounding events (including credible combined
hazards) within the DBA?
A full range of screening is conducted according to theabove mentioned scope of hazards analysis defined.
Quantitative analysis is conducted if the two exclusion
requirements are not met.
Combining correlated, consequential and independent
hazards (i.e. on a frequency basis, and positively andnegatively related external hazards)?
N/A
The process for identification and quantification of hazard
combinations for beyond design basis?







ONR Response
adjacent disks resulting in a number of missiles
ejected from the turbine cases. Both high and low
trajectory missiles should be postulated.
The number and velocity of turbine missile fragments
ejected is specific to the design and fabrication of
the specific turbine under consideration.
A probabilistic argument alone e.g. to support
unfavourable layouts and lack of design provision
against turbine disintegration is not acceptable andrisk should be demonstrated to be ALARP.
ONR expects consideration of impact angles wider
than 25° generally assumed.
Demonstration that the design provides sufficient
redundant equipment that will survive a turbine
disintegration to deliver the Fundamental Safety
Functions.

Are there any exclusions and what is the reason?

ARN Response
The methodologies used in the deterministic
analysis by vendors?

Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.

ARN does not specify a detailed analysis
methodology.

The process for identification, screening andquantification of credible bounding events (including
credible combined hazards) within the DBA?
Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.
Combining correlated, consequential and independent
hazards (i.e. on a frequency basis, and positively andnegatively related external hazards)?

There are no exclusions from assessment.
Combining correlated, consequential and independent
hazards (i.e. on a frequency basis, and positively andnegatively related external hazards)?
See comments in Drop load section above.

Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.

The process for identification and quantification of hazard
combinations for beyond design basis?

The process for identification and quantification of hazard
combinations for beyond design basis?
See Comments in HEPF section.

Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.

Ensuring conservatism in the analysis and the various
sources of uncertainties (e.g. assumptions, design
information or analytical model)?

Ensuring conservatism in the analysis and the various
sources of uncertainties (e.g. assumptions, design
information or analytical model)?

See comments in Drop load section above.
The use of probabilistic analysis?

Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.

See comments in Drop load section above.

The use of probabilistic analysis?

N/A
Ensuring conservatism in the analysis and the various
sources of uncertainties (e.g. assumptions, design
information or analytical model)?

NNR Response
The methodologies used in the deterministic analysis byvendors?

Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.

Screening range of the missile sources is broad enough tocover all possibilities. Conservatism exists in thecalculation of missile characteristic parameters, and in theempirical formulas of shield design. In conclusion, there
are considerations of conservative margin and reducing
uncertainty at every stage of the design.
The use of probabilistic analysis?

33

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response
Probabilistic analysis is mainly used for turbine missiles.

Combinedhazards inareas ofhigh risk (e.g.
highestintegrity
components
and areas
with nosegregation)

What are the regulatory expectations for: themethodologies used in the deterministic analysis byvendors?

What are the regulatory expectations for: themethodologies used in the deterministic analysis byvendors?

What are the regulatory expectations for: themethodologies used in the deterministic analysis byvendors?

What are the regulatory expectations for: themethodologies used in the deterministic analysis byvendors?

Combinations of events and failures (HAF102-2016)

ONR expects demonstration that SSCs with highest
reliability claims are not challenged by internal hazards.
These are items for which failure cannot be conceded in
the design due to highly undesirable consequences andtherefore require highly robust materials and care in thedesign, fabrication and inspection. This is expected as per
ONR SAP. EMC.3 Evidence should be provided todemonstrate that the necessary level of integrity has beenachieved for the most demanding situations identified in
the safety case.

Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.

ARN does not prescribe a specific methodology,
however should be carried out on a conservativebasis.

The process for identification, screening andquantification of credible bounding events (including
credible combined hazards) within the DBA?
Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.

It is expected that for each identified hazard
combination sequence, the analysis should also
take into consideration any deterioration ordamage to SSCs important to safety and hazard
barriers after being subjected to each of thevarious hazards.

A highest reliability claim is an onerous route to a safetycase because the low failure frequency expected goesbeyond what may be inferred from the actuarial statistics
relating to the failure frequencies for the gross failure ofpressure vessels and piping designed and constructed tohigh standards.

Combining correlated, consequential and independent
hazards (i.e. on a frequency basis, and positively andnegatively related external hazards)?

The process for identification, screening andquantification of credible bounding events(including credible combined hazards) within the
DBA?
ARN expects a performance-based approach be
implemented. This approach should becomprehensive and systematic.

5.32. Where the results of engineering judgement,
deterministic safety assessments and probabilistic safetyassessments indicate that combinations of events could
lead to anticipated operational occurrences or to
accident conditions, such combinations of events shallbe considered to be design basis accidents or shall be
included as part of design extension conditions,depending mainly on their likelihood of occurrence.
Certain events might be consequences of other events,
such as a flood following an earthquake. Suchconsequential effects shall be considered to be part ofthe original postulated initiating event. No specificregulatory expectations for methodology of combined
hazards.
The design details are as follows：
HPR1000: Special methodology of combined hazards has
not been published in HPR1000. But in HPR1000 design,
some combined hazards have been considered, such as
the flooding caused by the fire.
The process for identification, screening andquantification of credible bounding events (including
credible combined hazards) within the DBA?
Screen of external hazards
Effect of external hazards on plant to be evaluated on thescale of hazards, frequency of occurrence and distancefrom the plant; Hazards to be selected based on thescreen distance value /frequency of occurrence; designbasis to be defined for the remaining hazards after
screening taking into account of the impact on the
structure of plant；
In the NNSA Guide HAD102/17, the following requirements
are set for the “hazards combination” and “loadcombination”.

ONR Response

NNR Response

ONR therefore expects a demonstration of integrity basedon sound engineering provision with measures over andabove normal practice defined in nuclear codes andstandards. Taken together these measures provide
conceptual defence-in-depth. In addition, thesestructures and components need to be monitored,
inspected and maintained through-life to maintainconfidence that gross failure can be discounted.
The analysis of HIC components should include:

A comprehensive and systematic hazard
identification process covering internal hazards which
may challenge HICs, considering those hazards
individually and also in combination withconsequential, concurrent or independent hazards
and/or faults which may arise.
o Consequential Hazards: The consequencesof an internal hazard induce one or more
additional hazards – e.g. an exploding gas
bottle generating fragmentation and fire.
o Concurrent Hazards: A common initiating
event (including external hazards) results in
multiple internal hazard(s) occurring – e.g.
seismic event leading to both fire and flood
challenges.
o Independent Hazards: Non-casually linked.
An initiating event (including hazards) occurs
independently from, but simultaneously withan internal hazard, e.g., a fire on a standby
diesel when responding to a plant-trip

34

Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.
The process for identification and quantification of
hazard combinations for beyond design basis?
Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.
Ensuring conservatism in the analysis and the various
sources of uncertainties (e.g. assumptions, design
information or analytical model)?
Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.
The use of probabilistic analysis?
Similar principles are expected to be adhered to as
mentioned in the response to the same question in thesection above on high energy pressure failure.

ARN Response

In principle, three types of hazard combinations
could be considered:(1) Consequential (subsequent) events: An initial
event results in another consequential event, e.g.
an internal hazard.
(2) Correlated events: Two or more events, at least
one of them representing an internal hazard, which
occur as a result of a common cause. The
common cause can be any anticipated event
including an external hazard, or may be from anunanticipateddependency.
(3) Unrelated (independent) events: An initial event
occurs independently from (but simultaneouslywith) an internal hazard without any common
cause.
Screening criteria should be developed to ensurethat the list represents a credible and reasonable
set of plant challenges. The screening criteria canbe deterministic or probabilistic. Screening criteria
may include the following:(a) The event combination is not credible;(b) The event combination, even if credible, would
not lead to conditions beyond what has alreadybeen assumed in the design.

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response
The design basis should take account for a combinationof extreme weather conditions that can reasonably be
assumed to occur simultaneously
External flooding: The surrounding environment of thenuclear power plant should be evaluated to determine
the likelihood of external flooding that would
compromise the safety of the nuclear power plant.
External flooding should include flooding due to highrainfall, high tides, river overflow, dam collapse, andpossible combinations.



Nuclear safety related structures and components should
be designed to withstand all associated loads caused byoperational conditions and design basis accidents,
including internal and external hazards.
HPR1000
Some of the combined hazards are identified andcalculated according to detailed system and layout
design. The consequence of some combined hazards has
been evaluated. For example, the internal flooding
induced by internal fire and earthquake has been
identified and evaluated.

Combining correlated, consequential and independent
hazards (i.e. on a frequency basis, and positively andnegatively related external hazards)?

Regulatory expectations for types of combined hazards
can refer to the previous description.
The design details are as follows：Independent hazards



combinations are considered in the design of structuresand buildings in HPR1000 to protect against the external
hazards.
Independent internal hazards are not considered to occur
at the same time.
The process for identification and quantification of hazard
combinations for beyond design basis?
The design details are as follows:
Internal hazards
Conservative design and high-quality construction must be
adopted to ensure that nuclear power plant failures anddeviations from normal operation are minimised, to ensure
accident prevention as far as practicable, and to ensurethat there is no cliff edge effect in NPPS. （HAF102-2016）






ONR Response
caused by a weather-related loss of heatsink event.
A deterministic analysis of all credible hazard
combination should be undertaken, demonstratingthat the severity of hazard consequences as a resultof unmitigated consequence under the worst-case
operational states have been used to define theappropriate design and engineering provisions for the
HIC component and demonstration of HIC withstandunder these hazard conditions.
The analysis should be carried out on a conservativebasis and the unmitigated consequences should be
evaluated.
o Detailed knowledge of the site layout andthe plant is required:o Location of plant equipment;o Location of items important to safety;o Redundancy, diversity and reliability
requirements of the items important tosafety.
The analysis should not only focus on the number ofmost combined events present, in a given plant area,
but also on their severity.
Appropriate modelling of all combined hazards
should be undertaken and the impact loads,
duration and sequence should be determined.
The sequence and timeline of individual events (e.g.
fire causing pipe whip, missile, steam or flood) is
important in determining whether simultaneous loads
may occur, and the barrier response to the
combined hazard loading.
A robust demonstration of physical defence-in-depth
in the plant design. Demonstration of optimisation ofplant layout and identification of safety systems toeliminate, mitigate the hazard loads on the HIC
component.
Demonstration of additional measures beyond
normal practice defined in codes and standards thatwill underpin highest reliability claims for SSCs.
Demonstration of conservative assumptions in thehazard analysis.
Sensitivity analysis and assessment of cliff edge
effects.
Demonstration of HIC qualification
Application of appropriate standards, codes andanalysis tools.

The process for identification, screening andquantification of credible bounding events (including
credible combined hazards) within the DBA?
See HEPF section description of ONR expectation on
deterministic screening and probabilistic screening.
Key considerations in addition to the above:

35

NNR Response

ARN Response
Following screening, some hazard combinations
could be determined to be credible but need to
be assessed against specific acceptance criteria.
Combining correlated, consequential andindependent hazards (i.e. on a frequency basis,and positively and negatively related external
hazards)?
See previous answer.
The process for identification and quantification of
hazard combinations for beyond design basis?
For ARN, it is not feasible to identify a priori a set ofhazard combinations that should be required forbeyond design basis.
A set of DECs should be derived and justified as
representative, based on a combination ofdeterministic and probabilistic assessments as wellas engineering judgement.
Ensuring conservatism in the analysis and thevarious sources of uncertainties (e.g. assumptions,design information or analytical model)?
Conservative analysis using either an appropriate
and verified computer model or a simplified
approximation on the basis of experimental data,or other appropriate and justified conservative
assumptions
The use of probabilistic analysis?
ARN expects deterministic and probabilistic
assessments as well as engineering judgement.

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response
External hazards
a. Considering lessons learnt from Fukushima accident,
DBF combined with precipitation of 1000 year occurrence
is applied to evaluate the external flooding.
Ensuring conservatism in the analysis and the various
sources of uncertainties (e.g. assumptions, design
information or analytical model)?
For the combined hazards considered as the design basis
event, the conservative method is considered, as well as
the uncertainties, such as the definition of the design basis
flood.
For the combined hazards considered as the beyond
design basis event, the realistic method is adopted for the
analysis.
The use of probabilistic analysis?
Engineering judgement, deterministic safety assessments
and probabilistic safety assessments are considered forthe combined protection design.



ONR Response
The duration of the hazards when considering thepossibility of other hazards during this period.
The duration of consequential effects on plant.
The time it would take to introduce alternativeequipment to take over the long-term provision ofsafety functions.

NNR Response

The mission times - the time that the safety systems willneed to operate should be specified based on theconsequences of the event and not just the duration of
the hazards themselves
Combining correlated, consequential and independent
hazards (i.e. on a frequency basis, and positively andnegatively related external hazards)?
See comments in Drop load section above.
The process for identification and quantification of hazard
combinations for beyond design basis?
See Comments in HEPF section.
Ensuring conservatism in the analysis and the various
sources of uncertainties (e.g. assumptions, design
information or analytical model)?
See comments in Drop load section above.
The use of probabilistic analysis?

Multi-hazard
barriers

What are the regulatory expectations in the assessment
and substantiation of multi-hazards barriers (internal andexternal) and penetrations?

See comments in Drop load section above.
What are the regulatory expectations in the assessment
and substantiation of multi-hazards barriers (internal andexternal) and penetrations?

Relevant safety classified structures and components
should be designed to withstand all relevant loading
resulting from operational states and design basis
accidents including those resulting from internal andexternal hazards. （NS-G-1.2）

Civil barriers are a key claim in internal hazards safetycases. ONR expectations required that the Civil barrier isadequately designed to protect against a number ofcredible internal hazards individually and in combination(combined hazards).

The design details are as follows：

Substantiation of barriers provides the requisite evidence
for the claim made on barriers, in general:

HPR1000
For HPR1000, as some general design principles, the designof safety classified structures and components considered
the internal and external effects. For example, thecontainment of Reactor Building and safety classified






All barriers should be identified and listed in thehazard schedule.
All loads should be characterised.
All design codes and analytical methods should bemade explicit.
All acceptance criteria and margins of safety should
be stated.

36

What are the regulatory expectations in the assessment
and substantiation of multi-hazards barriers (internal andexternal) and penetrations?
For each identified hazard combination sequence, theanalysis should consider any deterioration or damage to
SSCs important to safety (including hazard barriers) after
being subjected to each of the various hazards. For
example, for a pipe failure that leads to a missile and asubsequent flood, the analysis of the capability of ahazard barrier to withstand the hydrostatic loads fromflooding will need to take account of any damage
caused by successive or simultaneous hazards (e.g. thefailure of pressurised parts, which could lead to pipe
whip, jets, and steam pressure effects on barriers or other
SSCs important to safety).
See also responses in the section on “Expectations onlayout” below.

ARN ResponseTechnical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response
valves used in DBC can understand the pressure andtemperature induced by steam release.
What are the regulatory expectations on layout design
against internal hazards, including for those areas of thedesign where full segregation of systems, structures andcomponents is not feasible?



ONR Response
The assessment of multi-hazard barriers is a multidiscipline effort between internal hazards and civilengineering.

Substantiation of Multi-Hazards Barriers – Combined
Hazards should consider:The reply can refer to topic #8.








The sequencing, duration and timing of individualloads can be critical to the combined effects andmay play a part in the engineering substantiation ofmulti-hazard barriers.
Assumptions on timing and duration should be basedon robust consequence assessment, the layout of theplant in question, and the qualification and provenperformance of the SSCs under the conditions of thehazard.
Should take into consideration any deterioration ordamage to safety related SSCs after being subjectedto each of the various consequences to determine its
overall performance.
Alternatively and conservatively an assumption canbe made that all loads apply at the same time, but
this may lead to over design.
All penetrations on divisional barriers should be
identified and minimised where possible. Theirlocation should also be optimised.
Penetration design guidelines and rules should bemade available.
oVentilation dampers on divisional barriers shouldbe generally avoided. If included, dampers oneither side of divisional barriers should be
included in line with UK regulatory expectations.
oSingle doors on divisional barriers should be
generally avoided. If included, the single doors
are required to withstand all relevant internal
hazard loadings equivalent to those of the Class
1 barriers. An appropriate monitoring system, ofappropriate classification, should be also
included. Lobby configurations (doors in series
for defence-in-depth) are likely to be reasonably
practicable.

What are the regulatory expectations on layout design
against internal hazards, including for those areas of thedesign where full segregation of systems, structures andcomponents is not feasible?
The design and layout of the site, its facilities (including
enclosed plant), support facilities and services should besuch that the effects of faults and accidents are
eliminated or minimised. The design layout should:

minimise the direct effects of initiating events,
particularly from internal and external hazards, on
structures, systems or components;

37

NNR Response
What are the regulatory expectations on layout design
against internal hazards, including for those areas of thedesign where full segregation of systems, structures andcomponents is not feasible?
See responses in the section on “Expectations on layout”
below.

ARN ResponseTechnical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA ResponseONR Response
not compromise the safety of the site, or its facilities,
structures, systems and components;
minimise any interactions between a failed structure,system or component and other structures, systems orcomponents;
ensure that site personnel are physically protectedfrom direct and indirect effects of faults; andfacilitate access for necessary recovery actions andre-supply of essential stocks, materials, equipment
and personnel following an accident.

NNR Response

ARN Response

Essential services and support facilities important to thesafe operation and/or safe shutdown of the facility should
be designed and routed so that, in the event of a fault or
accident, sufficient capability to perform their safetyfunctions will remain. Support facilities and services
include access roads, water supplies, fire mains, flood
defences and drainage, essential services and site
communications.
Also See guidance in layout section Below.
Expectations
on layout

What are the regulatory expectations in the assessment
and substantiation of multi-hazards barriers (internal andexternal) and penetrations?

What are the regulatory expectations in the assessment
and substantiation of multi-hazards barriers (internal andexternal) and penetrations?

What are the regulatory expectations in the assessment
and substantiation of multi-hazards barriers (internal andexternal) and penetrations?

What are the regulatory expectations in theassessment and substantiation of multi-hazards
barriers (internal and external) and penetrations?

The reply can refer to topic #7.

See relevant section above.

What are the regulatory expectations on layout design
against internal hazards, including for those areas of thedesign where full segregation of systems, structures andcomponents is not feasible?

What are the regulatory expectations on layout design
against internal hazards, including for those areas of thedesign where full segregation of systems, structures andcomponents is not feasible?

The design shall be such as to ensure that items
important to nuclear safety are capable of withstanding
the effects of internal and external events considered in
the design, and if not, other features such as passive
barriers shall be provided to protect the facility and toensure that the required safety function will be
performed.

ARN expectation includes the separation andprotection of safety divisions as well as forpenetrations and openings in the boundaries ofsafety divisions.

Regulatory expectations for combined hazards：

In addition to the relevant sections above:

HPR1000
Redundant trains should be separated by barriers or
distance in order to ensure that an internal hazard cannot
lead to the loss of more than one train.
（NS-G-1.2）
The design details are as follows：
HPR1000
HPR1000 adopted the same general requirements. Internal
hazards have been taken into account in the generalarrangement so as to ensure the delivery of safetyfunctions in the event of internal Hazards. Priority should begiven to passive barriers, such as the safeguard building
and the SEC pumping station, which are segregation areas
to protect the effects of internal hazards from impacting

ONR requires demonstration of the adoption of inherently
safe design and hazard / fault tolerant options fromconcept design stages, so far as is reasonably
practicable. This can lead to:A simpler and more robust set of “hazard
informed” layout decisions,
Increased “hazard robustness” – in particular the
adoption of simple solutions such as “massive
and passive” barriers with a reduced number ofpenetrations though primary hazard barriers,
Avoidance of more complex and potentially lessrobust safety cases.
ONR expects Nuclear plants to show hazard resiliencee.g. layout optimisation and segregation of redundantand diverse safety systems by robust passive barriers towithstand the maximum credible loadings.

38

For the currently operating plant, US NRC regulations
concerning containment isolation and penetrations are
the following:

•






General Design Criteria 10 CFR 50 Appendix A
No. 54: Piping systems penetrating
containment,
No. 55: Reactor coolant pressure boundary
penetrating,Containment,
No. 56: Primary containment isolation,
No. 57: Closed system isolation valves,(Justified exceptions to compliance with these
GDCs are penetrations of the containmenthydrogen monitoring system, penetrations forcontainment radioactivity measurement, lowhead safety injection and containment spraysystem recirculation line penetrations, etc.),

Some of these expectations are the following:In rooms where safety divisions cannot be
constructed as separate compartments, theyshall be separated by partly separating
structures or by distance. The methods ofseparation to be used in these cases shall take
into account the defence-in-depth concept offire protection and they shall be justified byanalyses. Examples of such cases include thecontainment as well as the control room andthe cable spaces below it.

The functional need for doors, hatches andpenetrations in structures between safety
divisions shall be justified, and they shall be
designed to fulfil the leak-tightness, pressure
resistance, fire resistance and otherenvironmental requirements set for structures
between safety divisions.

The number of doors, hatches andpenetrations shall be kept to a minimum
between a safety division and any othercompartment containing heavy fire loads or
substantial flood sources. The functional need

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Responsethe delivery of safety function. The structure considers the
combination of loads from different kinds of external
hazards.
The general plant layout also preferentially adopts
geographic separation, physical separation or a
combination thereof between safety related or nonsafety related systems to preclude adverse interaction
between safety related and non-safety related systems.
The consideration for Reactor Building:
The three primary loops are arranged within the internal
containment and enclosed by the secondary shielding
walls. Inside the secondary shielding walls, each loop is
separated from the others by massive walls. Between theinternal containment and the secondary shielding walls isannular space for personnel access. Different safety trainsare generally arranged in it by spatial separation. But it still
have some exception to segregation areas in Reactor
Building, which hazards safety assessments are carried out
to demonstrate that hazard effects will not lead to
unacceptable consequences

ONR Response
Approaches based entirely on separation by distance oron SSCs qualification may be challenging to substantiate
in the absence of suitable segregation. ONR expects that
all areas where exception to segregation exists should be
identified and assessed and an ALARP demonstration
provided.
A safety case should provide analysis to demonstrate therisks have been reduced to ALARP for the perspectives of:•••Normal operation,
Potential faults and accidents,
Engineering design.

ALARP requires the demonstration of:Everything ‘reasonably practicable’ has been done
to reduce risks - [i.e. all credible hazards andcombinations of have either been prevented or theseverity of the hazard loading and associatednuclear Consequences are sufficiently limited].
An adequate balance is maintained between thelevel of risk and the measures required to control therisk in terms of money, time or trouble.
Where action is not taken the safety case need todemonstrate that those measures would be grossly
disproportionate to the level of risk averted.

NNR Response
Regulatory Guide No. 1-11: Instrumentation
pipe penetrations.

Piping penetrating the containment walls shall be
provided with either permanent leak tight closure
devices, or remote-controlled closing devices.

In a broader approach ARN expects that theapplicant demonstrates the adoption of an
inherent safe design.

Penetrations for these pipes and penetrations provided
in the containment to allow the passage of cables,
wiring, equipment, and personnel, and more generally,
any discontinuity in containment leak-tightness devices,shall, as far as necessary, be designed so that their leaktightness may be examined independently from thecontainment leak-tightness tests; the appropriate leaktightness test shall be performed at containment designpressure.

What are the regulatory expectations on layout
design against internal hazards, including for thoseareas of the design where full segregation ofsystems, structures and components is not feasible?

Containment leak-tightness between the outside andinside atmosphere is provided by:
Welds of sleeves to the containment liner,Outside surfaces of the sleeves inside thecontainment and the welds between theadapters, sleeves and pipes,
Surfaces of the sleeves outside the containment
in the case of main steam and feedwater lines,Surfaces of the sleeves outside and inside thecontainment, in the case of containment
sweeping ventilation system (for which thesleeves form part of the process pipes)
penetrations.
The sleeves and adapters are designed to support theloads resulting from a pipe break.
For the currently operating plant, all supports for piping
crossing through the containment wall are designed toabsorb loads resulting from pipe failures without inducing
large scale stresses on the penetration. Moreover, piping
supports are designed in such a way that no additional
penetration loads are induced, even in the event of
LOCA or earthquake. On the other hand, penetrations
are designed to withstand the loads induced by piping(in the event of a LOCA), should the pipe supports beunable to support such loads.
What are the regulatory expectations on layout design
against internal hazards, including for those areas of thedesign where full segregation of systems, structures andcomponents is not feasible?
One example of a practice is as follows: When it is
impossible to install a concrete barrier to protect safety

39

ARN Response
for these doors, hatches and penetrations shallbe justified.

The aim of considering internal hazards in thedesign of nuclear power plants is to ensure that thefundamental safety functions are fulfilled in any
plant state and that the plant can be brought toand maintained in a safe shutdown state after any
internal hazard occurrence. This implies that:(a) The redundancies of the systems aresegregated to the extent possible or adequately
separated, and protected as necessary to preventthe loss of the safety function performed by thesystems;(b) The design of individual structures, systems andcomponents (SSCs) is such that design basis
accidents or design extension conditions induced
by internal hazards are avoided to the extent
practicable;(c) The implemented segregation, separation andprotection are adequate to ensure that themodelling of the system response described in theanalysis of PIEs is not compromised by the effects of
the internal hazard;(d) The design is such that an internal hazard does
not lead to a common cause failure between
safety systems designed to control design basis
accidents, and safety features required in theevent of accidents with core melting;(e) An internal hazard occurring elsewhere in theplant does not affect the habitability of the main
control room. In case the latter is not habitable,
access to the supplementary control room is to beensured. In addition and when necessary, accessby plant personnel to equipment in order toperform local actions is also to be possible.
The layout design should be such that the fulfilmentof the above mentioned objectives can beachieved.

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response

ONR Response

NNR Response
important SSCs against pipe break impact, anti-whip
devices are employed.
More generally, based on p.57 of IAEA -TECDOC-1791:
Physical separation of redundant trains andcomponents is efficient against CCFs and otherdependent failures originated by harsh environmental
conditions and the effects of several hazards, as well as
the direct impact of mechanical or electrical failures of
one train on the redundant train.

ARN Response
The expected measures include physicalseparation that can be accomplished either by full
separations of trains through qualified barriers, theinstallation of protections on one train’s relevant
equipment and theseparation by sufficient distance. The first option
gives in general the highest protection. When full
separation is not feasible, justification andassessment of a “robust” alternative solution must
be done.

Earthquakes, fires and floods among other hazards havethe potential to fail or degrade the condition of many
plant SSCs at once. Moreover some of these hazards
can induce other hazards as it happened in the
Fukushima accident. Physical separation, adequate
plant layout and design robustness are at the core of
the defensive measures to reduce the impact ofhazards, in addition to adequate safety margins andprotective measures as well as good operational
practices.
Of particular importance is the adequate separation ofcable routings of different electrical and instrumentation
divisions. A full physical separation of trains might not be
feasible in all plant areas. Physical separation can beaccomplished either by full separations of trains throughqualified barriers, the installation of protections on one
train’s relevant equipment and the separation by
sufficient distance. The first option gives in general thehighest protection.
Firemodelling(including
validation &verification)

What are the regulatory expectations for analyticalmodelling code validation?

What are the regulatory expectations for analyticalmodelling code validation?

What are the regulatory expectations for analyticalmodelling code validation?

Empirical curve method is widely used in fire hazard
analysis of nuclear power plants in China. Someapplicants are exploring the application of numericalsimulation method. If the fire analysis software is used in
the project, the applicability of the software inengineering should be evaluated.

It is ONRs expectation that a modern standards safetycase should demonstrate that analysis undertaken in thedesign base assessment of nuclear safety is relevant,conservative, complete and tolerant to uncertainty.
Hazard analysis should be conducted on a deterministic
basis, ensuring that all credible hazards (including
combination of hazards) are identified, their severity
determined and affects to nuclear safety related
structures, systems and components assessed.

According to Section 8.7 of NNR RG-0019 “Interim
Guidance on Safety Assessments of Nuclear Facilities”,
the applicant should demonstrate that there isreasonable assurance that the applicant designed afacility that provides for "adequate protection against
fires and explosions" and is based on defense-in-depth
practices. This should also establish that the radiologicalconsequence from fires is considered in determining
how the facility will meet the fundamental safety
requirements.
Amongst others, Section 8.7 lists fire protection featuresand systems that should be used. As such, they [as wellas elements from the latest guidance from IAEA SSG-64“Protection against Internal Hazards in the Design of

For all safety case hazard analysis, the safety case shouldpresent a clear auditable trial of documentation tounderpin the conclusions drawn from the modelling
analysis. This should include (but not limited to):40

What are the regulatory expectations for analyticalmodelling code validation?
The fire hazard analysis should be developed on adeterministic basis, with the following assumptions:(a) A fire is postulated wherever fixed or transientcombustible material could be present;(b) Only one fire is postulated to occur at any one
time; consequential fire spread should beconsidered as part of this single event, if necessary;(c) The fire is postulated whatever the normal
operating status of the plant, whether at power or
during shutdown.
The fire hazard analysis should take into accountany credible combinations of fire and other events.
Fire hazard analysis should be complemented byfire probabilistic safety analysis (Fire PSA). PSA isTechnical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response

ONR Response








Justification that the analysis is representative of
the scenario to be applied.
Both global and local effects should be
evaluated.
Justification of the modelling methods used anddemonstration that the analysis is within themodels valid ranges.
Justification that the data used is valid for its
application and verified.
Description of all the uncertainties of the modeland data.
User guidelines, relevant good practice and input
description.
Sensitivity studies to determine the sensitivity of
the analysis (and the conclusions drawn from it)to the assumptions made, the data used and themethods of calculation.

The safety case should demonstrate that all analyticalmodels are adequately validated (i.e. the correct
analytical model is used for the scenario being assessed)
for each application within the safety analysis.
The validation should be of the model as a whole and for
those individual dominant phenomena (as identified forexample by the phenomena identification and ranking
table (PIRT) method), where this is not practicable, a
modular approach can be adopted (if multiple analyticalmodels are being used). Validation of the models shouldbe against experiments that replicate as closely as
possible the expected plant condition.

Are analytical modelling codes formally approved by theRegulator?
China's Regulator have not yet carried out thecertification and evaluation of fire analysis software

Does the Regulator maintain and use an independent setof analytical modelling codes?

Where more complex analysis is required, computermodels such as computational fluid dynamics (CFD) areoften used. These computer models allow the solving ofmultiple analytical models and thus are far more
complex. As a result it is essential that the analyst
understands the valid range of the computer model andthey have assurances that the model itself has been
through a robust verification and validation regime in linewith relevant good practice and is adequately
documented.
Are analytical modelling codes formally approved by theRegulator?
ONR doesn’t prescribe, maintain or frequently use
analytical fire models.
Does the Regulator maintain and use an independent setof analytical modelling codes?

41

NNR Response
Nuclear Power Plants” on Internal fires (4.1–4.59)] might
be expected to feature in fire modelling.
Item 2) d) of Section 8.7 states:“The Fire Hazards Analysis consists of a systematic
analysis of the fire hazards, an identification of specificareas and systems important to plant fire safety, thedevelopment of design basis fire scenarios, anevaluation of anticipated consequences, and adetermination of the adequacy of plant fire safety.”
The validation aspects of analytical fire modelling codeare governed by the following general guidance onsafety analysis validation:
From Section 7.3 of NNR RG-0019 “Interim Guidance on
Safety Assessments of Nuclear Facilities”:‘7.3.8 Safety Analysis Methodology and Validation
1) The safety analysis methodology relevant to thesafety analyses for each licensing stage should be
described in detail along with those of the calculation
codes and models used and their validation thereof.
2) It is important that the methodology to be used forany computational analyses should be specified andjustified in terms of the overall approach to be adopted,
computer codes used, benchmarking, development ofmodels, and standards. As the review of these aspects
may be time-consuming, it is preferable that these be
addressed in the preconstruction SAR.

ARN Response
used to support decision making in thedeterministic design of plant layout and fire
protection systems.
ARN understand that validation entails acomparison of the software model results to actual
test or physical data through scientific assessment
and benchmarking against other models.
Benchmarking involves comparing the output of
one software code with the output of similar code,or the results of a hand calculation or spreadsheetthat serves as a baseline. This type of comparison
does not necessarily constitute validation, but has
merit as part of a validation procedure to theextent the baseline model is generally accepted asa reasonably accurate predictor for thephenomena of interest. Benchmarking can also
provide insight into model limits of applicability,
computing expense, input requirements, andimportant sensitivities or uncertainties. Ideally,
computer code results should be comparedagainst experimental results that were obtained inenvironments that mimic those to which the model
will be applied. However, this type of data is
generally very limited.
It is an applicant responsibility to justify how theused code was validated and the adequacy ofthe model.
Are analytical modelling codes formally approvedby the Regulator?
ARN does not approve the modelling codes,
instead review and assess the submission.

3) In the case of safety analyses previously performed inanother country in accordance with the nuclear
regulatory requirements of that country, the relevant
regulatory approval letter(s), along with confirmation of
the present regulatory status, provide strong supporting
evidence for local acceptability.

Does the Regulator maintain and use an
independent set of analytical modelling codes?

4) Where this is not available, or the analysis differs
significantly from that approved elsewhere, additional
information may be required. For example, an
independent in-depth review, including computational
analysis, by the licensee or a third party, may berequired.

Are there any other ways of assessing analyticalmodelling codes (for example, by involving
services of independent technical organisations)?

5) Any calculation methods and computer codes usedin the safety analysis have to undergo verification andvalidation of sufficient pedigree.

ARN maintain and use an independent set of“limited” modelling codes. However, it is not thecase for fire.

ARN has the practice to use TSOs. Some of the TSOs
are: GRS from Germany, US NRC, some US NationalLabs (like Sandia NL).

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response
If the fire simulation analysis code is used in the project,
Regulator will select some typical scenarios and used
independent software to verify the analysis results.
Are there any other ways of assessing analyticalmodelling codes (for example, by involving services of
independent technical organisations)?
Consideration may be given to assess the analyticalmodelling codes based on fire test cases that have been
carried out by other organisation.

ONR Response
See comments in response above
Are there any other ways of assessing analyticalmodelling codes (for example, by involving services of
independent technical organisations)?


Access to commercially available models could beobtained should there is a need to use analyticalmodels.
ONR could use technical support contractor to assess
models.
Various models can be used of various degree ofcomplexity (e.g. empirical models, zone models and
CFD Models) in the quantification of fireconsequences.

NNR Response
6) Detailed guidance is provided in NNR RG-0016,“Guidance on the Verification and Validation of
Evaluation and Calculation Models used in Safety and
Design Analysis”.’

ARN Response

Are analytical modelling codes formally approved by
the Regulator?
The NNR doesn’t prescribe nor formally approveanalytical fire modelling codes but evaluate them foracceptance as part of the review of the Safety Case.
Does the Regulator maintain and use an independent
set of analytical modelling codes?
The NNR is acquiring (mostly from the US NRC
environment) and developing an independent set ofanalytical modelling codes (but not on fire modelling)
through its recently established TSO, the Centre of
Nuclear Safety and Security.
Are there any other ways of assessing analyticalmodelling codes (for example, by involving services of
independent technical organisations)?

Beyonddesign basis
eventsIn the case of the Pebble Bed Modular Reactor Project(a high temperature gas cooled reactor), the NNR
contracted services of independent technicalorganisations in the UK and Germany.
What are the regulatory expectations for the approach
to beyond design basis hazards (i.e. definition andconsideration in analysis)? cf. DEC / DEE / BDB
approaches.

What are the regulatory expectations for the approach tobeyond design basis hazards (i.e. definition andconsideration in analysis)? cf. DEC / DEE / BDB
approaches.

What are the regulatory expectations for the approach tobeyond design basis hazards (i.e. definition andconsideration in analysis)? cf. DEC / DEE / BDB
approaches.

Combinations of events and failures (HAF102-2016)

Fault sequences initiated by internal and external hazards
beyond the design basis should be analysed applying anappropriate combination of engineering, deterministic
and probabilistic assessments.

From Section 7.1.1 of NNR RG-0019:

It is generally accepted that two levels of BDB events are
relevant to non-discrete hazards, one of which is primarily
concerned with the potential for cliff edge plant failuresfor events marginally above the design basis. The second
concerns more extreme events that could severely
challenge plant safety functions across the site.
Consequently, beyond design basis analysis has two
purposes:
To demonstrate that the plant design is robust to
uncertainties in the definition of external hazards
design bases and the plant design that flows fromthem. In other words, confirm the absence of ‘cliff

The NNR expects operators (i.e. according to Section 8.2
of NNR Position Paper PP-0014 Considerations of External
Events for New Nuclear Installations) to make provisions
for events with hazard levels that has a potential toexceed levels considered for design and to prevent thepotential for small deviations in plant parameters fromgiving rise to severely abnormal plant behaviour (cliffedge effects). To achieve this an additional safety goal
(called beyond design basis safety goal) is defined
which requires an applicant to meet the design basis
safety goal limit with a sufficient safety margin. The NNR

5.1.5.7. The design of the plant shall provide for anadequate margin to protect items important to safety
against levels of external hazards to be considered fordesign, derived from the hazard evaluation for the site,
and to avoid cliff edge effects.
5.1.5.8. The design of the plant shall also provide for anadequate margin to protect items ultimately necessary to
prevent an early radioactive release or a large radioactive
release in the event of levels of natural hazards exceeding
those considered for design, derived from the hazard
evaluation for the site.

42‘6) For DBECs, best estimate analyses plus uncertainty or
sensitivity analyses, may be justified.’

What are the regulatory expectations for theapproach to beyond design basis hazards (i.e.
definition and consideration in analysis)? cf. DEC /DEE / BDB approaches.
For design extension condition, the regulatory
expectation is that the analysis be done following a
best estimate approach together with anevaluation of the uncertainties to compare theresults of calculations with acceptance criteria(BEPU).
A best estimate approach provides more realistic
information about the physical behaviour of thereactor, identifies the most relevant safety issues
and provides information about the existingmargins between the results of calculations andthe acceptance criteria. An uncertainty analysis
should be performed to address the uncertainties
in the code models, in the plant model and in plantdata, including uncertainties in measurements anduncertainties in calibration, for the analysis of eachTechnical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response
The conservative definition of design basis external
hazards and suitable margin given in the design byfollowing the nuclear industry guidance are considered to
avoid cliff edge effect.
Considering lessons learnt from Fukushima accident,
DBF combined with precipitation of 1000 year
occurrence is applied to evaluate the external
flooding.



Detail SMA is performed to evaluate seismic margin
for NPP.



Large commercial aircraft impact is considered in the
NPP design.



ONR Responseedge’ effects just beyond the design basis. This is a
success based analysis, where the intent is to showthat plant failure does not occur
To demonstrate that for external hazard events
significantly beyond the design basis, the Licensee
has an understanding of how nuclear safetysignificant plant (Structures, Systems andComponents) respond, what failure modes canoccur and how the ability of plant and Systems,
Structures and Components, and operators to deliversafety functions is degradedBeyond design basis Analysis for hazards should:
Identify plant / SSC vulnerabilities and potential
measures to improve robustness.
Demonstrate sufficient margin to avoid cliff edge
effects just beyond the design basis.
For non-discrete hazards identify the hazard level atwhich safety functions could be lost (i.e. determine
the beyond design basis margin).
Provide an input to probabilistic safety analysis ofwhether risks targets are met.

Ensure that safety is balanced so that no single typeof hazard makes a disproportionate contribution to
overall risk.
Ensure that small changes to the design basis fault or
event assumptions do not lead to a disproportionate
increase in radiological risk.
Provide an input to severe accident analysis (nondiscrete hazards only).
ONR’s expectations for Beyond design basis Analysis are
given in the Safety Assessment Principles, specificallyEHA.7 ‘Cliff edge’ effects and 18 ‘Beyond design basis
events’. Additional guidance is provided in NS-TAST-GD013.
Cliff edge effects
EHA.7 introduces the need to demonstrate that there will
not be a disproportionate increase in radiologicalconsequences from an appropriate range of events thatare more severe than the design basis event. The analysis
should seek to provide confidence that the plant design
and its operation are robust in the face of uncertainties todesign basis definition (i.e. uncertainties in the data andanalysis) and the plant design process, and those safetyfunctional requirements if degraded, does so in a
predictable and gradual manner.
ONR considers events relating to cliff edge effects justbeyond the design basis are broadly consistent with a
WENRA DEC “A” event.
ONR expects Licensees to:43

NNR Response
considers this approach similar to the IAEA approach
used for the definition of design extension conditions,and consequently the IAEA approach is applicable. [13]
NNR Position Paper PP-0014 Considerations of External
Events for New Nuclear Installations

ARN Response
individual event. The overall uncertainty in the
results of a calculation should be obtained by
combining the uncertainties associated with eachindividual input. Studies to quantify the scaling
effect between an experimental arrangement andthe actual plant size should also be considered.
In addition, the uncertainty in parameters
associated with the results of a computer code
may be determined with the assistance of aphenomena identification and ranking table (PIRT)
for each event that is analysed. The ranking should
identify the most important phenomena for which
the suitability of the code has to be assured andshould be based to the extent possible onavailable data.

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response







ONR Response
accurately identify critical failure modes and theirnature (e.g. ductile or non-ductile) as this is helpful toaid the identification of the actual threshold of failure
establish that the hazard varies gradually around thedesign basis frequency, and that the plant response
does not suddenly change in this region, say due tothe failure mechanism
demonstrate margin between the design basis andthe loss of the design basis safety function that reflects
the known uncertainties in both hazard analysis andplant response analysis
demonstrate that loss of safety function should not,where practicable, lead to another fault condition, ie
equipment should be designed, where practicable,
to fail safe following an external hazard

Note: the design basis hazard value may well be verymuch greater than the site-specific hazard analysis value,
implying a large in-built margin to the design basis hazard
definition.
Beyond design basis Analysis
EHA.18 introduces the need to analyse fault sequences
initiated by internal and external hazards beyond thedesign basis should through an appropriate combinationof engineering, deterministic and probabilistic
assessments to understand the hazard level at whichsafety functions could be lost.
The use of good engineering practice applied to protect
and mitigate conservatively defined non-discrete faults
initiated down to the 10-4/yr. exceedance frequency
value, is likely to provide a level of risk control that will
satisfy the SAP risk targets. However, because non-discrete
EHs are described by hazard curves covering a wide
range of frequencies, parts of which extend well below
10-4/yr. the BDB component may contribute significantly
to facility risk. For non-discrete hazards therefore, BDBA is
important and can help to define the hazard severity at
which plant / SSC failure or loss of safety function occurs.
Where a design basis is established for a discrete EH and ahazard curve is not defined, the possibility of an event
more severe than the design basis may also needconsideration. This applies if the event initiation frequency
is difficult to determine or if the IEF is less than the designbasis criterion. A possible approach to demonstratesufficient margin to loss of safety function for the former is
to select one or more hazard-specific loading values thatare higher than the design basis event loads anddemonstrate that the safety functions are notendangered by these loads. The severity of the loading

44

NNR Response

ARN ResponseTechnical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response

ONR Response
values may be chosen to correspond to a safety margin
that is considered adequate. The use of a MCE for suchanalyses may also be useful, but caution should be
exercised if the selected MCE is very severe, since thismight lead to the conclusion that for such an event
reasonably practicable plant improvements do not exist.
Selecting a more reasonable choice of BDB event may
provide opportunities for reasonably practicable plant
improvements.

NNR Response

ARN Response

For the latter, where the hazard occurrence frequency isestimated to be below the design basis criterion but
above the EH screening criterion the fault analysis
guidance given in SAPs paragraph 609-610 is applicable.
In this case it is expected that assessment of the likely
accident progression and potential consequences shouldtake place to allow consideration of reasonably
practicable means of protection or mitigation of theconsequences such that the risks are ALARP.
It has previously been accepted that one satisfactory
approach to the demonstration of absence of adisproportionate increase in consequences is via an EHs
PSA. This has the merit of exploring the response of theplant to a wide range of hazard levels and is acceptedinternationally as a reasonable approach for EHs.
Maximum
credible
eventsWhat are the regulatory expectations for differentiating
between the approach for man-made and naturalexternal hazards from a MCE perspective including:What are the regulatory expectations for differentiating
between the approach for man-made and naturalexternal hazards from a MCE perspective including:

NO.SSG-18 Meteorological and Hydrological Hazards inSite Evaluation for Nuclear Installations.

It is ONR’s expectation that the safety case should list all
initiating faults that are included within the design basis
analysis of the facility. For external hazards, the designbasis event should be derived conservatively to takeaccount of data and model uncertainties. The thresholds
set for design basis events are 1 in 10,000 years for external
hazards and 1 in 100,000 years for internal hazards.

2.23. In some cases in which a physical limit exists (e.g. theamount of water vapour required to reach saturation in a
volume of air), deterministic methods may provide
rational limits to the statistical extrapolation by means of
the concept of the ‘physical limit’: an upper limit on thevariable of interest, such as flooding level or wind velocity,irrespective of the frequency of occurrence.

Initiating fault frequencies should be determined on abest estimate basis with the exception of natural hazards
where a conservative approach should be adopted toaccount for data and model uncertainties.
For some discrete hazards, usually man-made hazards, it
may be possible to characterise a worst-case event,called a Maximum Credible Event (MCE), that can beused as a surrogate for the hazard as a whole. For
example, the release of a toxic gas from a nearby off-sitetank farm will likely be limited by the maximum storage45

What are the regulatory expectations for differentiating
between the approach for man-made and naturalexternal hazards from a MCE perspective including:

Identification of physical limits for natural
hazards (e.g. atmospheric energy constraint on
precipitation).
Identification of physical limits for correlated
and unrelated/independent natural hazards(e.g. air temp and contemporaneous enthalpy
cf. air temp and wind speed).

The NNR philosophy is to distinguish between nondiscrete hazards (i.e. some if not most natural hazards
fall under this category) and discrete hazards (i.e. some
if not most man-made hazards fall under this category).
NNR expectation is that non-discrete hazards will be
determined probabilistically, as a conservative estimateof hazard severity at the 10-4/yr. frequency of
exceedance point on the hazard curve.
Beyond design basis hazards are determined at afrequency that is less than this. This frequency needs tobe justified by the operator/applicant. However, theWhat are the regulatory expectations fordifferentiating between the approach for manmade and natural external hazards from a MCE
perspective including:
AR 10.10.1 regulation for sitting a NPP deals withboth, discrete hazards and non-discrete hazards.
For discrete hazards, typically man –made, theapproach is to follow a Maximum Credible Eventcompatible with the site characteristic whenpossible, for example, regarding toxic from ships
due to traffic river, the distance from the plant
location to the river has to be consider.
For external hazards, the regulatory expectation
with respect to design basis is to determine thehazard severity through a probabilistic approach.
According to the current experience, the practiceis to set external events at the 10-4/yr. frequency of
exceedance point on the hazard curve.

Technical report
TR- HPR1000WG-03
Date: January 2019
Validity: until next update or archiving
Version : 0.1 (Draft)
HazardNNSA Response

ONR Response
capacity of the tanks. The MCE concept is useful for
quickly estimating worst-case scenarios and is generally
applied to hazards whose nuclear safety implications areminor. Quite often, the Licensee is able to demonstrate ina straightforward way that, even at the MCE level, thenuclear safety implications are negligible and therefore
the hazard can be screened out from further
consideration. The MCE can also be useful in helping todefine a design basis event when probabilistic methods
for the hazard in question carry large uncertainties, andalso provides a useful insight for BDBA
Some hazards may not be amenable to the derivation ofa design basis event based on frequency. In principle, it
may also be possible to develop a MCE for a non-discrete
hazard. In such cases a surrogate Maximum Credible
Event, supported by scientific evidence, may be defined.
For example, if the hazard curve is asymptotic to someupper value of severity, or if a relevant physical limit canbe defined that limits hazard severity.
Where hazards are not amenable to the derivation of adesign basis event based on frequency, a surrogate MCE,
supported by scientific evidence, may be defined. The
severity of the surrogate MCE should be chosen andjustified to reach an equivalent level of safety (that is, it
should be compatible with the principles of SAP FA.5).

46

NNR Response
NNR recognises that nuclear facilities are quite broadand such a definition is more reasonable if it is applied to
power reactor facilities as they demand a higher level ofsafety. Therefore, the NNR follows a graded approach
when applying these criteria.

ARN Response