Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

Date: September 2020
Validity: until next update or archiving
Version 1

MDEP Design-Specific Technical Report
TR-HPR1000WG-01

HPR1000 WORKING GROUP

Hydrogen Control During Severe Accidents

PARTICIPATION

Regulators involved in the MDEP
working group discussions:

ARN (Argentina), NNSA (China), NNR (South
Africa), ONR (UK)

Regulators which support thepresent technical report:

ARN (Argentina), NNSA (China), NNR (South
Africa), ONR (UK)

Regulators with no objection:

none

Regulators which disagree:noneMultinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

Date: September 2020
Validity: until next update or archiving
Version 1

Introduction
There is potential for large quantities of combustible gases to be generated during severe accident
conditions in a light water reactor. The combustion of such gases has the potential to threaten thecontainment integrity, and result in early releases of radioactive materials. In addition, harshenvironmental conditions as a result of hydrogen combustion have the potential to impinge on safety
equipment required to perform safety functions during accident conditions. It is therefore an
expectation of reactor designers or licensees (referred to as designer herein) to demonstrate thatthese risks posed by combustible gases have been considered and can be mitigated to safe levels.
There are several combustible gas generating processes that occur during accidents. The analysis ofhydrogen risk during design basis accidents is normally treated very differently to that for severe
accidents. The significantly slower processes important for design basis accidents add negligible risk
during severe accidents, and it is normally appropriate to omit these when performing severe accident
analyses. The design of the containment combustible gas control systems is, therefore, largely basedon the severe accident phenomena, and more effort is spent on the severe accident analyses.
The dominant processes for combustible gas generation in severe accidents are Molten Corium
Concrete Interaction (MCCI) and the steam-metal reaction. The HPR1000 employs the In-Vessel
Retention (IVR) strategy. Successful retention of the corium in the Reactor Pressure Vessel (RPV)
precludes the MCCI phenomena and, therefore, MCCI is not taken in to account in the design andanalysis of the combustible gas control system.
The HPR1000 hydrogen mitigation strategy employs Passive Autocatalytic Recombiners (PARs), andrelies upon a large open containment and good mixing in order to reduce hydrogen to acceptableconcentrations that prevent large pressure waves that could challenge the containment.
The HPR1000 design is currently under review in the UK and the People’s Republic of China. A
Multinational Design Evaluation Programme was established consisting of the following members:
Office for Nuclear Regulation (ONR) - UK, National Nuclear Safety Administration (NNSA) - China,
Autoridad Regulatoria Nuclear (ARN) - Argentina, and National Nuclear Regulator (NNR) – South
Africa.
The purpose of this document is to identify common features of the HPR1000 design and develop acommon understanding of the regulatory requirements of the regulators that make up the HPR1000
MDEP Working Group (referred to the ‘regulators’ herein). A survey was produced and sent to all theregulators regarding various aspects of the HPR1000 Containment Combustible Gas Control System(CCGCS). This document compiles the information provided within the responses to the survey andsummarizes the information presented by the regulators.
This paper discusses the two variations of the HPR1000 design, referred to as Option 1 and Option 2.
Below is a high level summary of the two options.
•

Option 1: 75300 m3 free volume in containment, 1 GWe PWR with active containment heatremoval.

•Option 2: 86300 m3 free volume in containment, 1 GWe PWR with passive containment heatremoval.

The text in this document refers to both options unless otherwise specified.
Discussion of Responses
This section summarizes the information in the responses to the survey that are pertinent to thedesign of the HPR1000.

1

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

Date: September 2020
Validity: until next update or archiving
Version 1

1. Rationale for PARs

All regulators represent countries which are Contracting Parties to the Convention on Nuclear Safety
and therefore share a common goal of the Vienna Declaration on Nuclear Safety that “New nuclear
power plants are to be designed, sited, and constructed, consistent with the objective of preventing
accidents in the commissioning and operation and, should an accident occur, mitigating possible
releases of radionuclides causing long-term off site contamination and avoiding early radioactive
releases or radioactive releases large enough to require long-term protective measures and actions”
In both prescriptive or goal setting regulatory regimes, it is recognized that early containment failureand damage to equipment providing safety functions due to high energy combustion of hydrogenshould be avoided.
None of the regulators have regulatory requirements that specify the type of technology that shouldbe implemented in a Pressurized Water Reactor (PWR) for the management of combustible gases in
Severe Accidents. Where regulations or expectations exist, they instead center on the prevention ofhigh energy combustion that could lead to a challenge on the containment structure through imposing
limits on combustible gas concentrations. The designers’ rationale behind having PARs in the HPR1000
containment is thus in pursuance of this goal. Whilst no country specifies the type of technology
required, it is noted that all countries have experience with PARs in existing or new reactors.
2. Rationale for location of PARs

In determining the layout of the PARs in the HPR1000 designs, the following principles have been
followed by the designers:•

To locate the PARs in the middle and upper level in the containment to optimize and takeadvantage of natural convection to promote mixing.

•

To locate the PARs in compartments where there is a relatively high hydrogen risk to prevent
local build-up.

•

To locate the PARs in the compartments where hydrogen may be directly released from theprimary circuit.

•Consideration is given to other equipment required for severe accident management which
may be affected by PAR operation (including the PARs own supporting structures), and thenegative impacts are minimised so far as reasonably practicable.

•

The PARs should be easily accessible for testing and maintenance.

In addition to these principles, consideration to external hazards (e.g. external flooding, earthquakes,
airplane crash etc) and internal hazards (internal flooding, pipe whip, jet impingement etc) are also
considered in the design layout to prevent common cause failure of the [CCGCS].
The number and location of the PARs has been derived and verified by the designer using an iterative
analysis using a severe accident analysis integral computer code. As discussed below, the location of
the PARs has been informed by requirements set by the reactor designer. For the most penalizing
cases identified using a lumped parameter code, the reactor designer performs more sophisticatedcomputational fluid dynamics (CFD) calculations in order more realistically model hydrogen transport
and, where necessary, determine dynamic loads from slow and fast deflagrations and determine thepossibility of Deflagration to Detonation Transition (DDT) occurrence.
Whilst the severe accident analysis is used for analyses related to equipment qualification andsurvivability, the main purpose of the analysis to verify that the sizing and location of the PARs
adequately mitigates risk of containment failure through hydrogen combustion.

2

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

Date: September 2020
Validity: until next update or archiving
Version 1

3 - How many PARs available and how many of those are necessary for safety report calculation?

Option 1: The CCGCS consists of 29 PARs. For design basis accidents in which significant quantities of
H2 can be generated over a long period, 2 large capacity PARs are located in the containment dome.
For severe accident conditions, an additional 27 (16 large and 11 small) PARs are available. For designbasis analysis, the single failure criterion is taken into account, and only 1 PAR is assumed available in
the analysis. For severe accident analysis, all 29 PARs are credited (assumed available).
Option 2: The CCGCS consists of 33 PARs. For design basis accidents in which significant quantities of
H2 can be generated over a long period, 2 large capacity PARs are located in the containment dome.
For severe accident conditions, an additional 31 (20 large and 11 small) PARs are available. For designbasis analysis, the single failure criterion is taken into account, and only 1 PAR is assumed available in
the analysis. For severe accident analysis, all 33 PARs are credited (assumed available).
The number of PARs required for Options 1 and 2 is different due to containment design and coolingphilosophy. However there should be consistency in the assumptions made on availability in theanalysis.
4. Regulatory Requirements

Only China has specific requirements that apply to hydrogen management. The requirements are as
follows:
HAF 102-2016 - Safety of nuclear power plants: design - “6.3.5.6. design features to control fission
products, hydrogen, oxygen and other substances that might be released into the containment shallbe provided as necessary:… To control the concentrations of hydrogen, oxygen and other substancesin the containment atmosphere in accident conditions so as to prevent deflagration or detonationloads that could challenge the integrity of the containment”
In addition to the above, NNSA have issued the report “General Technical Requirements on postFukushima Nuclear Accident improvement Measures for NPPs (Trail)”. It places requirements upon:hydrogen monitoring range, global hydrogen concentration, damage to containment integrity,degradation of safety functions and severe accident management guidelines regarding H2 mitigation.
The UK, Argentina and South Africa do not have specific regulatory requirements regarding hydrogen
management. However, as goal setting regimes, these regulators look to relevant good practice (suchas IAEA SSR2/1 and SSG-53) as a benchmark for hydrogen management in pursuance of reducing risks
to as low as reasonably practicable.
5. Safety Classification and Seismic Categorisation, if any

In general, all the regulators recognize that the safety classification for PARs allocated to design basis
accidents (such as LOCA faults) should be higher than those used to mitigate severe accident
conditions.
Whilst there are differences in the methodologies for categorization and classification of safetyfunctions and safety measures, it is generally recognized that nuclear codes and standards are applied
to the provision of the safety function for design basis PARs, and non-nuclear codes and standards
apply to those for severe accidents.
Further, the regulators recognize that whilst the classification/categorization of the safety function
decreases as the likelihood of its demand decreases, the seismic categorization should remain high inorder to prevent external hazards defeating all PARs in severe accident scenarios.
6. Rationale for qualification test (used for DBA and SA) and what qualification test are planned for thereference plants, if any

3

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

Date: September 2020
Validity: until next update or archiving
Version 1

As the supplier for HPR1000 PARs has not been selected for the UK and Argentina plants, there are no
specific qualification requirements or planned qualification tests identified by the designer. However,
all regulators expect that appropriate qualifications tests under normal, accidental and seismic
conditions should be performed to the relevant codes and standards commensurate with their safetyclassification and seismic categorisation. All regulators expect that the environmental conditions for
qualification of the PARs can be derived using severe accident analysis which is underpinned byvalidation and verification of the codes used.
7. Does the HPR1000 design include PARs with ignitors? If yes, rationale for ignitors location?

None of the HPR1000 designs include ignitors.
8. Does the HPR1000 design consider hydrogen ignition by PARs in the safety calculation?

Ignition by PARs is a supplier-specific feature, the progress of test and validation on this matter shouldbe tracked continuously. Ignition should be considered in future submissions when performing moredetailed calculations (such as CFD) of the containment. However, no safety submissions currently
consider ignition by overheating of the PARs, and no specific requirements from the regulators on thismatter.
9. How is hydrogen concentration in the containment monitored?

Option 1: Two low class (industry standard) safety trains of five hydrogen monitors are placed invarious positions in the containment. Whilst PARs are passively initiated, the hydrogen monitoring
instrumentation and control must be manually operated following transition in to severe accident
mitigation strategies. Hydrogen concentration can be measured and monitored in the main control
room.
Currently, in the FCG3 design, the range of hydrogen concentration that can be measured by the I&C
system is 0-15%.
Option 2: Six hydrogen monitors are placed in various positions in the containment, three of them arepowered by Train A while the other three ones are powered by Train B. The hydrogen monitor system
will be triggered manually during a severe accident. Hydrogen concentration can be measured andmonitored in the control room. The measuring range of hydrogen concentration system is 0 -15%.
10. How is the availability of PARs ensured during the life of the plant (examination, inspection, maintenanceand testing)?

None of the working group regulators have received and assessed detailed maintenance and testing
information, it is the regulators’ expectations that examination, inspection, maintenance and testing(EIMT) will be performed commensurate with the safety significance and frequency of demand of thesafety function (i.e. dependent on its safety function categorization). In general, throughout the plant
lifecycle, EIMT of the PARs includes visual inspections to verify integrity and corrosion of the shell andcatalytic drawer to confirm support function of structures and testing of samples of the catalytic plates
to ensure adequate catalytic performance is achieved. If required replacement or regeneration of theplates is performed.
11. What are the measures to protect the PARs during plant outage, if any, and what are the checks before
restartExcluding NNSA, details of measures to protect the PARs during plant outage have not been provided
by the designer to any regulators. However, it is generally expected that the PARs be protected bypreventing potential impurities from contacting the catalytic plates, resulting in a reduction ofefficiency. Any protective measures should be removed to restore the PARs to their initialconfiguration (e.g. shielding or removal of plates should be rectified) prior to entering any operating

4

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

Date: September 2020
Validity: until next update or archiving
Version 1

mode when their safety function is potentially required.
12. Do safety calculations take into account availability of PARs during shutdown events

For severe accidents, it is generally expected by the regulators that availability of equipment providing
low classification safety functions are available when their safety function could be potentiallydemanded, and therefore any analysis can take credit for correct performance of the PARs when they
are expected to operate. PARs are not required in the containment building during complete
unloading of the core.
For design basis accidents (e.g. LOCA in RHR mode), only 1 higher classification PAR is credited in theanalysis.
13. Are there PARs in the spent fuel building? Rationale for having them or not?

There are currently no PARs in the spent fuel building for any design. Whilst safety submissions related
to the severe accident mitigation strategy for the spent fuel building have been submitted to all
regulators, the rationale for not having PARs is expected to be based on arguments regarding the slow
nature of transients in the spent fuel pool, prevention of uncovery through redundant means of water
injection, the low likelihood of a fuel melt scenario and the ventilation panel that exists in the design.
Summary
The HPR1000 Containment Combustible Gas Control System is included in the design in order tomitigate the risk of containment failure due to high energy combustion of hydrogen.
The HPR1000 Containment Combustible Gas Control System includes the following two sub-systems:••

Passive Autocatalytic Recombiners (PARs) sub-system;
Hydrogen monitoring sub-system.

The HPR1000 hydrogen mitigation strategy employs Passive Autocatalytic Recombiners (PARs), andrelies upon a large open containment and good mixing in order to reduce hydrogen to acceptableconcentrations that prevent large pressure waves that could challenge the containment.
The two options of the HPR1000 design differ mainly in the number of PARs and monitors.
Nevertheless the principle of design and safety goal of both options are similar.
In addition, among the principles followed in deciding the locations of PARs are the need to establish
good in and outflow conditions of the PARs and to be located away from any equipment used in severe
accident, such that damage caused by the hot gas from the PARs can be avoided. Periodic testingshould be carried out to ensure the claimed reliability and effectiveness of the PARs through life.
Moreover, safety calculations are presented for severe accidents occurring during normal operation
but no specific calculations are presented for shutdown events, assuming that the PARs are available
during shutdown conditions. This is important to keep in mind because the rules for protected
measures for PARs during plant outage and in particular the rules to ensure that these protected
measures have been removed before restart are not presently known for the different HPR1000
designs. For plant operating states where the safety function of the PARs may be called upon, theplant availability rules and procedures should ensure those functions are available.
Regulators in China have reviewed the HPR1000 Containment Combustible Gas Control System[CCGCS] and have determined that it meets applicable regulatory requirements, and that the system
has been designed to accommodate hydrogen generation equivalent to a 100 percent fuel cladcoolant reaction. Although regulations are similar, some differences in the regulations and design
acceptance process exist. Conclusions about the design by the regulators of South Africa and Argentina
are pending review in case of a future applicant submittal.
5

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

1. Rationale for PARsONR (UK)
High energy combustion of combustible
gases generated during hypothetical
severe accidents (and some design basis
accidents) has the potential to challenge
the integrity of the containment and thecorrect performance of safetymeasures. As the corium coolingstrategy is in-vessel retention, hydrogengenerated from the steam-metal
reaction forms the majority of the
combustible gases.
Whilst ONR has no preference fortechnology to mitigate risks of highenergy combustion during both designbasis and severe accident conditions,
ONR expects that accident conditions
that have the potential to lead to large
or early releases are practicallyeliminated. ONR has issued design
acceptance confirmations for the EPR,ABWR and AP1000. The hydrogen risk
strategy for these designs includes PARsand ignitors.

Date: September 2020
Validity: until next update or archiving
Version 1

NNSA (China)
Containment failure due to hydrogen
explosion is one of the events that shall bepractically eliminated. The safety goal of
the PARs is to keep the concentration ofhydrogen released from the degradedcore low enough to prevent any possibilityof combustion that would threatencontainment integrity; PARs also prevent
failures to the equipment located inside
the containment, which might be caused
by fast combustion of gaseous hydrogen.
When hydrogen concentration in thecontainment reaches the start threshold,PARs launched automatically andrecombines hydrogen and oxygen in gas
mixture to water vapour, which caneffectively keep hydrogen concentrationin containment under safety range.

ARN (Argentina)
According to the regulatory
standard, AR 3-4-3 rev 1,”Nuclear
Power Plant Confinement
systems”, the different physicalbarriers provisions in the design
shall assure the fulfilment of
criteria for limitation theradiological consequences asstated in AR 3-1-3 “Radiologicalcriteria relating to accidents innuclear power plants”.
For accident conditions involving
severe fuel damage or core
melt/severe accidents, the main
safety objective in order to fulfil
the above regulatory
expectations is to maintaincontainment structure integrity
throughout the course of such aan accident.
In order to maintain thecontainment structure integrity,
its strength shall be high enoughto withstand (with sufficientmargins) static and dynamic
loads during core melt accidents
that have not been practicallyeliminated (pressure,temperature, missile, radiation
and reaction forces).
Containment failure caused by
the significant releases ofcombustible gases can bepractically eliminated by avoiding
the hydrogendeflagration/explosion. So, there

ONR is a contracting party to theConvention for Nuclear Safety, and has
adopted the Vienna Declaration for
Nuclear Safety, 2015.

6

NNR (South Africa)
Given the temperature
conditions prevailing in thereactor coolant system, the core
and the containment, core
coolant water and containment
spray water are both liable toreact with certain metalcompounds and/or todecompose by radiolysis during
a loss of coolant accident, thus
producing hydrogen. Hydrogencan also be generated insidecontainment by molten coreconcrete interaction during theex-vessel phase.
A potentially explosivehydrogen-air mixture may
develop inside the containment
as hydrogen is produced. Such
conditions represent a potential
challenge to containment
integrity.
In the case of the Koeberg PWR
plant, in order to maintain thehydrogen concentration at a
sufficiently low value during adesign basis LOCA, mobile H2/O2
recombiners are provided. The
mobile recombiners are sized
for a Design Basis LOCA. The
Passive Autocatalytic
Recombiners (PARs) are sized
for a Beyond Design Basis LOCA
and were also installed in the
Koeberg PWR plant.

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

2. Rationale forlocation of PARs

Date: September 2020
Validity: until next update or archiving
Version 1

ONR (UK)

NNSA (China)

ARN (Argentina)
shall be appropriated design
provisions, like PARs to prevent
containment failure due to
combustion of hydrogen.

NNR (South Africa)

The reactor designer has used
experience from the CPR1000 as an
initial estimate as to the number ofPARs required.

The general scheme of PARs location in
HPR1000 design is based on the following
aspects:

For the preliminary design:
selection of recombination
capabilities and locations of theequipment, the regulatory
expectation is that the decision
making process be justified bydeterministic analysis. For the
existent plants, MELCOR code
was used to develop a model forthe severe accident progression
allowing optimization of PARs’slocation and assessing theirefficiency to face different
accident scenarios.

The PAR locations and the unit
sizes are selected to optimisehydrogen removal in severe
accident conditions, and are
based on studies performed for
Tricastin (sister plant of Koeberg
NPP in France).

the following principles for location of
the PARs have been followed:• To locate the PARs in the middle andupper level in the containment to
optimise the natural convection;• To locate the PARs in thecompartments where there isrelatively high hydrogen risk to avoid
build-up of hydrogen;• To locate the PARs in thecompartments where hydrogen may
release into it directly;• Consider the layout of otherimportant equipment to avoid
damage.
• To locate PARs in where it is easy toaccess and keep in good repair.

• locate the PARs in the area where thehydrogen is prone to concentrate
locally, and guarantee the hydrogen
elimination effectiveness of PARs,• the PARs shall be able to support
general convection in containment, andpromote the atmospherehomogenization,• the PARs shall be accessible for the
implement of maintenance, periodic
test and in-service inspection.
• the PARs shall not have negative effecton other systems located in thelocalizing area.
The numbers and location of PARs design
are verified and validated by safety
analysis.

In addition, the reactor designer has
considered external (flooding,earthquakes, explosions etc.) andinternal hazards (flooding, pipe-whip,
jet impingement, dropped loads, fires)in the positioning of its PARs.

When determining PARs’slocation, design of support
structures and stress analysis
considering dead, thermal andseismic loads, shall also be
considered.
Other aspects needed to support
a further safe operation have to
be also considered early in thedesign stage, like accessibility for
maintenance and functional
tests.

Detailed H2 distribution analyses
have been performed at
Tricastin to determine the best
location of the PARs for optimal
H2 reduction. As Tricastin andKoeberg have the same CP1
reference plant configurations,the PAR locations at Koeberg are
the same as the PAR locations at
Tricastin.
The PARs are either wall or floor
mounted depending on thelayout of the area and available
support base. To allow flexibility
in the arrangement of thesedevices in the various
compartment areas ofcontainment, the PARs areavailable in various sizes.
The PARs were distributed in theequipment rooms to start theremoval as early as possible andto support global/local
convection and homogenizing

For severe accidents, the design of the
CCGCS will be confirmed through an

7

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

ONR (UK)
iterative process, using both the severe
accidents integral code and moresophisticated computation fluid
dynamics codes, to show that highenergy combustions that can challenge
the containment integrity can beprevented and that equipment
important to safety will not be effected.

Date: September 2020
Validity: until next update or archiving
Version 1

NNSA (China)

ARN (Argentina)

NNR (South Africa)
the atmosphere considering
possible hydrogen release areas.
Further PARs were installed in
the dome area to minimize
build-up of hydrogenconcentration in the upper partof the containment.
Besides the global convection
which will be supported by thebigger PAR type, local
construction constraints wereconsidered for optimal inflow
and outflow condition (noobstruction at the gas outlet andinlet, minimal distance to thefloor) to obtain the nominal
depletion rate.
The minimum requiredhydrogen reduction capacity
specification was the basis forthe selection of installation
locations in the predefinedcompartments considering:• hydrogen release areas,• main flow paths between
zones of hydrogen• enhance containment
atmosphere mixing• take advantage of global
convection paths.
As an aside, it should be notedthat core coolant water andcontainment spray water are notthe only sources of hydrogen

8Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

ONR (UK)

Date: September 2020
Validity: until next update or archiving
Version 1

NNSA (China)

ARN (Argentina)

NNR (South Africa)
through their liability to reactwith certain metal compounds
and/or to decompose byradiolysis during a loss of
coolant accident, thus producing
hydrogen. Hydrogen is also
produced by the hydrogenproduction and storage system.
The hydrogen produced is usedin the generator hydrogen
supply system and the chemical
and volume control system(RCV). A hydrogen blanket ismaintained in the volume
control tank.
In addition to this, there arehydrogenated wastes thatoriginate from the volume
control tank and primary waste
tank.
The wastes are also generated
during the treatment of primary
waste by the TEP degassers. The
wastes are made up ofhydrogen, fission gases (e.g.
xenon and krypton), andnitrogen.
In the RCV, RPE, TEG, and TEP
tank rooms, the equipment
capable of containing significant
quantities of hydrogen present a
potential risk of explosion in theevent of an accidental leak. In
addition, there is the risk that,should the RCV piping fail,9Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

3. How many PARsavailable and how
many of those arenecessary for safety
report calculation?

Date: September 2020
Validity: until next update or archiving
Version 1

ONR (UK)

NNSA (China)

ARN (Argentina)

NNR (South Africa)hydrogen could gather in theserooms and cause a risk of fire or
explosions. Koeberg has taken
additional measures to addressthese additional hydrogen risks.
It may be prudent for HPR1000
considerations to also consider
such additional sources ofhydrogen.

In the UK HPR1000 there are 29 PARsavailable in total.

The number of PARs depends on the plantdesign. In option 1, 29 PARs are assumed
available in safety report calculation; in
option 2, 33 PARs are assumed available insafety report calculation.

The number of PARs depends on
the plant design. In the case of
Atucha I (PHWR) the number is
32 and for Atucha II (PHWR), thenumber is 54.

The failure of some PARs for safety
analysis is not mandatory, but it
considered certain margin in design.

It is expected that in the designof HPR1000, the safety featuresdesigned to mitigate theconsequence of core melt
accident (level 4) be independent
from equipment designed tomitigate DBA (level 3a) and DEC(level 3b). Safety demonstration
shall be done for level 3a,
through conservative
methodology. It is also possible
to include best estimate
verification for level 3b. a

To prevent hydrogen (H2) build-up
during a Beyond Design Basis
LOCA, twenty four PARs are
installed inside the containmentbuilding of the Koeberg NPP.
An observation of more generalsignificance than just for thisquestion:
There appears to be examples of
how beyond design basis measuresof Generation II technology/design
are naturally being converted todesign basis measures ofGeneration III technology/design
whilst moving from Generation II
technology/design to Generation III
technology/design.
One of example of this is as follows:
The Containment Atmosphere
Control system (ETY) of theKoeberg NPP consists of two
systems to reduce hydrogenconcentration, namely theoriginally installed mobile
recombiners and the later installed
Passive Autocatalytic Recombiners• There are 2 dedicated to design basis
accidents. Only 1 is credited in designbasis analysis taking in toconsideration the single failure
criterion.
• There are 27 dedicated to severe
accidents, however, credit is takenfrom all 29 in the analysis.
ONR expect that sensitivity studies are
performed in order to demonstrate thatno cliff-edge effects are observed.

10

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

ONR (UK)

Date: September 2020
Validity: until next update or archiving
Version 1

NNSA (China)

ARN (Argentina)

11

NNR (South Africa)(PARs). The mobile recombiners
are sized for a Design Basis LOCA.
The PARs are sized for a Beyond
Design Basis LOCA.
In the UK HPR1000 design, in
design basis accidents, hydrogengenerated is removed by two setsof PARs. Under severe accident
conditions (DEC-B sequences) thehydrogen is removed by 27 sets of
PARs.
Thereby, when comparing with theKoeberg example, in effect,
converting beyond design basis
measures of Generation II to designbasis measures of Generation III in
moving from Generation II
technology/design to Generation III
technology/design.
One also encounters examples ofwhere the return periods for
extreme external events are inbeyond design basis territory for
Generation II considerations but
move to design basis territory for
Generation III considerations,
thereby, in effect, converting
beyond design basis conditions ofGeneration II to design basis
conditions of Generation III in
moving from Generation II
technology/design to Generation III
technology/design.
In summary, nuclear regulatorsneed to remain cognizant of thisMultinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

4. Regulatory
Requirements

Date: September 2020
Validity: until next update or archiving
Version 1

ONR (UK)

NNSA (China)

ARN (Argentina)

ONR’s SAPs state that early or large
releases should be practicallyeliminated. The SAPs are benchmarked
against relevant good practice (RGP)

HRP1000 China

N/A

In China, general regulatory requirements
are in HAF 102-2016 “Safety of nuclear
power plants: design” and related

12

NNR (South Africa)
shifting of the meaning of “designbasis” to include more stringent
requirements in moving from
Generation II design considerations
to Generation III design
considerations and, therefore, notforget that the further
development of design extension
conditions and measures(associated with Generation III
considerations) is not the only
tightening of requirements
imposed on authorization
applicants and -holders whenmoving from Generation II
considerations to Generation III
considerations. Tightening of
requirements also happens in theshifting meaning of what is meantby “design basis” as one moves
from Generation II to
Generation III.
This should be a source of caution
for nuclear regulators to remain
reasonable and pragmatic when
imposing evolving requirements by
not forgetting what tightening of
requirements might already be“buried”/implied in the use of thewords “design basis” whencomparing the Generation II and
Generation III contexts.
The analysis of Beyond Design
Basis Accidents (Including
Severe Accidents) shall showcompliance with risk criteria as

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

ONR (UK)e.g.(SSR2/1).
The requirement for risks to be As Low
As Reasonably Practicable (ALARP) is
fundamental and applies to all activities
within the scope of the Health and
Safety at Work Act 1974 [HSWA]. The
minimum expectation for
demonstration of ALARP is RGP.
ONR is bound by the Article 8a of the EU
Nuclear Safety Directorate that statesthat ONR requires that early or large
releases are avoided.

Date: September 2020
Validity: until next update or archiving
Version 1

NNSA (China)
guidelines and policy statement. Detailed
regulatory requirements for the hydrogenassessment are written in General
Technical Requirements on postFukushima Nuclear Accident Improvement
Measures for NPPs (Tentative):
HAF 102-2016 “Safety of nuclear power
plants: design”:• 6.3.5.6. Design features to control
fission products, hydrogen, oxygen andother substances that might be released
into the containment shall be provided
as necessary:− To reduce the amounts of fission
products that could be released to theenvironment in accident conditions;− To control the concentrations ofhydrogen, oxygen and othersubstances in the containment
atmosphere in accident conditions so
as to prevent deflagration ordetonation loads that could challenge
the integrity of the containment.
General Technical Requirements on postFukushima Nuclear Accident
Improvement Measures for NPPs
(Tentative):• The hydrogen monitoring system shouldhave the ability to monitor the hydrogenconcentration over the whole range
under severe accidents andcorresponding alarms should be set, so
as to confirm the status of the nuclear
power plant and provide information as

13

ARN (Argentina)

NNR (South Africa)
stated in NNR Requirements
Document RD-0024,“Requirements on Risk
Assessment and Compliancewith principal Safety Criteria”.
At Koeberg, the PARs are
credited in the Level 2 PSA.
Level 2 PSA studies were
performed to compare theimpact of PARs on cases such as
SBO and reactor coolant system(RCP) small break LOCA. Thiswas done using MAAP4.07
which has options to model the
AREVA type PARs that have been
installed at Koeberg.
Small break LOCA in the reactor
coolant system (RCP) is adominant severe accident
scenario for Release Category 6
in the Level 2 PSA. As part of
ALARA considerations for thiscase, a comparative analysis wasdone with and without the
installation of PARs.

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

ONR (UK)

Date: September 2020
Validity: until next update or archiving
Version 1

NNSA (China)
practicably possible for decision making
during the accident management.

ARN (Argentina)

NNR (South Africa)

Safety classification for items
important to safety must be doneusing IAEA, SSG-30: “Safety
Classification of Structures,
Systems and Components inNuclear Power Plants” (2014).
PARs for DBA shall be safety classand the others are non-safetyclass.

It should be noted that theContainment Atmosphere
Control system (ETY) of theKoeberg NPP consists of two
systems to reduce hydrogenconcentration, namely theoriginally installed mobile
recombiners and the later
installed Passive Autocatalytic
Recombiners (PARs).

• The hydrogen concentration should beless than 10%(V/V), assuming thehydrogen generated from the metalwater reaction involving 100% of thefuel cladding metal in the active fuelregion and distributed uniformly in thecontainment;• The damage of the integrity ofcontainment by combustion or
exploration due to local accumulation ofhydrogen should be avoided, and theimpact on the functions of severe
accident mitigation systems or
equipment should be minimized;• The hydrogen concentration monitoring
and controlling measures should be
included in severe accident
management guide or relevant
procedures.
5. Safety
Classification andSeismic
Categorisation, if any

PARs for design basis accidents aresafety function categorization 2,
meaning that nuclear codes andstandards apply, and the single failure
criterion applies.
PARs for severe accident conditions aresafety function categorization 3,
meaning industry standards apply, andthe single failure criterion doesn’t need
to be applied.
All PARs are the highest seismic
category.

In HPR1000 design, 2 PARs for design basis
accident are categorized as safety class,and other PARs for severe accident are
categorized as non-safety class.
Additionally all PARs are items importantto safety.

The mobile recombiners are
sized for a Design Basis LOCA.

14

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

ONR (UK)

Date: September 2020
Validity: until next update or archiving
Version 1

NNSA (China)

ARN (Argentina)

NNR (South Africa)
The PARs are sized for a Beyond
Design Basis LOCA.
Hydrogen monitoring andreduction of hydrogenconcentration to a safe level areessential to safety andcontainment integrity.
Therefore, the post-accident
containment atmospheresubsystem (mixing, sampling,
and mobile recombining) of theContainment Atmosphere
Control system (ETY) is a safetyrelated Class 2 subsystem.
The safety classification of the
PAR units are still subject to a
separate design study to classify
the PARs – more about thislower down below.
All safety-classified parts of the
ETY system are designed tooperate following a safe
shutdown earthquake (Seismic
Class 1) and are protectedagainst missiles.
Since the PARs are sized to deal
with a Beyond Design Basis
LOCA, they will be capable ofcontrolling the post DBA
hydrogen build-up. However,the current design for the PAR
installation function has the PAR
units conservatively classified as
NSF (No Safety Function) andthe seismic classification is ND

15

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

6. Rationale for
qualification test
(used for DBA) andwhat qualification
test are planned forthe reference plants,
if anyDate: September 2020
Validity: until next update or archiving
Version 1

ONR (UK)

NNSA (China)

ARN (Argentina)

NNR (South Africa)(Non Destruct), which is not
sufficient to allow the PARs to
officially take over the designbasis safeguard function of themobile recombiner (two mobilehydrogen recombiners, one oneach unit). This requires aseparate design study to reclassify the PARs.

Qualification will be performed todemonstrate that all PARs can performtheir safety functions under severe
accident environmental conditions, andthat they can perform their safetyfunctions following seismic activity.

As PARs are necessary equipment insevere accident, qualification test of PARs
are performed under severe accident
environmental conditions. The rationale
for qualification test is to prove thefunctionality of the PARs at environmental
conditions expected in a severe accident.
Referenced to RCC-E standards, K1 andsevere accident procedures aresequentially used, with different severityof thermal and chemical conditions, test
methods, acceptance criteria from design
basic accident.

Equipment qualification includes
three items: environmental,
seismic and electromagnetic
immunity (not for PARs). The
requisites for the process ofqualification are based on IAEA,
Equipment Qualification in
Operational Nuclear Power
Plants: Upgrading, Preserving andReviewing, Safety Report Series
No. 3.

The titles of the following test
programs provide an indication of
the rationale for qualification of thePARs used in the Koeberg NPP. The
PAR qualification test database isderived from the following national
and international test programs:• Integrated Core-MeltSimulation-Test• EDF H2- Kali Tests with sprayincluding chemicals• EPRI / EDF Tests for BWR andPWR conditions• PAR Tests in the Battelle
Containment• PHEBUS Catalytic Coupon Test
• Development and Qualification
Tests in AREVA NP Laboratories
in Karlstein.
A qualification program over anumber of decades was
performed. The test programs
allow the behaviour of the AREVA
NP PARs in case of design basis- orsevere accidents in PWR and BWR

No detailed qualification information
has yet been provided.

16

For PARs, the rationale forenvironmental qualification test
is to prove the functionality in asevere accident conditions. For
seismic qualification, SSE
earthquake is used to define thevibratory limits that have to be
tolerated. However, the vibratory
motions experienced by NPP
equipment will vary on the basisof the filtering, amplification anddampening of intervening
structures.

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

ONR (UK)

Date: September 2020
Validity: until next update or archiving
Version 1

NNSA (China)

ARN (Argentina)

NNR (South Africa)
nuclear plants with release of
combustible gases to be assessed.
The PAR tests were performed
under a wide range of hydrogenconcentrations, initial ambient gas
temperatures and pressures, steam
and nitrogen as inert gases, andpotential poisons. In addition, theeffects of wetness and low ambient
temperature on PAR start-up werestudied.
The Integrated Core-MeltSimulation-Test program in
Cadarache concerns poisoning,deposition and contamination of
catalyst in a post accident
atmosphere. During this program,the AREVA NP PAR was subjected
to a realistic aerosol exposure
generated by a molten core. This
test answers the question on theeffect of aerosols on the catalytic
recombination as well as thecatalytic poisoning by fission
products in a severe accident
atmosphere.

7. Does the HPR1000
design include PARs
with ignitors? If yes,rationale for ignitors
location?

The UK HPR1000 design only includes
PARs.

To prevent hydrogen accumulation leadinghydrogen detonation, HPR1000 design
installs only PARs and no igniters.
However, NNSA have no preference; theCANDU-6 units in Qinshan NPP, AP1000
units in Sanmen and Haiyang NPP utilize
PARs with igniters in containment ashydrogen control measure.

17

No igniters are used.

No igniters are used.

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

8. Does the HPR1000
design considerhydrogen ignition byPARs in the safetycalculation?

9. How is hydrogenconcentration in thecontainment
monitored?

ONR (UK)
With regards to severe accident
analysis, ONR expects that allphenomena are modelled on a best
estimate basis and adequately
underpinned by V&V. Currently, thesubmitted analysis is performed in a
lumped parameter code and ignition
from PARs has not been analyzed.
Further work is to be performed using
more sophisticated CFD analysis where
the possibility of ignition from PARs will
be explored.

NNSA (China)
Hydrogen ignition by PARs is notconsidered in safety calculation up to
now. At present, PAR ignition is still under
R&D stage.

ARN (Argentina)
Hydrogen ignition by PARs is notconsidered in the safetycalculation.

NNR (South Africa)
Hydrogen ignition by PARs is notconsidered in the safetycalculation.

Two trains for five hydrogen sensors (10 intotal) are able to measure the hydrogenconcentration in various location in thecontainment. The operator can observe
the hydrogen concentration from themain control room.

In HPR1000, hydrogen concentration incontainment is continuously monitored byusing two measurement trains, which
consists of hydrogen detectors in different
parts of the containment, and theinformation is displayed in main control
room.

Hydrogen concentration ismonitored at specific locations
supporting SAMGs.

Hydrogen concentration ismonitored at specific locations
supporting SAMGs.

HPR1000 is under construction, according
to experience feedback of domestic
plants, periodic inspection andmaintenance are performed
correspondingly for PARs during outage,to verify their reliability during plant life.

Availability of PARs is assured bymaintenance and inspection
activities, during planned
outages. The inspection is doneusing a so called “Transportable
Inspection and Regeneration
Equipment” (TIRE) device. Thisequipment was designed toinspect the catalytic plates andallow their regeneration, if
needed. In case of efficiency
reduction, the plates are exposed
to a high temperature in order toeliminate the humidity or

The hydrogen monitoring equipment ismanually actuated and has a measuring
range of 0-15% vol concentration.
10. How is theavailability of PARsensured during thelife of the plant(examination,
inspection,
maintenance andtesting)?

Date: September 2020
Validity: until next update or archiving
Version 1

Submission describe at a high level how
the examination, inspection
maintenance and testing will be
performed. The examination,
inspection, maintenance and testing(EIMT) involves visual inspections andtesting of PAR performance, withregeneration of plates where required.

• In every refueling outage, visualinspection are performed for all PARs, toverify integrity and corrosion of shelland catalytic drawer, and to confirm
support function of structures, etc.
• According to locations and inspection
route, all recombiners are divided ingroups for function test, and a complete

18

Hydrogen concentration is also
monitored in the context ofalternative hydrogen sources
described in the last threeparagraphs of the South Africa
response in Section 2 above.
A visual and functional check isrequired periodically (during
shutdown). The functional checkuses special mobile equipment todetermine the efficiency of thecatalytic plates (i.e. mobile trolley,
heated cabinet, measurement
devices, operation panel, analysis
unit and gas supply). The efficiency
is tested by removing 3 catalytic
plates from each selected PAR andthen testing them in the mobile
tester for recombination rates,
temperatures, etc.

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

ONR (UK)

11. What are themeasures to protect
the PARs during plant
outage, if any, andwhat are the checks
before restart

No details have been submitted.

Date: September 2020
Validity: until next update or archiving
Version 1

NNSA (China)
test cycle is finished in 2 to 4 refuelingcycles.

ARN (Argentina)
impurities that may be depositedover the surface.

• For each recombiner, 3 adjacentcatalytic plates are chosen randomly,
and are respectively tested in specificequipment, with inlet gas flow rate 6.5
SLM, H2 volume concentration of 3%, at
60°C. PAR can be considered reliable if 3
tested plates pass the tests, with 75%
hydrogen elimination efficiency in 15
minutes.

Visual inspection is also
performed for all PARs, to verify
indication of shell and catalytic
drawer corrosion. Supports andanchorages are verified forstructural integrity, as well.

HPR1000 is still under construction, andprotecting measures of PARs during plant
outage have not been fixed. In reference
to experience feedback of domestic
plants, all recombiners are protected byshielding that prevents the possible
impurities in the containment atmospherefrom getting into contact with thecatalytic plates during plant outage. The
shielding are removed before refuelingmode ends, and checks are subsequently
conducted to confirm no block.

N/A

NNR (South Africa)
Specific maintenance and repair
work necessary during outages
may result in higher concentrationsof adverse materials in thecontainment atmosphere. These
could include solvents fromdecontaminable paint, solvents forcleaning purposes, aerosols from
drilling, grinding or demolition
work as well as welding gas andfumes, etc.
The functional resistance of thecatalyst against welding fumes andsolvents has been investigated andprincipally proven. Nevertheless to
avoid an unnecessary exposure of
the catalyst it is recommended toremove the catalyst-bearing insert
or to temporarily protect it bycovering inlet and outlet openings
during such work.
Specific maintenance and repair
work necessary during outages
may result in higher
concentrations of adverse
materials in the containment
atmosphere. These could
include solvents fromdecontaminable paint, solventsfor cleaning purposes, aerosols
from drilling, grinding or
demolition work as well as
welding gas and fumes, etc.
The functional resistance of thecatalyst against welding fumes

19

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

ONR (UK)

Date: September 2020
Validity: until next update or archiving
Version 1

NNSA (China)

ARN (Argentina)

NNR (South Africa)and solvents has been
investigated and principally
proven. Nevertheless to avoid
an unnecessary exposure of thecatalyst it is recommended toremove the catalyst-bearing
insert or to temporarily protect
it by covering inlet and outlet
openings during such work.
In the unlikely event that
poisoning of a catalyst plate
occurs, thermal regeneration of
the catalyst could be performed.
The regeneration process ofcatalytic plates is an efficientmethod to refresh their catalytic
activity.

12. Do safetycalculations take into
account availabilityof PARs during
shutdown events

No analysis for hydrogen management has
been presented for shutdown states.

The availability of PARs is considered insafety calculation.

For severe accidents, it is generally
expected that availability of equipment
providing low classification safetyfunctions are available when theirsafety function could be potentiallydemanded, and therefore any analysis
can take credit for correct performanceof the PARs when they are expected tooperate. PARs are not required in thecontainment building during complete
unloading of the core.
For design basis accidents, theavailability of only one FC2 PAR iscredited.

20(Not answered)

The safety calculations for thecase of events at power could
be considered enveloping forthe case of shutdown events.
See also the South Africa
response in Section 4 above.

Multinational Design Evaluation Programme
Design-Specific Technical Report
TR-HPR1000WG-01 FOR PUBLIC USE

13. Are there PARs in
the spent fuelbuilding? Rationale
for having them ornot?

ONR (UK)
Not in the current UK HPR1000 design.
The severe accident analysis of the
spent fuel pool will be provided in thecourse of GDA. Arguments for nothaving PARs are expected to be:• Slow progression of severe accident• Many water sources before fueluncovery• And therefore the likelihood of fueluncovery• The UK HPR1000 design includes aventilation panel in the fuel building.

Date: September 2020
Validity: until next update or archiving
Version 1

NNSA (China)
There are no PARs in the spent fuelbuilding for HPR1000 design. Rationale for
not having them is that the process ofspent fuel melting is very slow, with aduration time from dozens to hundreds ofhours, and the main accident response
measure is water injection to avoid fueluncovering, and the means of water
injection is diverse and redundant. There
are venting systems installed in spent fuelbuilding, which can be prevent hydrogenconcentration when needed.

21

ARN (Argentina)
There are no PARs in the spent
fuel building.

NNR (South Africa)
There are no PARs in the spent
fuel building.