Jean Couturier, Hassan Abou Yéhia& Emmanuel Grolleau

Enhancing nuclear safety

Elements of nuclear safety
Research reactors

Elements of Nuclear Safety, Radiological Protection and Security series

Science and Technology Series

Elements of nuclear safety –Research reactors
Jean Couturier and Hassan Abou Yéhia
with the help of Emmanuel Grolleau
and contributors to the IRSN's Nuclear Safety Pole

Cover image: mosaics of photographs related to the subjects dealt with the different volumes of
the Elements of nuclear safety, radiological protection and security series. Highlighted, outlined inpurple, are those illustrating the themes developed in this second volume of the series.

Printed in FranceISBN (print) : 978-2-7598-2356-7 – ISBN (ebook): 978-2-7598-2357-4
DOI : 10.1051/978-2-7598-2356-7

All rights relative to translation, adaptation and reproduction by any means whatsoever are
reserved, worldwide. In accordance with the terms of paragraphs 2 and 3 of Article 41 of the French
Act dated March 11, 1957, “copies or reproductions reserved strictly for private use and notintended for collective use” and, on the other hand, analyses and short quotations for example orillustrative purposes, are allowed. Otherwise, “any representation or reproduction - whether in fullor in part – without the consent of the author or of his successors or assigns, is unlawful”(Article 40, paragraph 1). Any representation or reproduction, by any means whatsoever, will
therefore be deemed an infringement of copyright punishable under Articles 425 and following of
the French Penal Code.
© IRSN 2019

Preface
As part of IRSN's Science and Technology Series, the aim of the new “Elements ofnuclear safety, radiological protection and security” series is, like the 1996 publication
entitled Elements of nuclear safety by Jacques Libmann, to provide all those whose work
involves ionizing radiation, primarily in the nuclear industry, with information regarding
the technological culture relative to prevention and management of the related risks. This
new series is the result of the desire not only to update the 1996 publication, but also toextend its scope to areas previously not covered or only touched upon.
In its collection of scientiﬁc works, IRSN promotes the most advanced knowledge
acquired either within the Institute or in the context of national or international collaborations, focusing particularly on the educational value of its presentation. With this inmind, the speciﬁcations for this new series include clear explanations through recounting
the history of developments in techniques, ideas, approaches, organizations and regulations, or through questions raised and lessons learned from accidents and operating
feedback in general.
The series also aims to provide access for all those interested in these issues to technical knowledge and information that has been properly established and that can bechecked in the subject areas referred to, thereby applying IRSN’s three core values, Knowledge, Independence and Accessibility, as deﬁned in its Code of Ethics and Professional
Conduct.
We hope that this “Elements of nuclear safety, radiological protection and security”
series, coordinated by Jean Couturier, will contribute to disseminating knowledge, especially as a new generation of nuclear scientists and technicians takes over from the old.

*

*

*

The ﬁrst part of this publication gives a broad international overview of the diversity
and complementarity of research reactors. It describes the many uses of these reactors,

IV

Elements of nuclear safety – Research reactors

not least their signiﬁcant contribution to research for power reactors’ industrial development and safety – whether related to the development of more efﬁcient fuels or the studyof the types of accident affecting these reactors –, and it discusses some safety issues
speciﬁc to research reactors. Although the objectives, principles and safety (and radiological protection) approaches adopted for the design and operation of research reactors are
similar to those developed over time and used for power reactors, research reactors arevery diverse in terms of design and use very varied quantities of radioactive material. Someof them are operationally ﬂexible enough to be used for a wide variety of experiments,
with experimental devices that pose varying levels of risk (from the irradiation of inert
materials in a capsule to tests of nuclear fuel melt in a loop, in liquid sodium, in pressurizedwater, etc.).
In addition, many of the research reactors around the world are old and have been
through periods of temporary shutdown. Appropriate measures are necessary to manage
the ageing and obsolescence of some of their components and, on an organizational andhuman level, to keep them operating safely. There are also different types of operators
involved either in the operation of these reactors or their use; this can have an impact
on safety and radiological protection, and therefore also needs to be taken into
consideration.
Two speciﬁc chapters are devoted to the safety standards established under the aegis
of the IAEA for research reactors and to criticality and reactivity accidents at research
reactors.
These safety and radiological protection issues are discussed in more detail and illustrated in the case of French research reactors, in the second part of the publication. There
are also speciﬁc chapters on the French regulatory system and the ofﬁcial texts applicableto these reactors, on experience feedback from signiﬁcant events and accidents — including the Fukushima Daiichi nuclear power plant accident in 2011 —, on the account takenof reactivity accidents in the design of French research reactors, and on the ten-yearlysafety reviews carried out in France.
I would particularly like to thank Jean Couturier, the coordinator and main editor ofthis publication with Hassan Abou Yéhia, for this important – and unparalleled – synthesisof the subject, as well as Emmanuel Grolleau and everyone else who gave their valuable
support.
Jean-Christophe Niel
IRSN Director-General

Main contributors
Jean COUTURIER has worked for the ofﬁce of IRSN’s Director General since 2012,
supporting the roll-out of a knowledge management programme. He is also a senior expert
in safety policy and risk analysis. He began his career working for Novatome on the designof fast neutron reactors, in the areas of fuel and safety analysis. He joined IPSN in 1986 toassess the safety aspects of the PHENIX and SUPERPHENIX fast neutron reactors. His
activities then broadened to the nuclear safety of research reactors and pressurized water
reactors. From 2003 to 2005 he was Strategic Programme Director for Generation IV systems. He is a member of the standing group of experts for nuclear reactors.
Hassan ABOU YEHIA retired from IRSN in 2017. Having completed a doctorate inphysical sciences, from 1980 he held various technical and managerial posts at the CEA
followed by IPSN and IRSN, including safety assessment for different types of nuclear facilities in France – and throughout the world as part of assignments for the IAEA. From 2006
to 2012 he was responsible for the IAEA’s Research Reactor Safety Section (which also
covers nuclear fuel cycle facilities). Until the end of 2016 he coordinated IRSN’s nuclear
safety training activities and participated in the training courses organized by the European
Nuclear Safety Training & Tutoring Institute (ENSTTI).
Emmanuel GROLLEAU, has been, since the middle of 2018, assistant head of theservice responsible for conﬁnement and aerodispersion of polluants. Previously, he spent
several years within the criticality studies and computation service at SGN, part of the
AREVA group. He joined IRSN in 2004 to work for the assessment service responsible
for research reactor safety. In particular, he directed a number of assessments on which
presentations were given to the Advisory Committee for Nuclear Reactors. From 2007
to 2011 he worked for IRSN’s Strategy and Partnerships Department. From 2012 to the
middle of 2018, he has been assistant head of the service responsible for conducting safetyassessments of research-related facilities and reactors undergoing dismantling within
IRSN’s Nuclear Safety Expertise Directorate.

List of abbreviations
Glossary of institutions
AFCEN: French association producing rules for the design, construction and in-service
inspection of nuclear power plant components
AISI: American Iron and Steel Institute
ANCCLI: French national association of local information commissions
ANL: Argonne National Laboratory, USA
AREVA: French nuclear designer and operator (which subsequently became Orano andFramatome)
ARILL: Institut Laue–Langevin Retirees Association
ASME: American Society of Mechanical Engineers (ASME is often used to refer to thedesign and construction rules drawn up by this American society and used by nuclear
reactor designers [Westinghouse, etc.])
ASN: Autorité de sûreté nucléaire (French nuclear safety authority)
AVN: Association Vinçotte-Nucléaire, Belgium
CEA: Commissariat à l’énergie atomique et aux énergies alternatives (Alternative
Energies and Atomic Energy Commission), France
CERCA: Compagnie pour l’étude et la réalisation de combustibles atomiques (nuclear
fuel design and manufacturing company), France
CI: Information commission
CIS: Internal security committee
CLI: Local information commission
CNRS: Centre national de la recherche scientiﬁque (National Centre for ScientiﬁcResearch), France
CSIA: Commission de sûreté des installations atomiques (nuclear facility safetycommission), France
DAE: Department of Atomic Energy, India
DEP: Nuclear Pressure Equipment Department, ASN

VIII

Elements of nuclear safety – Research reactors

DOE: Department of Energy, USA
DSN: Nuclear Safety Department, CEA
DSND: representative in charge of nuclear safety and radiological protection for French
defence-related activities and facilities
EDF: Electricité de France (French power utility)
ENSREG: European Nuclear Safety Regulators Group (a European Commission
consultative group of independent experts)
FzK: Forschungszentrum Karlsruhe (Karlsruhe Institute of Technology, Germany)
GAAA: Groupement Atomique Alsacienne Atlantique, a French company
GRS: Gesellschaft für Anlagen- und Reaktorsicherheit (safety organization for nuclear
reactors and facilities, Germany)
HCTISN: Haut comité pour la transparence et l’information sur la sécurité nucléaire
(High Committee for Transparency and Information on Nuclear Security), France
IAEA: International Atomic Energy Agency, Vienna, Austria
ICRP: International Commission on Radiation Protection
ILL: Institut Laue-Langevin, France
INL: Idaho National Laboratory, USA
IPSN: Institut de protection et de sûreté nucléaire (Institute for Protection and Nuclear
Safety), France
IRSN: Institut de radioprotection et de sûreté nucléaire (Institute for RadiologicalProtection and Nuclear Safety), France
JRC: Joint Research Centre, European Commission
KIT (formerly FzK and KfK): Karlsruhe Institute of Technology, Germany
LLB: Laboratoire Léon Brillouin (joint CEA/CNRS research unit)
LSTC: Livermore Software Technology Corporation, USA
NEA: Nuclear Energy Agency, OECD
OECD: Organisation for Economic Co-operation and Development
PNC (formerly JAEA): Power reactor and Nuclear fuel development Corporation, JapanSCK CEN: Studiecentrum voor Kernenergie
Centre d'étude de l'énergie nucléaire
(nuclear energy research centre), Belgium
SCSIN: Service central de sûreté des installations nucléaires (central nuclear facility
safety service), France
SODERA: Société pour le développement de la recherche appliquée (company for thedevelopment of applied research), France
WENRA: Western European Nuclear REgulators Association
Technical glossary
ADS: Accelerator Driven System (subcritical hybrid reactor)
ALARA: As Low As Reasonably Achievable (a radiological protection principle)
ALIZÉ: name of a CEA nuclear research reactor (now permanently shut down)
APOLLO: name of a 2D neutron simulation software used for establishing multiparameter libraries of effective neutron cross-sections
AQUILON: name of a CEA nuclear research reactor (now permanently shut down)

List of abbreviations

IX

ARS: seismic reactor shutdown (high ﬂux reactor in Grenoble)
ASTEC: Accident Source Term Evaluation Code (system of simulation codes for evaluating the physical phenomena occurring during a core melt accident in a pressurizedwater reactor)
ASTER: Analyses des Structures et Thermomécanique pour des Etudes et des Recherches(thermomechanical and structural analysis simulation software system for studies andresearch)
ASTRID: Advanced Sodium Technological Reactor for Industrial Demonstration
ATPu: Atelier de technologie du plutonium (plutonium technology facility, now closed;
its main activity was the production of MOX [mixed oxide fuel] fuel for nuclear
reactors)
ATWS: Anticipated Transients Without Scram (automatic reactor shutdown without
insertion of control absorbers or transients with failure of the automatic reactor
shutdown system – also known as ATWR for anticipated transient without reactor trip)
AZALEE: name of a shaking table at CEA Saclay
BCS: control and safety rods (CABRI reactor)
BDBA: Beyond Design Basis Accident
BNCT: Boron Neutrons Capture Therapy (cancer treatment)
BORAX: BOiling water ReActor eXperiment (experimental reactor in the USA)
BR2: Belgium Reactor 2 (at the Mol research centre in Belgium)
CABRI: name of a CEA test reactor at Cadarache used to study accident situations inreactors (PWRs, SFRs)
CASHIMA: name of a research project looking at seismic “site effects”
Cast3M: name of a simulation software using the ﬁnite element method for structuraland ﬂuid mechanics
CATHARE: Code Avancé de THermohydraulique pour l’Etude des accidents de Réacteurs
à Eau (advanced thermohydraulic simulation software used for water reactor accident
analyses)
CDS: seismic depressurization system (RHF)
CEN: groundwater supply system (RHF)
CERES: name of a software for calculating the radiological impact of a release in an accident situation
CES: emergency cooling system (RHF)
CESAR: name of a CEA research reactor (now permanently shut down) or name of athermohydraulics module in the ASTEC software system
CFD: Computational Fluid Dynamics
CIP: Cabri International Program (an international program to study the behaviour of
nuclear fuel rods and cladding during a reactivity injection accident in pressurized water
reactors)
CPA: name of a module in the ASTEC software system
CRISTAL: name of a calculation route developed jointly by IRSN, CEA and AREVA toevaluate the risk of criticality in all nuclear facilities and transport casks containing
ﬁssile materials
CRONOS: name of a simulation software for 3D core neutronics calculation

X

Elements of nuclear safety – Research reactors

CRP: Coordinated Research Project
CRU: emergency core cooling (reﬂood) system (RHF)
CSA: Complementary Safety Assessment (post Fukushima Daiichi accident)
CSS: Commission on Safety Standards (IAEA)
DBA: Design Basis Accident
DEC: Design Extension Conditions
DIRAS: information package related to the cleanup of structures
DISCO: DIspersion of Simulated COrium (KIT experimental facility to study airborne
contamination/dispersion of corium, using inactive powders)
DULCINEE: name of a software used to simulate core thermohydraulics and thethermal behaviour of fuel in a reactor
ECS: évaluation complémentaire de sûreté (see CSA)EFPD: Equivalent Full Power Days
EIP: element important for protection (of “interests”, concept in French regulations)EL2: Eau Lourde 2 (a CEA research reactor, now dismantled)
EL3: Eau Lourde 3 (a CEA research reactor currently being dismantled)
EL4: Eau Lourde 4 (Brennilis nuclear power plant, France)
EOLE: name of a CEA nuclear research reactor
EPIC: French industrial and commercial public undertaking
EPR: European Pressurized Water Reactor
ESPN: nuclear pressure vessel
ETRR-2: Egypt Test and Research Reactor Number two
EUROPLEXUS: name of a ﬁnite element simulation software
FINAS: Fuel Incident Notiﬁcation and Analysis System (run by the IAEA)
FLICA: name of a software that calculates the thermohydraulics of a reactor core duringtransients
FP: ﬁssion products
FRM-II: Forschungsreaktor München II (research reactor in Garching, Germany)
GAZAXI: name of a software used for calculating the radiological impact of a release inan accident situation
GCR: gas-cooled, graphite-moderated reactor
GOR: General Operation Rules
GPD: standing group of experts for waste
GPDEM: standing group of experts for dismantling
GPE: standing group of experts
GPESPN: standing group of experts for nuclear pressure equipment
GPMED: standing group of experts for medical exposure
GPR: standing group of experts for nuclear reactors
GPRAD: standing group of experts for radiation protection (non-medical)
GPT: standing group of experts for transport
GPU: standing group of experts for laboratories and factories
GUS: ultimate diesel generator (JHR)
HARMONIE: name of a CEA nuclear research reactor (now dismantled)List of abbreviationsXI

HEMERA: Highly Evolutionary Methods for Extensive Reactor Analyses (software chain
for simulating the thermohydraulics and neutronics of transients in a nuclear reactor)
HFR: High Flux Reactor (high ﬂux reactor at the JRC in Petten, Netherlands)
HIFAR: High Flux Australian Reactor
HTR: High Temperature Reactor
IAEA: International Atomic Energy Agency, Vienna, Austria
IEA-R1: Instituto de Energia Atômica-Reactor 1 (Brazilian research reactor)
IGORR: International Group on Research Reactors
INB: basic nuclear installation
INES: International Nuclear Event Scale (developed by the IAEA)
INSAG: International Nuclear Safety GroupINSARR: Integrated Safety Assessment of Research Reactors
IODE: name of a module in the ASTEC software system
IRR1: Israel Research Reactor-1
IRS: International Reporting System for operating experience (system run by the IAEA
for reporting incidents at power reactors)
IRSRR: Incident Reporting System for Research Reactors (system run by the IAEA for
reporting incidents at research reactors)
ISIS: name of the critical assembly of the OSIRIS nuclear research reactor at Saclay
ISTP: International Source Term Program
ITER: International Thermonuclear Experimental Reactor (under construction at
Cadarache)
JHR: Jules Horowitz Reactor (CEA nuclear research reactor currently under construction)
LOOP: loss of off-site power
LS-DYNA: name of a ﬁnite element simulation software for dynamic structural analysis
MARIUS: name of a CEA nuclear research reactor (now permanently shut down)
MASURCA: critical assembly of the CEA at Cadarache
MC3D: name of a 3D multi-phase thermohydraulic software used to simulate the interaction between molten materials and coolant
MCNP: Monte Carlo N-Particle transport code (3D simulation software for particle
transport based on the Monte Carlo method)
MELUSINE: name of a CEA nuclear research reactor (now dismantled)
MHPE: Maximum Historically Probable Earthquake
MINERVE: name of a CEA nuclear research reactor at Cadarache
MNSR: Miniature Neutron Source Reactor
MORET: simulation software that solves the neutron transport equation using Monte
Carlo methods, mainly used for criticality studies
MOX: Mixed Oxide Fuel (UO2 + PuO2)
MTR: Material Testing Reactors (used for testing various materials and nuclear fuels)
NGO: non-governmental organization
NRU: National Research Universal (research reactor of Chalk River Laboratories, Canada)
NRX: National Research eXperimental (research reactor of Chalk River Laboratories,
Canada)XII

Elements of nuclear safety – Research reactors

NSRR: Nuclear Safety Research Reactor (Japanese research reactor used for safety
tests)NUSSC: NUclear Safety Standards Committee (IAEA)
OLC: Operational Limits and Conditions
OPAL: Open Pool Australian Lightwater (an Australian research reactor)
ORPHÉE: name of a CEA nuclear research reactor at Saclay
OSIRIS: name of a CEA nuclear research reactor at Saclay (now permanently shut
down)
OTHELLO: name of an experimental loop in the OSIRIS reactor
PAI: iodine ﬁlter
pcm: per cent mille
PSA: Probabilistic Safety Assessment
PCS: emergency control room (RHF)
PEGASE: name of a CEA research reactor (now permanently shut down)
PEGGY: name of the critical assembly of the PEGASE research reactor
PGA: Peak Ground Acceleration
PHEBUS: name of a CEA experimental reactor in Cadarache
Phebus-FP: international research programme to study the behaviour of ﬁssion
products in core melt situations in a pressurized water reactor
PHENIX: name of a CEA prototype nuclear power (and experimental) reactor at
Marcoule, a sodium-cooled fast neutron reactor (currently being dismantled)
PROSERPINE: name of a CEA research reactor (now permanently shut down)
PSA: Probabilistic Safety Assessment
PUI: on-site emergency plan
PWR: Pressurized Water Reactor
RA-2: name of an Argentinian research reactor
RADIOSS: name of a ﬁnite element simulation software
RAPSODIE: name of a CEA experimental sodium-cooled fast neutron reactor at
Cadarache (now permanently shut down)
RASSC: Radiation Safety Standards Committee (IAEA)
RCC-CW: rules for design and construction of French PWR nuclear civil works
RCC-E: design and construction rules for electrical components of French PWR nuclear
islands
RCC- M: design and construction rules for mechanical components of French PWR
nuclear islands
RCC-MRx: design and construction rules for mechanical components of nuclear
installations high-temperature, research and fusion reactors
RERTR: Reduced Enrichment for Research and Test Reactors (US program)
RFS: fundamental safety rule
RGEP: guillotine break of a “particular element” (concept used in the safety analysis of
the Jules Horowitz reactor)
RGSE: general surveillance and maintenance rules

List of abbreviations

XIII

RHF: high ﬂux reactor at Grenoble, France (nuclear research reactor of the Institut LaueLangevin)
RIA: Reactivity Injection Accident
RLC: risk limitation conditions (concept used in the safety analysis of the Jules Horowitz
reactor)RRDB: Research Reactor DataBase (run by the IAEA)
RSE-M: equipment in-service surveillance rules of French PWR nuclear islands
RSG-GAS: Reaktor Serba Guna – Gerrit Augustinus Siwabessy (Indonesian research
reactor)
RUS: Strasbourg university reactor or emergency secondary cooling system of the Jules
Horowitz Reactor, in construction at Cadarache, France
SAFARI-1: South African Fundamental Atomic Research Installation 1 (nuclear research
reactor)
SBO: station blackout
SCANAIR: software for simulating the thermomechanical behaviour of the fuel rods inpressurized water reactors during power transients
SCARABEE: name of a CEA research reactor at Cadarache (now dismantled)
SFRs: sodium-cooled fast neutron reactors
SIGMA: Seismic Ground Motion Assessment
SILOE: name of a CEA nuclear research reactor at Grenoble (currently being dismantled)
SILOETTE: name of a CEA thermal nuclear research reactor in Grenoble (criticalassembly of the SILOE nuclear reactor) (now dismantled)
SIMMER: name of a simulation software combining neutronics and ﬂuid mechanics,
used to simulate a fuel melt accident in a fast neutron reactor
SIREX: instrumentation and control electronic racks or cabinets in French research
reactors
SL-1: Stationary Low Power Reactor Number One (Idaho National Laboratories, Idaho,USA)
SME: Safe Shutdown Earthquake
SND: hardened safety core design earthquake
SOFIA: Simulateur d’Observation du Fonctionnement Incidentel et Accidentel(simulator of the operation of PWRs used by IRSN)SPERT: Special Power Excursion Reactor Tests, pressurized water type, operated byPhillips Petroleum Company as part of the U.S. Atomic Energy Commission program,
USA
SSC: Structures, Systems and Components
TECDOC: TEChnical DOCument (IAEA)TECV: French Act No 2015-992 on energy transition for green growth, adopted on
17 August 2015
HEPA: high efﬁciency particulate air (ﬁlter)
TRANSSC: TRANsport Safety Standards Committee (IAEA)
TREAT: Transient Reactor Test Facility (research reactor developed by Idaho National
Laboratories, Idaho Falls, USA)

XIV

Elements of nuclear safety – Research reactors

TRIDENT: name of a simulation software
TRIGA: TRaining, Isotope, General Atomics (pool-type research reactor developed byGeneral Atomics, USA)
TRIPOLI: TRIdimensionnel POLYcinétique (3D simulation software that uses the Monte
Carlo method to solve the coupled neutron/photon transport equation)
TSN: French Act No 2006-686 of 13 June 2006 on nuclear security and transparency
ULYSSE: name of a CEA nuclear research reactor (now dismantled). This was an
Argonaut class reactor, a research reactor model developed by the Argonne National
Laboratory in the USA (ARGONAUT stands for ARGOnne Nuclear Assembly for
University Training)
VARMA: acceptable modelled value for residual activity
VENUS: Vulcan Experimental Nuclear System (JRC research reactor in Mol, Belgium)
WASSC: WAste Safety Standards Committee (IAEA)ZEPHYR: Zero power Experimental PHYsics Reactor (a CEA reactor still in the planningphase)ZOÉ: ZerO Energy, an alternative name for the EL1 reactor. France’s ﬁrst research
reactor, located at the CEA centre in Fontenay-aux-Roses

Foreword
This publication on nuclear research reactors and particularly on speciﬁc characteristics
and issues of research reactors in terms of nuclear safety and radiological protection, waswritten by authors from IRSN, the French Institute for Radiological Protection and Nuclear
Safety.
It assumes that the reader already has a basic knowledge of the physics of nuclear
reactors and their operation; however, reminders are provided throughout the text onthese subjects in the form of notes or focus texts.
Jean Couturier is the main author – and the project coordinator – with contributions
from Hassan Abou Yéhia on international aspects, and assistance from Emmanuel Grolleau
and the unit in charge of assessing safety and radiological protection at French research
reactors. Speciﬁc contributions were made by Maud Corbel, Stanislas Massieux, Ludovic
Maas, Vincenzo Tiberi, Patrice François, Sandrine Soares, Elodie Cahen, Florence Gupta,
Stéphanie Kanamori, Mathieu Derotte, Céline Gelis, Eric Dumonteil, Bertrand Cochet,Tonino Sargeni and Jacques Ducau.
An effort has been made to ensure that external sources of information, including illustrations, have been credited. This was the case for the “monographs” by the Nuclear
Energy Directorate of the French Alternative Energies and Atomic Energy Commission(of the greatest interest), and for publications produced for conferences, ofﬁcial texts,
presentations available on websites, etc.
Daniel Quéniart carefully proofread the publication in its draft version. His contribution was important to the production of the ﬁnal version.
Thierry Bourgois, Martial Jorel, Gianni Bruna and Michel Bourguignon also proofread
draft versions of the whole text or sections of it. Their comments were taken into accountwhen it was ﬁnalized.
Odile Lefèvre and Georges Goué prepared the work for publication.

XVI

Elements of nuclear safety – Research reactors

Finally, during the production of this text we were keen to do more than simply
describe research reactors and their objectives and general principles in terms of nuclear
safety and radiological protection, which would have duplicated the work of many otherFrench and international publications; this would have produced a much less useful document, especially from an educational point of view. Technical substance was necessary toillustrate these objectives and principles. The authors would like to thank in this regard theDivision operating the high ﬂux reactor (RHF) in Grenoble (Institut Laue Langevin [ILL]) for
providing information and illustrations and allowing us to publish them. This material gives
a practical illustration, in the case of this particular reactor, of a number of (French)
nuclear safety and radiological protection principles and practices (particularly the tenyearly safety reviews and the experience feedback from the Fukushima Daiichi accident).

Contents
Preface...............................................................................................................................

III

Main contributors...........................................................................................................

V

List of abbreviations......................................................................................................

VII

Foreword...........................................................................................................................

XV

Chapter 1
Introduction
Part 1
General overview of research reactors at
international level
Chapter 2
The different types of research reactors, overall global situation,
uses and associated risks
2.1.

Types of research reactors..........................................................................................................................

7

2.2.

Global situation......................................................................................................................................................

13

2.2.1. Statistical data........................................................................................................................................

13

2.2.2. General nuclear safety and non-proliferation issues.........................................

14

Uses of research reactors and main related risks..................................................................

18

2.3.1. Training..........................................................................................................................................................

18

2.3.2. Fundamental research.....................................................................................................................

18

2.3.

XVIII

Elements of nuclear safety – Research reactors

2.3.3. Experimental irradiation................................................................................................................

19

2.3.4. Medical applications..........................................................................................................................

22

2.3.5. Activation analysis..............................................................................................................................

23

2.3.6. Industrial applications......................................................................................................................

24

Chapter 3
Aspects of the design and safety demonstration of research
reactors at international level
3.1.

Convergence of practices on a few main safety objectives, principles andsafety approaches .................................................................................................................

25

The IAEA safety standards ................................................................................................

26

3.2.1. Drafting process of the IAEA safety standards...........................................

27

3.2.2. Structure of the IAEA safety standards..........................................................

28

3.2.3. Brief presentation of the safety standards for research reactors.......

29

3.2.4. Application of the IAEA safety standards .....................................................

31

3.2.5. Supporting documents for application of the IAEA
safety standards .......................................................................................................

32

3.3.

IAEA exchange and assessment mechanisms ...........................................................

33

3.4.

Some general principles and approaches related to safety................................

33

3.4.1. Organization of safety control, safety culture............................................

33

3.4.2. Conﬁnement barriers, fundamental safety functions,defence in depth ......................................................................................................

36

3.4.3. The deterministic approach, design and safety demonstrationbasis – Situation regarding probabilistic studies
for research reactors ..............................................................................................

41

3.4.4. The graded approach..............................................................................................

42

3.5.

Periodic safety reviews .......................................................................................................

43

3.6.

Safety aspects of experimental devices ......................................................................

45

3.7.

“Envelope” accidents taken into account in research reactor
safety analyses.......................................................................................................................

47

3.7.1. Deﬁnition and characteristics of “envelope” accidents...........................

47

3.7.2. Source term evaluation for “envelope” accidents.....................................

49

Possible improvements to studies, research and development on
research reactor safety .......................................................................................................

50

3.2.

3.8.

Contents

XIX

Chapter 4International experience feedback for research reactors
4.1.

The IAEA incident reporting system (IRSRR).............................................................

60

4.2.

Serious incidents and accidents at research reactors............................................

61

4.3.

Complementary safety assessments carried out internationallyfollowing the accident at the Fukushima Daiichi nuclear power plant.........

63

Part 2
Research reactors in France
Chapter 5
Evolution of the French research reactor “ﬂeet”
5.1.

The diversity and complementarity of French research reactors ....................

71

5.2.

Current situation ...................................................................................................................

77

Chapter 6
Stakeholders and organization of research reactor safety in France
6.1.

Operators..................................................................................................................................

96

6.2.

Control of nuclear risks in France..................................................................................

97

6.3.

Key stages in the life of a research reactor..............................................................

105

6.4.

Internal licensing scheme ..................................................................................................

107

Chapter 7
Safety principles for French research reactors
7.1.

7.2.

General safety principles, concepts, approaches and objectives ......................

109

7.1.1. The defence in depth principle applied to research reactors ...............

112

7.1.2. Events selected for the design and safety demonstrationof research reactors................................................................................................

116

7.1.3. Reference accidents ................................................................................................

120

7.1.4. Application of general safety objectives........................................................

121

7.1.5. The graded approach in France .........................................................................

122

Speciﬁc safety features of research reactors............................................................

122

7.2.1. Power densities, fuel and core neutron characteristics...........................

122

7.2.2. Usage rates.................................................................................................................

127

7.2.3. Organisational and human factors...................................................................

128

XX

7.3.

Elements of nuclear safety – Research reactors

Features of research reactors by main safety function .......................................

130

7.3.1. Controlling core reactivity ...................................................................................

130

7.3.2. Cooling the reactor.................................................................................................

132

7.3.3. Conﬁnement of radioactive substances.........................................................

137

7.3.4. Criticality risks...........................................................................................................

139

Hazards......................................................................................................................................

141

7.4.1. Internal hazards ........................................................................................................

141

7.4.2. External hazards .......................................................................................................

144

7.5.

Experimental devices and research reactor-speciﬁc equipment .......................

151

7.6.

Radiological protection and waste substances.........................................................

153

7.6.1. Radiological protection..........................................................................................

153

7.6.2. Waste liquids and gases .......................................................................................

156

Emergency preparedness and management(crisis management).............................................................................................................

156

Safety aspects for decommissioning research reactors........................................

159

7.4.

7.7.
7.8.

Chapter 8
The reference accidents selected forFrench research reactors
8.1.

Deﬁnition and examples ....................................................................................................

161

8.2.

BORAX-type accident – main aspects.........................................................................

164

8.2.1. Accident at the SL-1 reactor ...............................................................................

164

8.2.2. Key lessons learned from the SL-1 reactor accident ...............................

166

8.2.3. Consideration of the BORAX-type accident in France............................

167

Demonstrative testing conducted in France .............................................................

172

8.3.

Chapter 9
Maintaining compliance with the applicablerequirements - Safety Reviews
9.1.
9.2.

Maintaining compliance with the applicable requirements,
managing obsolescence and ageing..............................................................................

177

Safety reviews ........................................................................................................................

178

Contents

XXI

9.2.1. History and approach ............................................................................................

178

9.2.2. Examples of signiﬁcant safety reviews...........................................................

180

Chapter 10
Operating experience feedback from French research reactors
10.1. Trends, some notable events and their management..........................................

187

10.1.1. Trends.........................................................................................................................

187

10.1.2. Some notable events and their management ..........................................

189

10.2. Measures to improve the safety of French research reactors following
the Fukushima Daiichi accident......................................................................................

206

Chapter 11
Overview of simulation software used indesign studies and safety analyses for French research reactors

Chapter 1
Introduction
Since nuclear fission1 was first discovered in 1938, scientists have taken a greatinterest in this property of matter which, when properly managed, can produce large
amounts of energy that can be converted into electricity. To develop the use of thisform of energy, it has been necessary over time to conduct numerous studies andexperiments, mostly using research reactors, which are essential for acquiring knowledge and developing the techniques necessary to design and operate nuclear power
plants under sufficiently safe conditions. But, in parallel, many other uses of research
reactors have also developed.
For the purposes of this publication, the widely used English term “research reactor”
is used, even though in France many of these facilities are known as “réacteurs d’experimentation” (experimental reactors). Research reactors are not to be confused withexperimental or prototype nuclear power reactors, such as the EL24 heavy water reactor
in France (Brennilis nuclear power plant) or the Lucens nuclear power reactor in Switzerland. However, some nuclear power reactors will be discussed if experiments were orare being conducted there (e.g. PHENIX, a sodium-cooled fast neutron reactor used
for electricity production) even though they are not strictly categorized as research
reactors.
Research reactors are nuclear facilities used to supply intense neutron fluxes3. These
reactors, which operate at low temperatures and pressures, are simpler than nuclear
1.
2.
3.

Phenomenon whereby the nucleus of a heavy atom splits into two smaller nuclei due to the impactof a neutron.
Eau lourde in French.
Refers to the number of neutrons passing through a closed unit of area during a unit of time.

2

Elements of nuclear safety – Research reactors

power reactors. They require little fuel and their fission product inventory4 remains
much lower. However, they require the use of a fuel that is much more highly enrichedwith uranium-235 than the fuel used in power reactors. The enrichment level of research reactor fuel can be as high as 20% uranium-235, or even 93% in some cases.
Since the divergence5 of the first nuclear reactor (Chicago Pile-1) on 2 December
1942 by a team led by Enrico Fermi at the University of Chicago (the first divergenceof a research reactor in France, the ZOÉ atomic pile6, took place in December 1948),
more than 800 research reactors have been or are being built throughout the world.
Around 220 research reactors are in operation in nearly 55 countries. Their thermal
power varies from 0 to 250 MW (compared to the thermal power of around3,000 MW of a PWR producing 900 MWe of electricity), but, in the case of around
90% of them, it is below 10 MW. Their designs, modes of operation and uses are very
diverse.
The many uses of research reactors include fundamental research and applied research (i.e. research with defined practical objectives), education and training of engineers and nuclear power industry personnel, and the production of radioisotopes for
medical use. In the applied research field, research reactors have played a key role inthe development of nuclear power reactor technologies, including the technologies ofdevices and systems that perform a safety role. Research reactors have made it possible
to conduct studies of the neutron physics of power reactor cores and to test the behaviour of the fuels and materials in these reactors under the effect of irradiation. They
have also enabled studies of accident situations to be conducted, up to and including
fuel melt and the resulting transfer of fission products into the environment.
As regards safety, like all nuclear reactors, research reactors host a chain reactionthat needs to be controlled, and they are therefore subject to all the risks associatedwith any other type of nuclear reactor (damage to the fuel, dispersion of radioactive
substances, irradiation of personnel, etc.). But the nature and scale of those risks varies
according to the research reactor and its uses. Consequently, safety analyses need to be
conducted on a case-by-case basis, and the conditions in which different experiments
are run must be checked to ensure that they are compatible with safety requirements.
However, there are some generic safety issues for research reactors. For many existing reactors (in operation), the service life for which they were designed has alreadybeen exceeded; 60% of them are more than 40 years old. Consequently, there are someparticularly pressing issues to be attended to as regards the ageing7 and obsolescence of
certain components and the need for upgrading work, particularly to take account of
more advanced knowledge of certain risks and changes in safety criteria.
Depending on type and use, research reactors can pose some specific problems
regarding human and organizational factors. For example, conducting experiments in research reactors can involve many reactor core handling operations, including while thereactor is in operation.
4.
5.
6.
7.

Expression commonly used to refer to the quantities and types (isotopes) of ﬁssion products.
Nuclear divergence is the start of the nuclear chain reaction process in a nuclear reactor.
ZOÉ (ZerO Energy) an alternative name for the EL1 reactor.
Known as “ageing management”. This concept will be discussed in more detail in paragraph 2.2.2.

Introduction

3This publication is in two parts:– the ﬁrst part gives a general overview of research reactors internationally andlooks at some generic aspects of the safety of these reactors. The actions andwork of the IAEA are presented, along with serious incidents and accidents
and the reassessments carried out internationally following the accident at the
Fukushima Daiichi nuclear power plant in 2011;– the second part, which goes into more detail, looks speciﬁcally at French
research reactors and at different aspects of their safety: the agencies involvedin and the structural organization of safety monitoring in France, general safety
objectives, principles and procedures, accidents taken into account for theirdesign, experience feedback (including from the accidents at the Chernobyl
and Fukushima Daiichi nuclear power plants), key improvements made duringsafety reviews, etc.

Part 1
General overview of research
reactors at international level

Chapter 2
The different types of research reactors,
overall global situation,
uses and associated risks
2.1. Types of research reactors" Different types for different applications
Because research reactors are designed differently according to their purpose
or application, they can be classified accordingly. In practice, we make a distinction
between:– Material Testing Reactors (MTRs), designed mainly for studying and testing
different materials and nuclear fuels, especially those used in power reactors,
or for producing radioisotopes for medical use;
– reactors with “neutron channels8”, often referred to as “neutron beams outside”
reactors, which are mainly used for fundamental research, e.g. neutron scatteringexperiments;

8.

In this document, the following expressions will be used: “neutron channel” will refer to theassembly consisting of – in the reactor pool – a “thimble” or “beam tube”, (the end of which
nearest the core, in the heavy water tank, is known as the “beam tube end”) and – outside thereactor pool (in the experiment hall) – a “neutron guide”.

Elements of nuclear safety – Research reactors

8– critical assemblies (or critical mockups), with very low thermal power, used particularly to determine nuclear data for validating software used to simulate coreneutronics (of power or research reactors);– reactors for safety studies, which are used speciﬁcally for studying accident situations representative of those likely to occur in power reactors, such as loss offuel cooling and reactivity injection9, which could lead to melting of fuel and therelease of ﬁssion products into the environment;– training reactors, which are generally of low thermal power and are used to train
nuclear industry personnel and for teaching at universities.

" Different designs
Unlike power reactors, which have gradually become limited to a small number ofdesigns, in the case of research reactors there is a wide range of different designs.
Among the wide variety of research reactors, there are two main groups:– heavy-water reactors10 (in which heavy water is used as coolant, moderator orneutron reﬂector),– reactors cooled and moderated by light water.
The other types of research reactors include those in which the neutrons are moderated by graphite, aqueous homogeneous reactors, which use a uranium nitrate or sulphate solution, and fast neutron reactors, which do not need a moderator but can use amixed uranium oxide and plutonium oxide fuel.
– Heavy water reactors:
Heavy water reactors are “tank in pool” reactors. They can produce intense fluxesof thermal neutrons, which are extracted from the core by means of neutron
channels, generally for fundamental physics research. The moderating propertiesof the heavy water enable neutron beams to be produced that contain no fast
9.

In order to characterise the risk of core runaway, the concept of reactivity is used: it is amagnitude (represented by ρ) for measuring how far a core is from its just-critical state (ρ = 0).
Typically, the inadvertent removal or ejection of a control or safety rod from the reactor core,
because it reduces the proportion of neutron-absorbing materials in the core, will lead toexcessive core “reactivity” and therefore an increase in heat, at least locally. If this is notcontrolled by the reactor’s surveillance and protection systems, it can cause signiﬁcant damage oreven cause fuel elements in the core to melt. The terms “insertion” and “injection” areinterchangeable in this context. The term “power excursion” refers to the power transient caused
by a reactivity injection.
10. For reactors using uranium-235 fuel, it is the slow, low-energy neutrons (E = 0.025 eV) that havethe highest probability of causing ﬁssion. With an effective moderator, the neutrons resulting
from the ﬁssion of uranium-235 are slowed down until their kinetic energy is around the thermal
agitation energy of the scattering medium (0.025 eV at a temperature of 300 K), without being
absorbed. Most ﬁssions occur at this energy, and the reactor is referred to as a thermal-neutron
reactor. Moderators are therefore used; heavy water (D2O) is the best moderator, ahead ofgraphite, beryllium and light water (H2O), in descending order.

The different types of research reactors, overall global situation, uses and associated risks

9neutrons (considered to be parasites), which are ideal for experiments on the physics of matter. However, these reactors are not really suitable for material testing
because the presence of a closed tank to hold the heavy water makes it difficult toaccess equipment near the reactor core.
– Light water reactors:
Light water reactors, also known as pool-type reactors, can have an open core or acore in an enclosed tank, in both cases in a pool (“tank in pool” reactor type).
These reactors are multi-purpose facilities generally used for the irradiation of different materials. Of the different types of research reactor currently in operation
throughout the world, these are the most common. Figure 2.1 below shows the
HFR reactor11, a closed-tank reactor, at Petten in the Netherlands.

Figure 2.1. The HFR reactor at Petten, a closed-tank pool-type reactor. Ó NRG.

Open core pool-type reactors generally give easy access to the irradiation locations,but their low pressure of use (similar to hydrostatic pressure) means that there is lessremovable heat and therefore that the neutron fluxes are more limited.
In pool-type reactors with a closed tank, higher thermal power levels can beachieved (with greater pressures than in open core reactors), but they are more difficult
to use for experimental irradiation because of the need for devices that penetrate thetank for closer access to the core; the neutron fluxes outside the tank are lower becauseof neutron absorption by the tank material.
Open core pool-type light water reactors operate at low pressures (a few bars),
determined by the hydrostatic pressure of the height of water above the core (aroundten metres) plus the discharge pressure of the pumps circulating the water in the core.
With light water reactors where the core is in a closed tank and heavy water reactors,
the operating pressures can be significantly higher (around 10 to 20 bars).
11.

High Flux Reactor.

Elements of nuclear safety – Research reactors

10

Of the closed-vessel reactors, it is worth mentioning the design used for the BR212
reactor, developed by SCK CEN at the Mol research centre in Belgium13, to make it easier to conduct experiments. This reactor, rated at 100 MW, is moderated and cooled bylight water at a pressure of 22 bars; the core consists of a beryllium matrix. To facilitate
access to the irradiation locations, the core tank is in the shape of a hyperboloid of revolution (diabolo – figure 2.2) with the core in the narrow part. Its top cover, with adiameter around twice that of the narrow part, allows more room for the penetration
sleeves of the irradiation devices, which are inclined slightly off the vertical14.

Figure 2.2. Diagram of the BR2 reactor. Ó SCK CEN.

" Fuel and core of research reactors
In general, the cores of research reactors consist of fuel elements, control and safety
elements containing materials that absorb neutrons, reflector elements to reduce
12.
13.
14.

Belgian Reactor 2.
One of the biggest producers of radioisotopes for medical use.
“Les réacteurs de recherche”, Francis Merchie, Encyclopédie de l’énergie, 2015.

The different types of research reactors, overall global situation, uses and associated risks

11leakage of the neutrons produced in the reactor core, and spaces in which materials forirradiation can be placed.
The description below tends to refer to pool-type reactors.
With these reactors, the constituents of the core are placed on a grid supported by ametal structure at the bottom of the pool filled with demineralized water.
Fuel elements15 can come in the form of an assembly of uranium oxide-based rods,
but more often they are in the form of plates of a uranium alloy-based fuel (UAlx16 or
U3Si2) clad in an aluminium alloy (by “co-rolling”) (figure 2.3), placed (the plates arecrimped) in a vertical shell (figure 2.4) channelling the cooling water, which also acts
as the moderator. The core reflector is generally made from beryllium or graphite. It
can also be a tank of heavy water surrounding the reactor core. In the case of “neutron
beams outside” reactors, there are openings in the side walls of the pool for the neutron
channels to go through.

Figure 2.3. Stages in the “co-rolling” fuel plate fabrication process. The fuel core is a blend of fuelpowder (UAlx, U3Si2, UMox) and aluminium from melting U and Al, Si or Mo. Ó Georges Goué/IRSN.

Although some of the first research reactors could operate with natural uranium(containing 0.7% of its fissile isotope uranium-235), benefiting from the excellent
15.
16.

For more details, see the CEA’s publication entitled “Nuclear fuels”, a Nuclear Energy Division
Monograph, 2008, especially the “Research reactor fuels” chapter.
This is usually referred to as UAl. The same applies for UMox, which will be discussed later on andis commonly referred to as UMo.

12

Elements of nuclear safety – Research reactors

Figure 2.4. Different types of research reactor fuel elements and fuel assemblies. Ó AREVA-CERCA.

neutronic properties of heavy water or graphite as moderator and reflector17, most use
uranium enriched to between 20% and 93% uranium-235.
Among the pool-type reactors widely used throughout the world, it is worth mentioning the TRIGA (Training, Isotope, General Atomics) reactors designed and built by
the American company General Atomics18 (see figure 2.5 showing two of these reactors): some of their characteristics, particularly related to the fuel and the core, areof particular interest.
Nearly forty TRIGA reactors are currently in service. The most powerful of thesereactors is the TRIGA reactor at the Pitesti nuclear centre in Romania, which has a thermal power rating of 14 MW. The thermal power of the other TRIGA reactors ranges
from a hundred kW to 3 MW.
The core of a TRIGA reactor is positioned at the bottom of a pool containing demineralized water. It has a graphite or beryllium reflector and generally consists of arounda hundred fuel rods containing pellets made from a blend of uranium and zirconium hydride (UZrH) clad with stainless steel or 800 alloy19. The uniform blend of uranium (enriched to 19.75% of uranium-235) and zirconium hydride (used as moderator) produces
significant and immediate neutron feedback if the temperature of the blend increases
17.
18.

19.

The NRX (National Research eXperimental) and NRU (National Research Universal) reactors in
Canada, for example.
In 1996, General Atomics joined forces with the French company CERCA (Compagnie pour l’étude
et la réalisation de combustibles atomiques, a subsidiary of AREVA (Orano)) to create
TRIGA International. Since then CERCA has been responsible for the fabrication of the fuelassemblies for TRIGA reactors.
Iron, nickel and chrome alloys, which combine good ultimate tensile strength with excellent
resistance to oxidation and carburization at high temperatures in many aqueous environments.

The different types of research reactors, overall global situation, uses and associated risks

13

Figure 2.5. Left, the TRIGA reactor in Mainz, Germany. Ó Thomas Hartmann, Johannes Gutenberg
University Mainz; right, the TRIGA reactor at the University of Oregon, USA. Ó Oregon State Radiation
Center and School of Nuclear Science and Engineering.

(reactivity coefficient of around −10 pcm20/°C)21. Because of the good metallurgical stability of this fuel and its ability to function at high temperatures (normally 750°C, though
the fuel blend is stable at up to 1,150°C), and the high negative reactivity coefficient, the
TRIGA reactor can be “pulsed” by injecting reactivity at very high power levels (of up to
22,000 MW in the case of the TRIGA reactors currently in operation) for fractions of asecond. The rapid increase in power is quickly brought to a halt by the negative reactivity
effect of the moderator. It is also worth noting that UZrH fuel has good fission productretention potential compared to fuel plates made using aluminium.

2.2. Global situation
2.2.1.

Statistical data

According to the RRDB database22 – data from May 2018 – held by the International
Atomic Energy Agency (IAEA), 807 research reactors have been built throughout the
20.
21.
22.

pcm: per cent mille.
The coefﬁcient Δk/k /°C, representing the relative variation in the neutron multiplication factor byincreasing the temperature by one degree Celsius.
Research Reactors Data Base. The ﬁgures in this database include research reactors cover not justcivil nuclear facilities.

Elements of nuclear safety – Research reactors

14

world and 23 are planned or are under construction. Among the reactors already built,
430 have been decommissioned (more than half of these are in the USA), 223 are operational, and the other 154 are in extended shutdown without utilization (or not yet
decommissioned). Around:– 27% of research reactors have a thermal power of less than 1 kW;– 35% have a thermal power of between 1 kW and 1 MW;– 38% have a thermal power of more than 1 MW.
Among the reactors in operation worldwide:– more than 50% are MTRs and multi-purpose reactors (also produce, radioisotopes, have “neutron beams outside”, etc.);– around 20% of them are very low power critical assemblies;– just over 10% of them are small reactors mainly used for education and training.
The Russian Federation has the largest number of research reactors (in operationor temporarily shut down) (54), followed by the USA (50), China (16), Japan (9),Germany (7) and France (5)23. Many developing countries also have research reactors
or are planning to acquire them. Nine research reactors are under construction throughout the world and fourteen are planned.
Despite the growing interest in research reactors in developing countries, the total
number of these reactors globally is steadily diminishing (the reduction in numbers
since 2005 means that, on average, one research reactor is being closed per year). Thismay be due to the ageing of some facilities, which can only be brought up to a safetylevel considered acceptable today by carrying out major upgrading or modification
work. It could also be due to a lack of funds to operate and maintain them, or evento there being no utilization programme for them. In this regard, it should be noted thatnearly 40% of research reactors are underused (154 are in extended or permanent shutdown).

2.2.2.

General nuclear safety and non-proliferation issues

Despite the variety of designs and uses, some important general safety issues havebeen raised in relation to many of the research reactors in operation throughout theworld; these issues mainly concern:– maintaining safety levels as facilities age (in the broadest sense, including as
equipment becomes obsolescent),– safety management by their operators,– the effectiveness of regulatory monitoring of their safety.

23.

The ISIS, RHF, CABRI, ORPHÉE and MASURCA reactors are counted here in the RRDB database.

The different types of research reactors, overall global situation, uses and associated risks

15

These issues have been highlighted particularly by the various safety reports produced by the IAEA within the framework of different meetings and technical workshops,
based on experience feedback from its activities concerning research reactor safety,
including the results of numerous “safety assessment24” missions.
Another key generic issue is the “conversion” of research reactors originally designed to use fuel highly enriched with uranium-235 to use less highly enriched fuel(containing no more than 20% uranium-235), for non-proliferation reasons.
Management of ageing and the “conversion” of research reactors that use highly enriched fuel are discussed in more detail below.
Moreover, it was stated above that nearly 20% of research reactors are in extended
shutdown, which means that they are not used but there are no clear plans for their
future. This is a cause for concern for the IAEA, which is engaged in various actions
aimed in particular at improving the utilization of research reactors.

2.2.2.1.

Management of research reactor ageing

There are two aspects to this issue:– actual ageing, which is the result of various damage mechanisms – or pathologies – that can affect components (metal structures, civil engineering works,
cables and other electrical equipment, etc.) over time, which can lead to latent
deterioration (cracking, brittleness, etc.) despite the design, construction andoperational precautions25 taken;– equipment obsolescence in respect of the most recent technologies, standards
and safety requirements.
The IAEA’s experience feedback reports show that ageing and obsolescence areamong the leading causes of incidents at research reactors throughout the world.
Ageing and obsolescence especially affect material testing reactors, some of which
are also used to produce radioisotopes for medical use.
A country’s decision to renovate a research reactor or to shut it down, replacing it(or not) with a new reactor, will depend on a number of factors, in particular:– how much the facility is used;– the radioisotope needs of the country (or region) for medical applications;– the experimental studies required to support an existing or planned national
nuclear power generation programme;– changes in the reactor’s environment (urban, industrial, etc.);

24.
25.

The Integrated Safety Assessments of Research Reactors (INSARR).
Particularly in the form of margins, corresponding to “provisions” in the case of damage
mechanisms that can be anticipated and quantiﬁed.

16

Elements of nuclear safety – Research reactors– the scale and the feasibility of the renovation work required, as well as the cost,
including to reach a satisfactory safety level.
It should be noted that it is generally possible to replace all the components of research reactors, except their civil engineering works. This has been confirmed by the
major renovations carried out on a number of different research reactors.
As with other types of nuclear facilities, ageing and obsolescence in the case of research reactors can lead to a reduction in safety margins (as regards dreaded phenomena) if those changes are not detected or corrected in time.
Obsolescence can in particular lead to difficulties procuring spare parts to replacesafety-related components.
Ageing can affect safety-related equipment, e.g. corrosion of fuel element cladding,
the reactor pool liner or coolant system pipes. It can also increase the risk of “common
failure mode”26 of redundant components.
Although for many research reactors, most structures, systems and components(SSC27) are replaceable, in order to manage ageing a systematic approach is necessary,combined with an effective programme for this management. This means, for example,
the use of materials with good corrosion resistance or materials that are compatible
with one another (for welding, for radiation protection in pools28, etc.) or setting up
equipment inspection and maintenance programmes, including the surveillance of representative samples specifically to monitor and anticipate the ageing of safety-related
equipment. Generally, all parameters that could affect the ageing of facilities and leadto the degradation of safety-related structures, systems and components should bemonitored appropriately during the life of a reactor.
Ageing management should be set up and carried out in a proactive and anticipative
way, during the different phases in the life of a research reactor. For example, modifications made to a research reactor or its experimental devices should not obstructinspections or tests designed to detect signs that safety-related structures, systems
and components are ageing – and if possible should facilitate them. This can beachieved by making the equipment accessible (at the initial design stage of the facility)and keeping it so (during operation), though without exposing those carrying out theinspections, or anyone else, to ionizing radiation.
Finally, existing experience feedback on ageing, including from industrial facilities,
whether specific to the reactor in question or generic, must be taken into account as
part of ageing management. The IAEA keeps a database on this subject, the aim ofwhich is to share this knowledge worldwide.

26.
27.
28.

Failures of several components due to the same cause.
“Structures, systems and components” is a standard expression used particularly in IAEA
standards.
For example, lead can cause aluminium structures to corrode, depending on the physical andchemical state of the water.

The different types of research reactors, overall global situation, uses and associated risks

2.2.2.2.

17“Conversion” of research reactors using fuel highly
enriched with uranium-235

Where research reactors using fuels highly enriched with uranium-235 are used,
there is a risk that this fissile material could be diverted to a non-peaceful use. This risk
is particularly high given that the low radioactivity level of the fuel makes it easy tohandle.
Highly enriched uranium differs from the natural uranium or low enriched uranium
used in power reactors because of its high uranium-235 content (which can be as muchas 93%). The maximum “non-proliferation” content is considered to be 20%, given therisks associated with the diversion or theft of non-irradiated fuels and the risks related
to the production of plutonium during the irradiation of low enriched fuels in a reactor.
In the 1950s and 1960s, the USA and the Soviet Union started to export highly enriched uranium as part of their civil nuclear cooperation programmes (especially the US
Atoms for Peace programme launched in 1954).
In 1978, the US Department of Energy (DOE) launched the Reduced Enrichment for
Research and Test Reactors (RERTR) programme, the aim of which was to “convert” research reactors using fuel highly enriched with uranium-235, of US origin, to the use of
low enriched fuel (less than 20%). In the mid-1980s, the programme was extended toinclude facilities that produce radioisotopes, in particular with the development of technologies to produce molybdenum-99 for nuclear medicine using low enriched with uranium-235 targets.
In the early 1990s, the programme was extended again, in collaboration with Russian institutes, this time to reactors using highly enriched fuel of Russian origin. This
concerned highly enriched fresh and spent fuel at research reactors in Poland, Serbia,
Ukraine and Uzbekistan, as part of their “conversion” to low enriched fuel.
After the terrorist attacks of 11 September 2001 on the World Trade Center in New
York, efforts and resources to reduce the enrichment with uranium-235 of fuels used inresearch reactors were stepped up, especially with the launch by the US administrationof the Global Threat Reduction Initiative programme in 2004, which brought the RERTR
programme and other US initiatives together under a single umbrella. In particular it
aimed to tighten the licensing conditions for exports of highly enriched uranium for research reactors and to take back any exported highly enriched nuclear fuels after use, tokeep them secure.
From the launch of the RERTR programme to the end of 2011, some 75 research
reactors had been converted to low enriched fuel or had been permanently shut down(out of the 129 research reactors selected for conversion under this programme, including American university reactors). The programme objective is to complete the “conversion” of the remaining reactors by 2020, bearing in mind that, for 28 of them,“conversion” requires the “qualification” of a new high density UMo29 fuel (containing
around 7 grammes of uranium per cm³).
29.

Fuel made from a uranium-molybdenum alloy in an aluminium matrix (see ﬁgure 2.3).

Elements of nuclear safety – Research reactors

18

It is worth noting that the majority of “conversions” in developing countries havebeen carried out in cooperation with the IAEA and that “conversion” has offered someof them an opportunity to renovate safety-related equipment.

2.3. Uses of research reactors and main related risks
A number of research reactors on university or research organization sites are used
to train students, engineers and nuclear industry personnel, including personnel who
operate research reactors and power reactors, and also nuclear safety authorities.
Research reactors are also used for fundamental and applied research, especially inthe fields of nuclear physics and matter sciences, and for activation analysis, radiochemistry and nuclear medicine. They can be used to produce a wide variety ofradioisotopes for medical or industrial applications, and for agriculture and research,and to create materials modified by transmutation30 for the electronics industry. They
can also be used to test different types of nuclear fuel and to study the behaviour ofdifferent materials under irradiation or in simulated accident conditions.
These different research reactor uses are discussed in more depth in the next sections. It is also worth reading the report produced by the IAEA in 2007 giving a detailed
overview of the different uses of research reactors throughout the world31.

2.3.1.

Training

In principle, all research reactors can be used for education and vocational training
in the nuclear field. But for safety and accessibility reasons, low power research reactors(up to a few hundred kilowatts) are best suited to training activities, which can include
making neutron measurements and radiological protection measurements, and characterizing reactor cores by establishing the neutron-absorbing rod worth curve and measuring the temperature coefficient and power distribution. This type of reactor alsoenables trainees to acquire knowledge and practical experience of operating a nuclear
reactor (approach to criticality, divergence, etc.). It is obviously important to use specific core configurations with low potential reactivity to prevent reactivity accidents if
trainees do something wrong. It should also be noted that setting safety limits, a common operation in reactors used for teaching, requires special care from the point ofview of human and organizational factors, especially on the part of trainers and operating personnel.

2.3.2.

Fundamental research

The neutron beams of research reactors can be used for research into nuclear physics or the physics of condensed matter and to study crystalline structures by thermal30.
31.

Doping of silicon for the manufacture of electronic components.
Technical Reports Series No. 455: “Utilization related design features of research reactors: acompendium”, 2007. See also the CEA publication “Research Nuclear Reactors”, a Nuclear Energy
Division Monograph, 2012.

The different types of research reactors, overall global situation, uses and associated risks

19

neutron diffraction. Neutrons, which have a similar unit mass to that of a hydrogen
atom and have a neutral electrical charge, can easily penetrate most materials andare therefore ideal for exploring matter. Thermal neutrons travel at around 2,200 m/s,
and their wavelength is 0.18 nm (nanometres), which is perfect for studying crystalline
structures through diffraction because it is the same order of magnitude as the latticesize of crystals32.
The reactors best suited to neutron scattering and diffraction experiments and studies of the physics of solids are generally the reactors with a thermal power greater thanten megawatts and a neutron flux of more than 1014 neutrons.cm-2.s-1.
Using a “cold source” containing liquid hydrogen or liquid deuterium (at a temperature of around 20K) or a “hot source” containing graphite (at a temperature of around
1,500K) makes it possible to move the neutron energy spectrum and obtain higher orlower wavelengths for certain types of research. Using neutron channels, which canbe up to a hundred metres long, is a way of increasing the number of experiments installed around the reactor.
The main risks associated with experiments conducted using neutron channels arenormal industrial risks and irradiation risks for the experimenters. Severe irradiationof experimenters has happened at various facilities, due either to malfunctioning safety
devices (such as neutron beam shutters, radiation monitors or radiation measurement
and signalling devices), or to failure to respect safety instructions. Many of the experimenters affected have been from external organizations and have not necessarily beenfamiliar with the different risks associated with the experimentation zones where they
were working. As a result of these irradiation incidents, operators have taken measures
to make experimenters more aware of the risks associated with the areas they are working in (e.g. putting up notices at the entrance to each experimentation zone showing
the conventional and radiological risks in that zone). Material changes have also been
made, e.g. an audible and visual alarm being triggered whenever there is unauthorised
access to an experimentation zone where the dose rate is above a pre-set value.
Lastly, the risks associated with “cold sources” and “hot sources”, especially the risksof hydrogen or deuterium explosion and of steam explosion (through the interaction ofgraphite and water), which are likely to affect the core of a reactor or its confinement“barriers”, should be addressed in the context of the safety demonstration33 for thatreactor.

2.3.3.

Experimental irradiation

Research reactors with a thermal power above ten megawatts are the facility ofchoice for studying and qualifying nuclear fuels and the structural materials and components used in power reactors (vessels, internal equipment, neutron absorbers, etc.).

32.
33.

“Les réacteurs de recherche”, Francis Merchie, Encyclopédie de l’énergie, 2015.
The measures taken by the operator to obtain an appropriate level of safety at the facility should
be described in the documents justifying the rationale behind those measures and their adequacy,
usually known as the “safety demonstration”.

20

Elements of nuclear safety – Research reactors

Figure 2.6. Telescopic device at the OSIRIS reactor used to carry out slow power ramps, according to
IAEA Report 455. Ó DR.

Irradiation can be carried out under conditions representative of the neutronics andthermohydraulics of a power reactor in normal operation or, in the case of some reactors, under conditions representative of accident situations at power reactors, such asreactivity insertions or reductions in coolant flow rate to the reactor core, though notsevere conditions (e.g. core melt), which are studied specifically using safety testing
reactors.
The use of research reactors for this type of irradiation has major advantages overthe use of power reactors:– the higher neutron ﬂux means that the intended irradiation doses can beobtained more quickly (e.g. for studying the ageing of materials subject toirradiation);– having the ability to instrument the samples better means that more precise
measurements can be made of temperature, pressure and neutron ﬂux;
– being able to move the studied fuel samples closer to the reactor core using a(telescopic) “displacement device” makes it possible to simulate slow powerramps34 (ﬁgure 2.6);

34.

Slow changes in power in respect of rapid transients (“pulses”).

The different types of research reactors, overall global situation, uses and associated risks

21– the risks are lower if an accident occurs while an irradiation experiment is taking
place.
The irradiation is generally carried out in experimental devices containing the fuelsamples or materials to be irradiated under clearly defined conditions in terms of temperature, pressure, neutron flux and surrounding fluid (inert gas, water as liquid or
steam, liquid sodium, etc.).
Every irradiation device must be specially examined from a safety point of view,
looking particularly at the risks from possible interactions between the device andthe reactor, i.e. the potential impact of the device on the safety of the reactor and other“experiments”, and the impact, on the safety of the device, of events (connected withthe reactor itself or events such as internal or external hazards) taken into account in
the design of the reactor and the associated safety demonstration.
The experimental devices used include irradiation capsules − which are not instrumented − and irradiation loops, containing water, gas or molten metal (e.g. sodium for
sodium-cooled fast neutron reactors).
Irradiation capsules generally have two external physical “barriers” (metal envelopes) between the radioactive material and the outside, the integrity of which is surveyed by monitoring the pressure of the thin gas layer (nitrogen or helium) between
the two barriers. The safety of the capsules relies on design choices justified by calculations of the heating and increase in pressure of their different components during irradiation, and on the chemical compatibility35 of the materials used. Incidents haveoccurred involving irradiation capsules, where the barriers have burst or their integrity
has been lost, leading to contamination of the pool or other reactor structures, or evento the irradiation of experimenters.
Irradiation loops can be used to study the behaviour of nuclear fuels used in the different types of nuclear reactors, under conditions representative of normal, incident or
accident operating conditions in power reactors. These loops which, like the irradiation
capsules, have envelopes to act as barriers, differ in that they have a circuit to cool thesamples being studied. As explained above, the coolant can be water (pressurized), a gas
or even a molten metal.
The different parameters of an experimental irradiation device (pressures, temperatures, coolant flow rates in the case of loops, etc.) are continuously monitored while theirradiation is carried out. Security systems trigger automatic reactor scram or the device
itself to be brought back to a safe state (e.g. if a pressurized loop loses pressure), assoon as predefined limits are exceeded.
The main risks associated with irradiation loops include:– the risk of contamination and irradiation of personnel if the integrity of the loop
barriers is lost;– the risk of structural damage to the loop and the emission of projectiles, which
can affect reactor safety if the fuel sample being tested melts, potentially
35.

Risks of eutectic formation, galvanic corrosion (steel in contact with aluminium), etc.

Elements of nuclear safety – Research reactors

22

followed by a steam explosion (melting of the sample can be one of the objectives in some experiments).
Provisions are made to prevent these risks and limit their consequences.

Some reactors used specifically for safety tests– CABRI (Cadarache Research Centre, France)
Testing of the behaviour of nuclear fuels in cases of rapid reactivity
insertions (pressurized water reactors [PWRs], sodium-cooled fast neutron
reactors [SFRs]).
– SCARABEE (Cadarache Research Centre, France) – this reactor has
been shut down and dismantled
Tests to support the study of melting fuel accidents caused by fuel assembly
blockage in SFRs.
– PHEBUS (Cadarache Research Centre, France)
Tests related to cooling accidents in PWRs and the associated ﬁssion
product transfers.
– NSRR (Nuclear Safety Research Reactor, Tokai Mura, Japan)
Tests to support the study of rapid reactivity insertions in the case of fuels
for SFRs and light water reactors.
– TREAT (Transient Reactor Test Facility - Idaho National Laboratories, Idaho Falls, USA)
Tests to support the study of rapid reactivity insertions in the case of various
fuels (SFRs and light water reactors, etc.).
...................................................................................................................................................................................................................

2.3.4.

Medical applications

2.3.4.1.

Production of radioisotopes

Research reactors enable radioisotopes to be produced for use in many fields,
including nuclear medicine, industry, agriculture and research.
The use of radioisotopes for medical purposes is rapidly increasing globally. Every
year more than 30 million examinations and cancer treatments are carried out worldwide. Molybdenum-99 (99Mo) is one example of a very commonly used radioisotope. It
is used to prepare technetium-99m generators; technetium-99m is produced by theb decay of molybdenum-99 (half-life 2.75 days). Molybdenum-99 is a fission productobtained by irradiating small UAl fuel plates (the uranium can be enriched to varying
degrees). In some research reactors, molybdenum-99 is produced by neutron capture
in targets enriched with molybdenum-98.

The different types of research reactors, overall global situation, uses and associated risks

23

The reactors that produce most of the world’s molybdenum-99 are old reactors(BR2 in Belgium, HFR (Petten) in the Netherlands, NRU in Canada, SAFARI36 in South
Africa OSIRIS in France was shut down at the end of 2015), which frequently haveto be shut down for maintenance, risking a global shortage of molybdenum-99.
The risks associated with the production of radioisotopes in research reactors obviously include the risks of contamination and irradiation of operational personnel andthe risk of radioactive releases into the environment.

2.3.4.2.

Cancer treatment by neutron capture

A number of research reactors are used to treat cancer (melanomas, brain tumours).
The method they use, which is referred to by the acronym BNCT (Boron Neutron
Capture Therapy), is based on the absorption of neutrons by boron-10. It consists ofinjecting a boron-10 solution into the tumour to be treated and irradiating it with aneutron beam from the reactor. The absorption of neutrons by the boron-10 leads tothe emission of a (alpha) particles, which are highly ionizing. The cancer cells are destroyed locally by these particles, the distance of travel of which is of the same orderof magnitude as the diameter of the cells.
Further research is necessary to reduce the irradiation time of the patients and thedoses received by healthy cells.

Artificial radionuclides produced at research reactors andused in the medical sector– Diagnostic techniques:Technetium-99m (from molybdenum-99), xenon-133, tritium (3H),
carbon-14, ruthenium-97, iodine-125;– Therapeutic treatments:
b emitters (for synovitis, stenosis (diseases of the arteries), palliative
treatments (bone cancer): yttrium-90, strontium-90, rhenium-186,
erbium-169, copper-64, samarium-153,

c emitters (for cancers): cobalt-60, iridium-192,
b and c emitter (for thyroid cancer and hyperthyroidism): iodine-131.
...................................................................................................................................................................................................................

2.3.5.

Activation analysis

Activation analysis is a method for precisely determining traces of impurities insamples of materials required to have a high chemical purity. It is based on the conver36.

South African Fundamental Atomic Research Installation 1.

Elements of nuclear safety – Research reactors

24sion of stable atomic nuclei into radioactive nuclei through neutron irradiation of thesample being tested and on measurement of the radiation emitted by the radionuclides
formed in the irradiated material.
Activation analysis is the most common area of use of research reactors. Practicallyany reactor with a power of more than around 20 kilowatts can provide a sufficientneutron flux to perform these analyses. By using hydraulic or pneumatic tubes linking
the reactor to the analysis laboratories, elements with a short radioactive half-life canbe measured.
From a safety point of view, the risks associated with this type of research reactor
use are generally low. They are the risk of contamination of premises or persons in theanalysis laboratories, the risk of irradiation if a container carrying an irradiation capsulein a hydraulic or pneumatic tube system becomes trapped, and the risk of contamination of internal structures within the reactor if the irradiated samples overheat, causing
the loss of integrity of these structures and the destruction of the irradiation capsule.
The measures to be taken to avoid the above situations and to limit their consequences,and the list of materials which must not be irradiated in a reactor (e.g. mercury becauseof its corrosive properties), must be stated in the facility’s operating rules.

2.3.6.

Industrial applications

There are numerous industrial applications for research reactors. Only three ofthem, which are very common, will be mentioned below.
Neutron beams can be used for neutron radiography of various objects. Nondestructive testing using neutron radiography, which is based on the property ofneutrons that they are stopped by light nuclei, is a complementary technique to radiography, because it enables both thin slivers of light elements and thick pieces of heavy
elements to be examined. Neutron radiography is used for non-destructive testing in
the aeronautical and space industries (e.g. for testing the pyrotechnic devices in rocket
launchers), and in the nuclear sector. An example is the facility used for the neutron
radiography of irradiated fuels associated with the PHENIX reactor at Marcoule, France,
which consists mainly of a small reactor with a vessel containing a fissile solution(uranyl nitrate), equipped with a cooling system, a fixed reflector and a mobile reflector,
which can be moved closer to the vessel to start the chain reaction.
The neutron irradiation of silicon ingots changes the silicon through the uniform
generation of phosphorus-31, which turns it into a semi-conductor. This method canbe used to achieve an excellent distribution of resistivity in silicon ingots used in the
manufacture of components for the electronics industry, such as diodes and thyristors.
Irradiation with fast neutrons causes colouration of topaz, which is used in
jewellery-making. This activity is prohibited in many countries, but is still carried out
in some research reactors throughout the world.

Chapter 3
Aspects of the design and safety
demonstration of research reactors
at international level
3.1. Convergence of practices on a few main safety
objectives, principles and safety approaches
The construction of nuclear reactors (whether for research or power generation)
began in the mid-20th century in a few countries (USA, former Soviet Union, France,
UK, etc.) that were engaged in the research and development of technologies that could
use the energy produced by nuclear fission to generate electricity.
In view of the safety and radiological protection issues raised by these facilities,
which mobilized nuclear materials and radioactive fission products, and to avoid theexposure of workers and the public and the release of radioactive substances into theenvironment, the industry, in liaison with the safety organizations and authorities thatwere gradually set up, adopted various fundamental safety objectives, principles, procedures and criteria. These included, for example:– compliance with “main safety functions”, namely37, for all reactors, control of core
reactivity, removal of the heat released by the radioactive material, and conﬁnement;
37.

The wording used by the IAEA (e.g. in document SSR-3, which will be discussed in section 3.2.3) is
as follows: “The design for a research reactor facility shall ensure the fulfilment of the following
main safety functions (…) for all states of the facility: (i) control of reactivity; (ii) removal of heatfrom the reactor and from the fuel storage; and (iii) confinement of the radioactive material,
shielding against radiation and control of planned radioactive releases, as well as limitation of
accidental radioactive releases.”Elements of nuclear safety – Research reactors

26– the insertion of several physical conﬁnement “barriers” between the radioactive
materials or substances and the environment;– the classiﬁcation of equipment according to its importance for safety (“safetyclassiﬁcation”);– or even the adoption of a redundancy principle38 for the most important safetyrelated systems.
They also adopted methods and approaches for safety analysis and demonstration,e.g. the determination and analysis of normal, incident and accident events related to
the facilities themselves, and of events (hazards) that could cause damage to the facilities, whether of internal or external origin (fire, floods, earthquakes, etc.).
In parallel the industry developed rules for the design (including the dimensioning39)
and the construction of equipment, based on proven best practice and offering different
requirement levels – to be chosen for each item of equipment on the basis particularlyof its safety classification.
The practice of sharing experience feedback was gradually established, nationallythen internationally, and in some countries, particularly France, the practice of carryingout periodic safety reviews (described below in sections 3.5 and 9.2) developed, including for French research reactors from the 1990s onwards.
The representative bodies – industrial, technical safety organizations, safety authorities, etc. – in these countries contributed their experience and expertise to the draftingof the IAEA safety standards for international use. These IAEA safety standards, which
incorporated this “knowledge”, were the subject of a consultation with all the Member
States40 to achieve a broad consensus.
The IAEA safety standards are documents which are not binding but are used as reference documents on the basis of which the IAEA conducts safety assessments when
asked to do so by a Member State. Particularly in the case of research reactors, many
Member States have written these safety standards into their own national regulations.
This chapter, which looks at some issues of the design and safety analysis ofresearch reactors at international level, refers to the document reference base of the
IAEA.

3.2. The IAEA safety standards
The IAEA’s statute enables it to establish safety standards, to promote their application by its Member States and to provide assistance in this area to any Member Statesthat request it.
38.
39.
40.

Redundancy, or possibly more, for certain systems, equipment or components, in order to improve
the reliability of their functions.
Determining the technical characteristics (geometry of equipment, ﬂowrate of pumps…) of a
facility during the design process to satisfy pre-established criteria and regulatory requirements.
On 23 October 1956, 81 States approved the Statute of the IAEA, which came into being on
29 July 1957. On April 30, 2018, the IAEA had 170 Member States.

Aspects of the design and safety demonstration of research reactors at international level

27

A Code of (good) Conduct on the Safety of Research Reactors was adopted by the
IAEA Board of Governors in March 2004. This Code, the text of which is similar to thatof the Convention on Nuclear Safety, which applies solely to power reactors, is a highlevel document that is also not legally binding. It lays down guidelines for developing
and harmonizing national practices as regards regulation and defines the ideal conditions for managing the safety of research reactors.
This Code of Conduct is a key element of the IAEA’s programme of activities related
to research reactors. This programme, approved by the Board of Governors, in particular
involves the development of safety standards which inform or contribute to the application of the Code of Conduct, the organization and performance of safety assessments(INSARR), the organization of regional or international meetings on specific issues, andtraining carried out nationally or regionally to promote the guidance in the Code of
Conduct. The IAEA intends that this programme will facilitate the sharing of operating
experience feedback and lessons learned from events occurring at research reactors,
especially through the Incident Reporting System for Research Reactors (IRSRR) andassociated periodic meetings (see chapter 4 for more details). The IRSRR is managed
by the IAEA, just like the IRS41 for power reactors and the FINAS42 system for fuel cycle
facilities. However, it should be noted that only a few major or valuable incidents interms of the lessons learned are entered into these databases.

3.2.1.

Drafting process of the IAEA safety standards

The IAEA Secretariat organizes the drafting of the IAEA safety standards with thesupport of four specialist committees (competent respectively in the fields43 of nuclear
safety, radiation safety, transport safety, and waste safety), overseen by the Commission on Safety Standards (CSS). The work of the CSS has to be approved by the Member
States within the Board of Governors. The process of drafting new standards or revisingexisting standards is shown in the diagram in figure 3.1. IRSN and the the French nuclear
safety authority (ASN) are extensively involved in the development of these IAEA safety
standards.
It is worth mentioning that other specialist international organizations sometimes
take part in the development of these standards, either through direct involvementin their drafting or by commenting on the draft texts.
Through the process described above, a broad consensus is reached on the IAEA
safety standards among the Member States. Consequently, implementation of the highlevel standards (safety fundamentals and requirements – see section 3.2.2) can beviewed as necessary to achieve an adequate level of safety for nuclear facilities, bearing
in mind that responsibility for monitoring their safety remains a national responsibility.
All safety standards (including guides) are generally reviewed five years after publication
to decide whether revision is necessary.
41.
42.
43.

International Reporting System for operating experience.
Fuel Incident Notiﬁcation and Analysis System.
To be more speciﬁc, the Nuclear Safety Standards Committee (NUSSC), the Radiation Safety
Standards Committee (RASSC), the Waste Safety Standards Committee (WASSC) and theTransport Safety Standards Committee (TRANSSC).

28

Elements of nuclear safety – Research reactors

Figure 3.1. Process for the development or revision of the IAEA safety standards (note that for safety
requirements and safety fundamentals, ﬁnal endorsement is given by the Board of Governors).
@ Georges Goué/IRSN.

3.2.2.

Structure of the IAEA safety standards

The IAEA safety standards consist of three types of document: from the most general to the most specific, there are the safety fundamentals, the safety requirements
and the safety guides.
The safety fundamentals present the objectives and general principles on which the
IAEA’s different standards for nuclear safety are based.
The safety requirements specify the requirements to be met to protect people andthe environment.
The safety guides provide information and clarifications to help with applying thefundamentals and requirements; where appropriate, they are accompanied by examples
of best practice.
The IAEA safety standards can be split into two main families: thematic standards
and standards specific to a particular type of nuclear facility or activity. Separate safety
requirements can therefore be drawn up for cross-cutting (thematic) fields and forspecific facilities or activities (nuclear power plants, research reactors, fuel cycle facilities, radioactive material handling and transport, etc.). There are not very many thematic safety guides, but there are numerous guides for the different types of facility.

Aspects of the design and safety demonstration of research reactors at international level29

In 2006 the IAEA adopted a new structure for the safety standards (figure 3.2),
which aims to ensure that there are clear, logical links between the safety fundamentals, the safety requirements and the safety guides.

Figure 3.2. Structure of the IAEA safety standards Series. @ Georges Goué/IRSN.

Within this structure, the general safety requirements have been grouped together
in a single document, whereas the facility- and activity-specific safety requirements are
separate documents. The new structure also takes the same approach to integration of
the different fields (nuclear safety, radiation safety, waste safety and transport safety)
as the approach used for the safety fundamentals.

3.2.3.

Brief presentation of the safety standards
for research reactors44

A set of safety standards has been established by the IAEA as part of its research
reactor safety activities. Whereas the majority of these standards fall into the category
44.

Published up to June 2018.

Elements of nuclear safety – Research reactors

30of standards specific to a type of facility, other important safety issues for research
reactors, such as emergency preparedness and response45, fall into the thematic category.
All organizations involved in research reactor safety, whether designers, operators orusers, or indeed inspection bodies, can find these safety standards useful. They are written especially so that they can be used when drafting national regulations.
The standard SSR-3 (Safety of Research Reactors – Specific Safety Requirements)
published in 2016 to replace the standard NS-R-4, contains safety requirements applicable to different types of research reactors cooled by (light or heavy) water with athermal power of no more than a few tens of megawatts. For other types of research
reactors and for research reactors with a higher thermal power rating, the safety
requirements in the safety standards for power reactors can be used.
Compared to the standard NS-R-4, the standard SSR-3 introduces additional
requirements on topics including:– the “design extension conditions”46; this topic, which means that the accounttaken of postulated events in the design and for the safety demonstration of a
nuclear reactor is extended, is discussed further later on;– the use of a “graded approach”; this also is explained in more detail later on;– the feedback of operating experience;– the interface between nuclear safety and nuclear security47 – safety measuresand security measures should not compromise one another;– the management of waste from research reactor operation.
The requirements in the standard SSR-3 deal with essential safety issues, including
safety governance, regulatory control, safety demonstration and quality assurance,
but also all the key stages in the life of these facilities, from choice of site, design(confinement barriers, main safety functions, defence in depth, etc.), construction, commissioning, operation, utilization and modification of research reactors, to final decommissioning.
The standard SSR-3 also requires that operators of research reactors have an independent safety committee (or advisory group48) to advise them on the safety aspects of
45.

46.
47.

48.

See the IAEA documents: General Safety Requirements No. GSR Part 7: “Preparedness andResponse for a Nuclear or Radiological Emergency”, and General Safety Guide No. GS-G.2.1:“Arrangements for Preparedness for a Nuclear or Radiological Emergency”.
Accidents that are more severe than Design Basis Accidents, caused by internal or external
hazards (based on the IAEA’s deﬁnition of postulated initiating events).
This topic is not discussed in this report; for more information please refer to the document “Acomparative approach to nuclear safety and nuclear security”, Reference documents series, IRSN
2009/117, available on the IRSN website.
Independent of the operating organization or the reactor manager (the member of the reactor
management team to whom the operator gives direct responsibility for, and authority over,
operation of the research reactor and whose functions consist primarily of fulﬁlling this
responsibility).

Aspects of the design and safety demonstration of research reactors at international level

31

their reactor (design, commissioning, operation) and its utilization (experiments, training, etc.).
The committee members should be specialists in different fields on which the safetyof the research reactor concerned depends; they may be external experts independentof the operating organization. The safety questions or issues to be considered by thecommittee include:– the design, including the chemical composition, of nuclear fuel elements andreactivity control elements,– modiﬁcations to operational limits and conditions,– proposed new tests or experiments, and also systems, equipment or proceduresthat have signiﬁcance for safety,– proposed modiﬁcations to elements of the facility that have signiﬁcance forsafety,– incidents that must be or have been reported to the regulatory body,– periodic safety reviews of the facility,– reports on radioactive discharges into the environment (in normal, incident or
accident conditions) and on radiation doses to personnel at the facility and to the
public.
There are a number of safety guides to help with the application of the requirements
presented in standard NS-R-4 (and consequently those listed in standard
SSR-3) for research reactors. A list of them, with comments, is provided in table 3.1
at the end of this chapter (guides in existence as at July 2018).

3.2.4.

Application of the IAEA safety standards

As stated above, the IAEA safety standards are the expression of an international
consensus aimed at protecting people and the environment. Despite this, the Member
States are not legally bound to apply the safety standards. However, the IAEA does
apply them to its own activities carried out under agreements to provide assistanceor equipment signed with Member States. These agreements also stipulate that thecountry receiving assistance with acquiring or operating a research reactor must adhere
to the IAEA safety standards.
More generally, the IAEA encourages its Member States to include in their national
regulations and apply to their facilities the safety standards on research reactors as wellas the standards on the regulatory and governmental infrastructure required for nuclear
safety, radiation safety, the safety of radioactive waste and the safety of radioactive
materials transport.
Finally, as stated above in section 3.1, all the standards are used as a reference by
the IAEA when conducting safety assessments.

Elements of nuclear safety – Research reactors

32

3.2.5.

Supporting documents for application of the IAEA
safety standards

Other documents known as safety reports and technical documents (TECDOC) are
published by the IAEA in addition to the safety standards. They do not make any
new recommendations and their only purpose is to facilitate the application of thesafety guides by providing technical information, practical examples and detailed methods. There are many documents of this type related specifically to research reactors.
They cover areas such as the technical and regulatory infrastructure to be set up by
countries wishing to launch a nuclear power generation programme by building theirfirst research reactor, the “conversion” of research reactors (to use low enriched withuranium-235 fuels), site evaluation, source term49 evaluation and evaluation of theradiological consequences of accidents, implementation of an integrated management
system, ageing, extended shutdown and decommissioning of facilities, and the corresponding safety analyses.
The process of preparing these documents is simpler than for the safety standards,
because they do not have to undergo the full review and approval process used for the
IAEA safety standards.
We saw earlier that a significant proportion of research reactors are in extended
shutdown. In 2004 the IAEA wrote a technical document on this subject, TECDOC1387 entitled Safety Considerations for Research Reactors in Extended Shutdown. This
document makes some recommendations and suggests practices considered satisfactory in relation to the various safety issues raised by this situation, for example:– maintenance of skills and a memory of the facility’s technical history,– qualiﬁcation of the personnel used,– human resources, retention of enough personnel to respond in an emergency,– equipment (including instrumentation) that can be decommissioned,– conditions for the preservation of equipment (which can mean removing it forstorage in a less harsh environment [mothballing], e.g. unloading of the core forstorage),– surveillance, periodic testing and maintenance of structures, systems andcomponents,– preventing criticality risks, dealing with neutron moderators used to operate thereactor (e.g. in the case of heavy water reactors, removal of the water for safe
storage),– radiological protection,– adaptation of the operating rules, the associated documentation, updating of
documentation,
49.

The expression “source term” refers to releases from a facility in an accident, expressed as
Becquerels (Bq) of each radionuclide.

Aspects of the design and safety demonstration of research reactors at international level33– procedures for restarting a reactor after an extended shutdown (especiallypre-operational testing of equipment), etc.

3.3. IAEA exchange and assessment mechanisms
The IAEA uses the following resources in the context of its activities to improvesafety at research reactors worldwide:– international or regional meetings on the application of the Code of Conduct on
the Safety of Research Reactors. Indeed, these meetings amount to discussions
forums where the participants can share their experience and identify safety bestpractices. Self-assessments carried out during these meetings also enable the
IAEA to identify more clearly the Member States’ needs and any areas where
safety management at research reactors could be improved. This information isthen taken into account in the deﬁnition and performance of the IAEA’s
programmes of activities;– national or regional training workshops on speciﬁc topics identiﬁed by the IAEA as
important for the requesting country or the region;– INSARR missions, which can be carried out at Member States’ request to assess
the safety of research reactors or to help resolve safety or radiological protection
issues of a technical or organizational nature, including on inspection andregulation. These assessments cover around twenty topics. They are carried out
by the IAEA with the participation of experts from operator organizations orsafety bodies in different countries;– more speciﬁc expert missions can also be organized to give the requesting bodies
advice and assistance with resolving speciﬁc safety issues;– periodic meetings, organized on average every 18 months as part of the IRSRR
system, to exchange information about signiﬁcant events that have occurred at
research reactors and that could offer lessons for all research reactors.
Finally, the IAEA’s technical cooperation programmes provide financial support topromote the participation of specialists from Member States that are (nuclear) developing countries in the meetings and workshops listed above. The IAEA’s resources are also
used to conduct INSARR missions and expert missions required as part of technicalcooperation projects set up with the countries concerned.

3.4. Some general principles and approaches related
to safety
3.4.1.

Organization of safety control, safety culture

The fundamental safety principles and objectives are the subject of document SF-1
entitled “Fundamental Safety Principles”, published by the IAEA in 2006. This document

34

Elements of nuclear safety – Research reactors

sets out the basis for the safety requirements. The ten safety principles discussed in thisdocument concern nuclear safety and radiological safety. The document states that thefundamental safety objective is to protect people and the environment from harmful
effects of ionizing radiation. The key principles presented concerning the organizationof safety are:– the prime responsibility for safety rests with the person or organization
responsible for facilities and activities that give rise to radiation risks. The licensee
retains the responsibility throughout the lifetime50 of the facility or activity andcannot delegate it;– an effective legal and governmental framework for safety must be establishedand sustained. The government is responsible for the establishment and adoptionof the necessary legislation and regulations. It is also responsible for establishing a
regulatory body independent of the operator organizations, with legal authority,
technical and managerial competence, and the resources to fulﬁl its
responsibilities;– an effective integrated management system (for quality, safety, etc.) must be
established, that ensures the promotion of a “safety culture” (a concept explainedin more detail later on). Regarding accidents, the primary means of preventing
them and mitigating the consequences of any that do occur is defence in depth(see section 3.4.2);– the safety of facilities and activities that give rise to radiation risks must be
assessed using a “graded approach” taking account proportionately of thepotential risks associated with them (see section 3.4.4).
In practice, there are major disparities in the application of these safety principles
and objectives at research reactors throughout the world. These disparities concern:– the effectiveness and independence of the regulatory and inspection bodies,taking account of the skills and resources at their disposal;– the updating of safety documentation to reﬂect the true state of facilities;– the validity and the “envelope” nature of the safety analyses of these facilities.
However, it should be noted that, in countries where the construction of a new research reactor is considered to be an important step in preparations for a nuclear power
generation programme, safety and regulatory texts generally refer these days to the
IAEA safety standards and to international best practice.
The concept of safety culture emerged from the reflection process following theaccident at the Chernobyl nuclear power plant on 26 April 1986. While the measurestaken following the Three Mile Island accident in 1979 focused particularly on theergonomic and cognitive aspects of workstations in reactors and other nuclear facilities,
the Chernobyl accident raised questions of a different kind, concerning organizational
factors. The development of a safety culture within organizations active in the nuclear
50.

Including, at the end of its life, issues related to dismantling and waste management.

Aspects of the design and safety demonstration of research reactors at international level35

sector has generally been considered to be the appropriate response. As a result of the
post-Chernobyl reflection process, it was felt that a more international vision of nuclear
safety was necessary. This led to the issue of various reports by INSAG51, an international group of experts in nuclear safety created within the IAEA. They included theSummary Report on the Post-accident Review Meeting on the Chernobyl Accident(Safety Series No.75-INSAG-152) published in September 1986, which introduced thesafety culture concept. The concept was discussed in more detail in 1991 in the report
entitled Safety Culture (Safety Series No.75-INSAG-4). Safety culture is defined as “thatassembly of characteristics and attitudes in organizations and individuals which establishes that…) safety issues receive the attention warranted by their significance”. In particular, safety culture assumes that, within an organization, a questioning, careful andthorough approach and good communication between individuals are encouraged.
Two other INSAG reports are worth mentioning:– the report entitled Management of Operational Safety in Nuclear Power Plants(Safety Series No.75-INSAG-13), published in 1999. This report discusses safety
management issues of signiﬁcance in promoting a safety culture, accompanied byrecommendations and best practices. In particular, it contains recommendations
on the maintenance of safety management during periods of organizationalchange, on monitoring safety performance and on early identiﬁcation of declining
safety performance before it has a signiﬁcant impact on safety;– the report entitled Key Practical Issues in Strengthening Safety Culture (Safety
Series No.75-INSAG-15), published in 2002. This report, which includes somequestions that can be asked as part of a safety culture self-assessment within an
organization, discusses key issues such as: the importance of the manner ofcommunication and of ensuring messages on safety are being received andunderstood, and especially of users understanding why procedures are used, thereporting culture and the attention that should be given to “near miss” incidents
and to possible deviations (‘to tolerate is to validate’53), an organization’s ability
to challenge itself at all levels (the “learning organization54”).
The explanations and recommendations in these different INSAG reports are relevant to all types of facility, including research reactors – and also to operators, designers
or other organizations that make a significant contribution to their operation. It is worth
51.
52.
53.

54.

International Nuclear Safety Group.
Updated in 1992 by report Safety Series No.75-INSAG-7.
Regarding the latter topic, it is worth mentioning here work done by an American sociologist,
Diane Vaughan, on the Space Shuttle Challenger accident, published in 1996 in the book “The
Challenger Launch Decision, Risky Technology, Culture and Deviance at NASA”. It shows that what
in hindsight appears to be a series of clearly identiﬁable errors is actually a series of decisions andinterpretations that are perfectly understandable in the context in which they were made, butwhich are in fact slight deviations from normal limits and lead imperceptibly to the normalizationof deviation.
INSAG-15 also points out that, although safety culture cannot be directly regulated, it isimportant that safety bodies understand how their actions affect the development of a safety
culture and the improvement of the less formal human aspects of safety in organizations
operating in the nuclear sector.

Elements of nuclear safety – Research reactors

36

mentioning that, while there are production challenges for research reactors just as
there are for power reactors (performing experiments, production of radioisotopes,
etc. in the case of research reactors; production of electricity in the case of power reactors), the safety culture concerns two populations: the operating personnel, but also toa certain extent the experimenters. Regarding experience feedback from incidents,
section 10.1.1 discusses the importance of the operators involved in experiments having
sufficient awareness of nuclear safety and radiological protection.

3.4.2.

Conﬁnement barriers, fundamental safety functions,defence in depth

Historically, in terms of safety, reactor design has naturally followed the principle ofplacing multiple physical confinement barriers between radioactive materials and theenvironment and “fundamental safety functions” have been adopted. These wereexplained in section 3.1.
The deployment of multiple confinement barriers was already in itself a type of
defence in depth. But over time this concept has taken on a much broader meaning
and can now be described as follows.
The defence in depth principle can be summarised as the deployment of a succession of different “levels of defence” such that, if one level fails, the consequences of the
failure are mitigated by higher levels. The independence of the different levels ofdefence is therefore a key element55 in meeting this objective, and should therefore
be sought as far as reasonably achievable56.
The general objectives of defence in depth are:– to compensate for human and component failures;– to maintain the effectiveness of the barriers by averting damage to the facility
and to the barriers themselves;– to protect the public and the environment from harm in the event that thesebarriers are not fully effective.
A concept associated with the defence in depth principle has been developed overtime and was formalised in the INSAG-10 report (“Defence in Depth in Nuclear Safety”)
published in 1996, as five levels. The five levels are shown in figure 3.3.
In defence in depth, the concept of level corresponds to a set of measures such as
the intrinsic characteristics of the facility in question (reactor, fuel pool, etc.), physicalmeasures (structures, systems and components) and procedures.
Even though the implementation of the levels may differ from country to country
and may depend on facility design, the main principles are universal.

55.
56.

Expression used in INSAG-10.
Improving the independence of the levels of defence in depth “as far as reasonably achievable” isone of the safety objectives of WENRA for reactors of the future.

Aspects of the design and safety demonstration of research reactors at international level

37

Figure 3.3. The defence in depth concept as developed in the INSAG-10 report: objectives and means.
© Georges Goué/IRSN.

Because level 1 is the first level, it performs the main prevention function. Because
levels 4 and 5 are the last levels, their main function is to limit the consequences ofsevere accidents.
There must also be a balance between the different levels of defence in depth. The
INSAG-10 report stresses that accident management (level 4) may not be used to
excuse design deficiencies at prior levels.
Conservative assumptions and safety margins (in relation to postulated phenomena)
should be general features of the first three levels of defence in depth (choice of site,
design and safety demonstration [e.g. when setting the limits for triggering protection
and safeguard systems], construction, operation and modification, etc.). Measures should
be taken to anticipate ageing (in the case of known mechanisms). At defence in depth
levels 4 and 5, “best estimate”, or reasonably conservative, considerations are used.
The INSAG-10 report also highlights the fact that, when implementing the defence in
depth principle, internal and external hazards (fire, flooding, earthquakes, etc.) requireparticular attention because they could simultaneously impair several levels of defence
in depth.
The INSAG-10 report also states that if it is not feasible to implement defence in
depth against some events (such as sudden failure of a component under pressure),
several levels of precautions should be introduced into the design and operation. These

38

Elements of nuclear safety – Research reactors

precautions could, for instance, be taken by choosing certain materials, by incorporating
additional margins of safety during design, by reducing the length of welds, by using
appropriate procedures for in-service monitoring, etc.
The various levels of defence-in-depth are explained below.

" Level 1: prevention of abnormal operation and failures
A nuclear facility such as a reactor (power or research reactor) should be intrinsicallyrobust so as to reduce the risks of failure. This means that, once the initial definition of
the facility (and the selection of the design options) is complete, the normal and abnormal conditions of operation should be clearly identified (i.e. as exhaustively as possible)
in order to ensure the systems and components are sufficiently robust and resistant,including in accident conditions. According to the defence in depth concept, level 1
must offer an “initial basis of protection” against internal and external hazards (earthquake, plane crash, fire, explosion, etc.), though additional measures may be required at
higher levels. The study of these hazards would lead, for example, to the selection of aseismic reference level, maximum weather conditions (expressed in terms of temperatures, wind speed, weight of snow), a maximum overpressure wave due to externalindustrial explosions, and the duration of exposure to these phenomena. The choiceof site plays a key role in limiting these constraints.
The facility’s various SSCs can then be designed, built, inspected, installed, tested
and operated and be subject to appropriate preventive maintenance, following wellestablished and qualified rules, with a sufficient margin beyond the limits defined forcorrect operation of the facility, and more specifically to ensure the SSCs performthe functions required for them in the various envisaged situations. These margins
should prevent regular use of systems designed to cope with abnormal situations,particularly recourse to the measures taken for defence in depth levels 2 and 3.
Binding rules laid down in design and construction codes 57 define precisely theconditions for the design, procurement, manufacture, assembly, inspection, testingand preventive maintenance of safety-related equipment, to guarantee its quality inthe broadest sense.
They are used to define the facility’s authorised normal operating domain and its
general operating rules.
A reactor technology58 that changes state slowly and has automated controls can
reduce the risk of stress for operating personnel. The design of the human-machineinterface and the time available before manual intervention is required can make animportant positive contribution.

57.

58.

Which reﬂect proven industrial best practice. Worth mentioning are the American ASME
(American Society of Mechanical Engineers) code, the RCC-M (design and construction rules formechanical components) for French PWRs, and the RCC-MRx (design and construction rules formechanical components of nuclear installations: high-temperature, research and fusion reactors),
applicable to research reactors in particular.
Designers often use the term “process” to refer to the technology of a reactor.

Aspects of the design and safety demonstration of research reactors at international level39

The choice of personnel involved at each phase in the life of a facility (design,
manufacture, inspection and testing, operation, decommissioning), their training, thegeneral organization of the different bodies involved – particularly in quality assurance
and safety culture –, the sharing of responsibilities, and operating procedures, all help toprevent failures throughout the life of the facility.
Methodically taking account of experience feedback is also a key element that helps
to improve prevention of failures.

" Level 2: control of abnormal situations and detection of failures
The facility should be prevented from leaving the authorised operating domain
defined above and systems should be designed that are sufficiently reliable and thatcan stop abnormal changes before equipment is beyond design conditions chosen sothat there is no failure risk.
A reactor design with a stable core and good thermal inertia makes it easy to keep
the reactor within its authorised operating domain.
Surveillance of the facility’s compliance with the design assumptions by means of
in-service inspection and appropriate periodic testing of equipment is necessary todetect any degradation before it can affect the safety of the facility59 and to carryout essential repairs (curative maintenance, replacement, etc.).
Systems that measure the radioactivity of different fluids and the atmosphere in different rooms can be used to verify the effectiveness of confinement barriers and purification systems.
Clear information in the control room about faults but also about the state or configuration of the facility’s structures, systems and components makes it easier for operating personnel to deal with faults within an appropriate time scale.
Systems that limit adverse trends and can rapidly stop an undesirable phenomenon,
not properly controlled by regulation, from occurring are deployed, including reactor
shut down.

" Level 3: control of accidents within design basis
The first two levels of defence in depth – prevention and control of abnormal
situations – are designed to prevent the occurrence of accidents.
However, in spite of the attention paid to these two levels, obviously for safety reasons a number of accidents are postulated, leading to failures such as a break in a reactor coolant pipe, regardless of the precautions taken to make them unlikely, or indeed

59.

For French PWRs, in-service inspection of equipment is the subject of a document entitled RSE-M(equipment in-service surveillance rules), published by AFCEN (the French association that
produces rules for the design, construction and in-service inspection of components for nuclear
plants). There is no generic equivalent for research reactors because of the variety of theirdifferent designs.

40

Elements of nuclear safety – Research reactors

very unlikely. This approach is usually described as “deterministic”, and it is an important part of the design of a facility and essential for the safety demonstration. These
accidents have to be chosen at the start of the project design phase, so that systems
can be designed that prevent severe damage to the core (e.g. core melt) and to ensure
these systems are properly integrated into the other part of the facility. They have to bechosen with the utmost care because it is very difficult to integrate major systems at alater date into a facility that has already been built.
The systems defined are known as safeguard systems; they do not play any role in
the normal operation of the facility. Where necessary, these systems start up automatically and they only require human intervention once sufficient time has elapsed for
diagnostics to be carried out under calm conditions. The correct functioning of thesesystems ensures that, in the postulated situations, the integrity of the core structure
is maintained and it can therefore continue to be cooled. Releases into the environment
would be therefore very limited.
To ensure these safeguard systems are sufficiently reliable, particular attention
should be given to the risk of common mode failures, hence the adoption of principles
such as redundancy, geographical separation, diversification, etc. In-service monitoring
and appropriate maintenance must also be carried out on the safeguard systems.
Particular attention must be given to the procedures used to qualify these systems
for accident conditions, which obviously cannot involve triggering an accident at thefacility itself.

" Level 4: prevention of accident progression and mitigation of theconsequences of severe accidents
The accident at the Three Mile Island power plant in 1979 prompted efforts to develop the means to cope with situations not covered by the first three levels of defence
in depth, involving severe core damage. The challenge was to try to limit releases
caused by situations where the core is badly damaged, for example in the event of coremelt, and to buy time in which measures can be taken, if necessary, to protect the offsite population. Maintaining the containment function under the best possible conditions is essential in this case.
Special measures are taken by the operator of the damaged facility as part of theon-site emergency response plan: alerting the public authorities, monitoring the stateof the damage facility, following appropriate operating procedures, implementing
means of communication, response, etc. Periodic exercises are run with the different
stakeholders that would be mobilised in an emergency, to ensure these measures will
be effective should such situations occur.

" Level 5: mitigation of the radiological consequences of signiﬁcant
external releases of radioactive substances
The use of measures (off-site emergency response) to protect the population if significant releases occur ([enhanced] monitoring of activity levels and radiological exposure, sheltering, evacuation and control of foodstuffs, etc.), assumes that the previousAspects of the design and safety demonstration of research reactors at international level41

measures have not been effective or have failed. The public authorities decide the conditions for evacuation or sheltering. They also take measures to control the consumption or marketing in the short, medium or long term of foods that could becontaminated. The decision to apply these measures is based on analyses of the situation by the operator and the safety bodies and on environmental radioactivity measurements.
Periodic exercises are also required, obviously involving the relevant public services,to ensure the intended logistical resources are effective.
Some specific aspects of the adaptation of defence in depth to French research reactors will be mentioned in chapter 7, giving examples.

3.4.3.

The deterministic approach, design and safety
demonstration basis – Situation regarding probabilistic
studies for research reactors

In particular, to take account of safety objectives and requirements when designingresearch reactors and establishing their safety demonstrations, a deterministic approach(see above) must be taken, using conservative data that considers the most unfavourable configurations, for the reactor, of the core and the experimental devices or experiments. In accordance with this approach, to comply with the recommendations in the
IAEA safety standards for research reactors, the safety analysis must consider a selection of postulated initiating events that can result from equipment failure, system
malfunction, human error, or an internal or external hazard. A list of the initiating
events generally postulated for research reactors is given in IAEA safety standard
SSR-3; table 3.3 at the end of this chapter lists a selection of these events, grouping
them into various families.
The deterministic approach involves studying a number of “facility states60”, determined on the basis of the initiating events, some of which can be categorized according
to the estimated frequency of the associated initiating events, has been refined overtime. Most research reactors in operation were designed on a more cursory basis –though they are often still quite robust – than the more recent research reactors.
The safety reviews discussed in sections 3.5, 4.3, 9.2.2 and 10.2 or other important
administrative stages (e.g. see below for the HFR at Petten) enable the safety analyses
to be extended by reference to more recent practices.
Probabilistic studies can be used in addition to the deterministic approach. However,it should be pointed out that the majority of research reactors are less complex thanpower reactors (e.g. pressurized water reactors), and that the value of probabilistic
60.

According to IAEA terminology, especially in the standard SSR-3, the facility states are “Normal
operation”, “Anticipated operational occurrences”, “Design basis accidents” and “Design extension
conditions” (which includes “Severe accidents”). “Normal operation” and “Anticipated operational
occurrences” are “Operational states”. There is a limited number of facility states, with each one
chosen to cover the corresponding family of events (events affecting core reactivity, core cooling,etc.).

Elements of nuclear safety – Research reactors

42

safety analyses is therefore less obvious. But even with research reactors, probabilistic
studies can be useful to identify relative weaknesses in their design or to assess quantitatively the contribution of implemented or planned improvements or modifications61. In addition, the use of probabilistic methods can give a better assessment of
the relative importance of systems for the safety of a research reactor and identify
more accurately their potential interactions.
It is worth mentioning in this regard that some safety authorities have asked
operators of research reactors to conduct probabilistic safety analyses as part of thelicensing process. For example, in 2003, probabilistic safety analyses (PSAs) at level 1(assessment of the sequences leading to core damage and the overall probability of thatdamage) and level 2 (assessment of the different categories of radioactive releases into
the environment and their probabilities) were carried out for the HFR reactor at Petten
as part of the license renewal for operation of the reactor with low enriched uranium
fuel. In particular, these probabilistic analyses were used to determine the dominantsequences of damage to the core (loss of off-site power, large-break loss of coolant
outside the pool) or fuel elements (blockage of water circulation in the core, etc.)62.

3.4.4.

The graded approach63

IAEA Safety guide No. SSG-22, entitled Use of a Graded Approach in the Applicationof the Safety Requirements for Research Reactors, published in 2012, presents
recommendations for the “graded” application of the standard NS-R-4, and of the
new standard SSR-3 that replaces it, which are applicable to research reactors and werementioned above (in section 3.2.3).
The diversity of research reactors in terms of design, technical characteristics(power, quantity and nature of radioactive materials and substances, etc.), mode ofoperation and utilization, technological maturity and experience feedback is reflectedin the diversity of associated risks. This diversity of risks has naturally led to the development of the graded approach concept.
The graded approach concerns many issues and applies at all stages in the life of a
research reactor. For every research reactor, the design measures, application of the defence in depth principle, level of detail of the safety analyses, verifications of all kinds,
documentation, activities and procedures used to implement the safety requirements,and more generally the resources dedicated to safety and safety monitoring, should
be in proportion to the potential hazards posed by that reactor. The concept of potential hazards is very important for understanding and making correct use of the gradedapproach: grading should be based on the potential hazard of the facility in its environment due in particular to the inventory of radioactive material and substances, the

61.

62.
63.

These uses are less affected by the lack of valid data on equipment reliability for the different
research reactors, due mainly to the wide range of different research reactor designs, uses andmodes of operation.
The probabilities of this damage are overall of the same order of magnitude as those for core meltin power reactors (a few 10-5 per year).
The expression “proportionality” is also used.

Aspects of the design and safety demonstration of research reactors at international level

43

energy capable of disseminating that material, the site characteristics, the proximity of
local populations, etc. For example, the resources dedicated to off-site emergency response plans should be proportionate to the robustness and containment capacity of
the reactor building and to the radioactive releases envisaged in accident situations,
their radiological impact on the populations likely to be affected, etc.
The purpose of the graded approach is to ensure the efforts made by operators andsafety organizations are in proportion to the significance of the safety issues they
address. According the IAEA safety guide, the graded approach can be applied to thefollowing:– the level of detail of procedures and operating instructions,– the approval of documents or the authorization of modiﬁcations to the facility
and experiments,– training programmes,– regulatory and other inspection programmes (e.g. frequency and duration of
inspections),– the integrated management system (safety, quality),– emergency preparedness and response,– the frequency of maintenance, equipment calibration, etc.
In some countries, like France, the application of the graded approach is written into
national regulations.

3.5. Periodic safety reviews64
Internationally, periodic safety reviews are not a widespread practice at research
reactors. Safety reviews are often carried out only for the purpose of renewing operating licences issued by safety authorities for a limited period of time. But for many research reactors worldwide, the licence does not set a maximum period of operation, andconsequently periodic safety reviews cannot be carried out systematically, even though
they are useful for:– assessing whether continued operation is acceptable from a safety perspective, inview of any modiﬁcations made to facilities or to their operating procedures andany changes in their environment;– identifying safety improvements to be made to these facilities on the basis ofoperating experience feedback (for the facility in question and similar facilities
elsewhere in the world), better knowledge of certain risks and changing safety
requirements or criteria.
IAEA safety guide No. SSG-25 entitled Periodic Safety Review for Nuclear Power
Plants, published in 2013, makes recommendations for carrying out periodic safety64.

This is the expression used in the IAEA safety standards.

Elements of nuclear safety – Research reactors

44

reviews on power reactors. The maximum recommended time between reviews is
10 years. With certain adaptations to reflect the specific nature of research reactors
and the application of the graded approach, these recommendations can be used forresearch reactors.
In general, periodic safety reviews consist of the systematic review of safety at anuclear facility at regular intervals, taking account in particular of the effects of ageing,
modifications made to the facility, operating experience feedback, changes at the site,
new knowledge acquired (e.g. concerning seismic risk), and best practices; changes tosafety requirements are also considered. The aim of a review is to determine whether
measures to ensure safety at a facility, which may have been modified in the light ofother safety reviews, will still be adequate by the next safety review (or until the facility
is permanently shut down). French practice – based on a ten-yearly frequency – is discussed in section 9.2 and illustrated by some of the most notable safety reviews conducted in France.
Periodic safety reviews carried out at research reactors generally cover:– the safety management system, including quality assurance measures;– the physical state, due to ageing, of structures, systems and components, which
may have become brittle from the effect of radiation or could have eroded or
corroded (e.g. components exposed to humidity if there is no air conditioning or if
ventilation systems are not working);– changes to safety requirements and the applicable criteria;– changes to the site of the facility, such as an increase in population density, theadvent of industries involving hazardous materials, the construction of highways
to transport those materials, or changes in trafﬁc (road and air trafﬁc, etc.);– experimental devices and experiments;– maintenance programmes, test programmes and periodic inspection programmes;– experience feedback, including international,– organizational aspects concerning the operating personnel (recruitment, mobility,
qualiﬁcation, training, maintenance of skills and knowledge);– the doses received by operating personnel;– management of efﬂuent and radioactive waste, the associated reports;– the safety and operating documentation for the facility (safety report, general
operating rules, on-site emergency plan, operating procedures).
Weaknesses and non-compliances identified during periodic safety reviews have inmost cases led to safety improvement programmes at the facilities concerned, with precise timescales, subject to the safety authority’s approval.
Although, during these improvement programmes, components of significance forthe safety of research reactors may be replaced (in case of obsolescence or significant
ageing), the configuration of civil engineering structures can, in some cases, make itAspects of the design and safety demonstration of research reactors at international level45

difficult or even impossible to achieve adequate physical separation of the different“trains” of redundant safety systems during renovation work, and the safety analysis
should take account of this.
The periodic safety reviews are an important step for maintaining a satisfactory level of safety. On the basis of these reviews, the safety authority may say whether thefacility can continue operating or not.
The IAEA continues its efforts to promote and extend the practice of periodic safety
reviews for research reactors with the forthcoming publication of a specific safety report and the organization of training activities on the subject.

3.6. Safety aspects of experimental devices
An experimental device65 contains one or more samples to be irradiated in a neutron flux produced by a research reactor. The device contains the sample supports
and the equipment for producing and controlling the desired irradiation conditions.
Experimental devices are generally installed in the core of a research reactor, in its
reflector or around its periphery. A wide variety of experiments or irradiations arecarried out with these devices. In particular, they can involve the irradiation of:– fuel samples, subjected to pressure and temperature conditions and to coolant
ﬂuids that may be very different from those in the research reactor where they
are irradiated; in this case the irradiation device is an experimental loop. The
thermohydraulic conditions in the experimental loop may reﬂect incident or
accident situations that the samples could be subject to in a power reactor. In
these experiments, the fuel samples studied can be tested to the point of cladding
failure and/or fuel melt;– various materials for industrial applications;– targets for the production of radioisotopes for medical or other uses.
An experimental device mainly consists of an “in-pile” part and an “out-of-pile” part.
The in-pile part contains the sample(s) to be irradiated and can be used to achieve
and control the desired characteristics for the environment of these samples. In terms ofsafety, it has one or more barriers separating the sample from the reactor core coolant.
The requirements for these barriers depend on the irradiation conditions and the risks
posed by the experimental device as a whole.
The out-of-pile part consists in particular of the power supplies, the instrumentationand control units for the device, the fluid circuits and, with some irradiation loops, cells
for analysing the fission products released by the fuel being tested. The out-of-pile partof an experimental loop helps to obtain the desired experimental conditions, particularly in terms of pressure and temperature, to which a sample should be subjected.
65.

They are not experimental in themselves but are used for experiments. The name “experimentation device” would therefore be more appropriate; however, the usual term has been retained inthis document.

Elements of nuclear safety – Research reactors

46

It is important to emphasise that possible interactions between the experimental
device(s) and the reactor where the irradiation is being performed, should be carefully
examined from the point of view of safety.
Because there are common aspects to planning experiments in research reactors andplanning modifications to those facilities, such as organization, safety analysis, management of authorizations and commissioning tests, in 2012 the IAEA published guideNo. SSG-24 entitled Safety in the Utilization and Modification of Research Reactors. This
guide recommends that the operator of a research reactor has responsibility for all
aspects of reactor safety connected with preparing and carrying out experiments – evenif other organizations (research organizations, universities, hospitals, industrial companies, etc.) are in charge of the design and programming of these experiments and eventhough the performance of certain tasks may be subcontracted to other organizations.
The safety committees mentioned in section 3.2.3 (standard SSR-3) may be called upon
to examine the suitability and safety of experiments and to make recommendations to
the reactor manager. The guide recommends that the safety authority of the country
where a research reactor is located should define and implement a licensing process (including the possibility for the operators of “internal” licensing under certain conditions)for experiments in research reactors and should check that operators are taking appropriate measures to manage and control the safety of these experiments.
The guide also recommends that:– planned experiments be categorized on the basis of their signiﬁcance for safety(as part of a graded approach);– procedures be established for the safety analysis and approval of experiments;– experiments with a major or signiﬁcant effect on reactor safety be designed
following the same principles as the reactor itself (defence in depth, single failure
criterion, etc.) and be subject to formal licensing by the safety authority in the
country concerned; experiments with only a minor effect on the safety of thereactor may be internally licensed by the operator.
The guide lists various safety aspects specific to experiments that should be examined for each:– the reactivity worth66 of the experimental device, which should remain within
operational limits and conditions (negative reactivity of the core when thereactor is shut down, etc.);– the protection system associated with the experiments, which can also be
designed to protect the reactor;– the heat produced in the experimental device and the ability of the device’s cooling
circuit to remove that heat, which should not affect the ability to cool the reactor;
66.

The reactivity worth of any constituent of a reactor core is expressed in pcm (per cent mille). A
fuel element has a positive worth because it contributes reactivity to the core, whereas a neutron
absorbing rod has a negative worth. An experimental device can have positive reactivity (e.g. if it
contains ﬁssile material) or negative reactivity (e.g. if it is an irradiation capsule for steel samples).

Aspects of the design and safety demonstration of research reactors at international level47– any risks associated with pressure in the experimental device, especially withregard to equipment important to reactor safety;– the compatibility of the materials in the experimental device with one anotherand with the materials of the reactor (risk of corrosion, of eutectic formation,etc.);– the possible interactions between the experimental device and the reactor(neutron ﬂux disturbance, mechanical interactions, etc.);– updating of the safety documentation for the facility (safety report, general
operating rules, emergency procedures, etc.).
The guide also recommends application of the ALARA principle67 to operator exposure when carrying out experiments and that the main risks associated with each experiment zone be displayed at the entrance to that zone.
Finally, the guide recommends that appropriate measures are taken to ensure thatany equipment can be stored or disposed of safely on decommissioning or when thereactor is dismantled.

3.7. “Envelope” accidents taken into accountin research reactor safety analyses
3.7.1.

Deﬁnition and characteristics of “envelope” accidents

Certain aspects of research reactors and their uses, and experience feedback fromtheir operation, very early on prompted designers and safety organizations to consider
the possibility of accidents involving damage to the fuel in the reactor core or to thecore as a whole, to the point of core melt. These aspects include:– the fact that many handling operations take place in the reactor core or inproximity to it;– some research reactors being sited close to populated areas;– the occurrence of a number of reactivity accidents internationally, as explained in
section 4.2 below.
Directly postulated “envelope” accidents determined from initiating events (single
or multiple failures) of internal origin, are defined in order to verify the acceptabilityof the design68 and the operating procedures. They are also used to define organizational and physical measures for emergency response. Studies of these accidents are

67.
68.

As Low As Reasonably Achievable. This principle, developed from the study of risk (cyndinics), wasformulated for the ﬁrst time in 1977 by the ICRP in its publication No. 26.
Architecture of systems, functional requirements of equipment, technical characteristics of thisequipment (thickness of a concrete wall, rebar ratio, ﬂow rate of a pump, thickness of a tank orvessel, materials used, type of welds, etc.).

48

Elements of nuclear safety – Research reactors

conducted to assess radioactive releases and their radiological consequences forhumans and the environment, based on the behaviour of the confinement barriers under
the stresses they are subject to.
Various terms are used throughout the world to refer to the accidents in question at
research reactors, which does not make understanding them any easier: envelope accident, reference accident (a term used particularly for French research reactors), maximum credible accident or maximum hypothetical accident, controlled severe
accident, etc. The English terms Design Basis Accident (DBA) and Beyond Design Basis
Accident (BDBA) are also used – for the newest research reactors or in the context ofrecent safety reassessments – to refer to concepts involved in the deterministic approach that has developed over time.
From a terminology point of view, it may be worth recalling the definitions given in
the IAEA glossary (2007 version) for the different facility states:– the design basis accident (DBA) is deﬁned as “accident conditions against which afacility is designed according to established design criteria”;– beyond design basis accident (BDBA) refers to “accident conditions more severe
than a design basis accident”;– severe accident refers to “accident conditions more severe than a design basis
accident and involving significant core degradation” (making it a subset of the
BDBA domain).
It therefore seems to be the case that the “envelope” accidents used for research
reactors are mostly, by nature, beyond design basis accidents, or even severe accidents.
The term Design Extension Conditions (DEC)69 has also been introduced by the international community – particularly the IAEA in document SSR-3 – for accidents thatwere previously described as beyond design basis (multiple failures, complex events, fuelmelt accidents), and consequently the study of these accidents should aim to determine
whether the design of the facility (including the ultimate confinement barrier) can adequately limit their consequences, or whether reinforcement (e.g. of the ultimate barrier)or the installation of extra equipment (additional power supplies, ultimate water makeup, etc.) should be envisaged.
A wide variety of “envelope” accidents are studied for the various research reactors
throughout the world, a fact illustrated particularly by table 3.3 – though this presents
only a selection. These accidents cover a wide range of states of core degradation, ranging from minimal damage to a fuel element to partial or total core melt. Although there
are factors that partially explain this diversity (different designs and intrinsic characteristics [neutron feedback, etc.], varying robustness of safety systems [architecture,
redundancy, diversification, etc.]), there is no denying that there are also disparities
in the “envelope” accidents considered for research reactors that are technically similar.

69.

The term in French is “domaine complémentaire”, which has become “domaine de conceptionétendu” in more recent texts (see for example ASN Guide No. 22 “Exigences de sûreté etrecommandations pour la conception des réacteurs à eau sous pression”).

Aspects of the design and safety demonstration of research reactors at international level49

The Nuclear Energy Agency (NEA) and IRSN have highlighted70 the value of identifying
and establishing best practices for defining “envelope” accidents for research reactors.
Specifically in the case of pool-type research reactors that use uranium-aluminium
fuel, which are widespread throughout the world, “envelope” accidents initiated by a
rapid and large-scale reactivity injection leading to core melt – so-called BORAX accidents71 – are considered. However, the mechanical effects of the interaction between
molten fuel and cooling water, in the form of a steam explosion, have not been uniformly taken into account for all these reactors, especially as regards the mechanicalrobustness of the reactor pool and containment; in addition, the potential consequencesof projectiles hitting the containment wall due to a steam explosion have not always
been examined.
Other differences concern the data used to calculate the radioactive releases from“envelope” accidents; this issue is discussed in the next section.
Chapter 8 of this report, on BORAX accidents, discusses the issues mentioned above,and how these accidents are taken into account in the case of French pool-type research reactors.

3.7.2.

Source term evaluation for “envelope” accidents

Source term evaluation when studying the radiological consequences of an accident
causing damage to the fuel in the reactor core (cladding failure, fuel melt) assumes thatthe nature and extent of the damage is known, as well as the pathways and quantities
of fission products released by the fuel in the reactor building, and from that, thereleases of fission products into the environment, and finally the doses and (long-term)
contamination that could occur at various distances from the facility. For some reactors, the cancer risk from the radiation has been worked out72.
These elements need to be evaluated on a case-by-case basis taking account of thespecific characteristics of the reactor building (integrity, possible bypasses, etc.) and theventilation (extraction rate, effectiveness of filtration systems), and specific characteristicsof the site, considering that the accident could happen during a loss of off-site power, etc.
When fuel melt happens under water, the fission products are released in the poolwater, from which a fraction is assumed to be released instantly into the atmospherein the reactor building (particularly all the noble gases). The release of fission products
then continues over time (partly through evaporation of the water in the pool – depending on the temperature difference between the water and the air in the reactor building
and the evaporation surface area). When fuel melt happens in the air, the fission products are assumed to be released straight into the atmosphere in the reactor building.

70.

71.
72.

In particular see the paper: “Safety of research reactors: views of the NEA committee on the safetyof nuclear installation” ‒ IAEA International conference on research reactors, Rabat, Morocco,
14–18 November, 2011.
BOiling water ReActor eXperiment.
For example, in 2003 in the case of the HFR reactor at Petten, when the operating license wasbeing renewed to use the reactor with low enriched with uranium-235 fuel (see section 3.4.3).

Elements of nuclear safety – Research reactors

50

There are differences in the assumptions used throughout the world to calculate thetransfer of fission products from the fuel to the water, from the water to the air in thereactor building hall, and finally from the hall to the environment. As far as the releaseof radionuclides from fuel is concerned, the noble gases (xenon, krypton) are generally
assumed to be released in their entirety. The differences between safety analyses concern the other species (iodine, caesium, ruthenium, strontium, actinides). They are often
due to a lack of transposable experimental data (the transfer rates depend in particularon the burnup of the fuel, the maximum temperature reached by the fuel, and the medium it is in [water, air, steam-air, etc.]). Big differences have been observed, for example
for iodine-131 and caesium-137, release rates from molten fuel into water vary from
0.1 in some reactors to 0.8 in others (OSIRIS reactor, etc.). The value 0.8 came froman analysis by the operator of the OSIRIS reactor after six fuel plates melted in the
SILOE reactor in 1967 – attributed to a loss of cooling at the inlet of the affected fuelelement (this event is described in section 10.1.2).
For transfer from the hall of the reactor building to the environment, the differences
mainly relate to whether or not the deposition of fission products on surfaces and theeffectiveness of filtration systems are taken into account.

3.8. Possible improvements to studies, researchand development on research reactor safety
While research reactors can be used to acquire knowledge that is useful for assessing the safety of power reactors, their own safety does of course need to be justified bysufficient supporting data. Using very conservative values to study postulated initiating
events can prove excessive and cause difficulties with design, construction or operation.
Assumptions that are more informed (realistic) could be a way, provided that sufficientvalidated knowledge is available.
Acquiring further knowledge of the release rates of fission products from fuel elements in incident or accident conditions would be particularly useful, as previously
turned out to be the case with evaluation of the source term linked to fuel melt accidents. Although the designers and operators of research reactors, and more specificallyof the fuels to be used in these reactors, undertake experimental programmes to qualify
these fuels, the programmes mainly explore temperature and pressure conditions, etc.
in normal operation or during research reactor transients. The NEA (and IRSN) has
drawn the attention of research reactor designers and operators to the value of using
tests to improve knowledge of fuel behaviour in research reactors in incident and accident conditions73.
In addition, various thermohydraulic simulation codes originally developed for
power reactors have been adapted for studies related to research reactors in normal
operating conditions, during transients, and in incident or accident conditions. However,disparities have emerged in the mathematical models and the correlations used in thesecodes, and in their degree of validation specifically for research reactors. This is because
73.

See footnote 72.

Aspects of the design and safety demonstration of research reactors at international level51

data or knowledge were either not shared or not shared sufficiently, and because theconnections between neutronics and thermohydraulics need to be improved. A Coordinated Research Project74 (CRP) of the IAEA was run from 2003 to 2006 to compare simulations performed by different codes of operating transients in a reactor chosen as areference (the Brazilian IEA-R1 reactor). The CRP mainly identified a need to benchmark
the simulation codes using experimental data (qualification process), which led to asecond CRP75 run from 2008 to 2013, in which IRSN participated (see chapter 11).
The aim of the second CRP was to assess the ability of simulation codes to reproduce
a number of neutronics and thermohydraulics measurements taken straight from thecores of different research reactors76. In most cases, the neutronic data included coreparameters such as the effective multiplication factor, the neutron flux distribution
in the core, the fission rate in the fuel, some kinetic parameters, and the “worth” ofthe neutron-absorbing elements. The thermohydraulic data included, most notably,
the temperature of the water measured at the inlet and outlet of the fuel elements.
These data were for stable operating states and for reactivity and flow rate transients– including reductions in flow until natural convention was established, possibly withreversal of the direction of flow of the water in the core, for the ETRR-2, IEA-1 and
RSG-GAS reactors. The final report of the second CRP is in preparation.
Other areas for improvement have been identified by the NEA and IRSN77; they are:– acquisition and sharing of data on the mechanical characteristics of speciﬁcmaterials used in research reactors (e.g. the aluminium or zirconium alloys used
for reactor tanks), and the changes in these characteristics over time and/or underirradiation;– knowledge management, a particularly important subject given the long service
life of many research reactors, extended shutdown periods, and related refresher
training of operating personnel.
Among other IAEA initiatives, it is worth mentioning CRP T12029 Benchmarks ofComputational Tools against Experimental Data on Fuel Burnup and Material Activation
for Utilization, Operation and Safety Analysis of Research Reactors. This CRP was begun
in 2015 and should end in 2019. It aims to contribute to the validation of the methods
and codes used for computing fuel burnup and material activation by comparing experimental data collected from various operators. The results of this CRP will consist of adatabase of experimental results, measurements and associated facility specifications,and a publication comparing the experimental results with those from the different
simulation codes and methods used.

74.
75.

76.

77.

IAEA CRP J7.10.10: “Safety Significance of Postulated Initiating Events for Different Research
Reactor Types and Assessment of Analytical Tools”.
IAEA CRP 1496: “Innovative Methods in Research Reactor Analysis: Benchmark against Experimental
Data on Neutronics and Thermal-hydraulic Computational Methods and Tools for Operation and
Safety Analysis of Research Reactors”.
Measurements taken at the ETRR-2 reactor in Egypt, IEA-R1 in Brazil, McMaster Nuclear Reactor in
Canada, MINERVE in France, MNSR in Syria, OPAL in Australia, RSG-GAS in Indonesia, and SPERT
III and IV in the USA.
See footnote 72.

Elements of nuclear safety – Research reactors

52

Table 3.1. IAEA guides for research reactors.
Reference
SSG-10Description
Ageing Management for Research
Reactors

SSG-20

Safety Assessment for Research
Reactors and Preparation of the
Safety Analysis Report

SSG-22

Use of a Graded Approach in the
Application of the Safety Requirements for Research Reactors

SSG-24

Safety in the Utilization and Modiﬁcation of Research Reactors

SSG-37

Instrumentation and Control Systems and Software Important to
Safety for Research Reactors

SSG-40Predisposal Management of radioactive waste from nuclear power
plants and research reactors

Comments
This guide presents recommendations on establishingan ageing management programme depending on theactual state of facilities. This is a particularly important issue for research reactors, around two thirds ofwhich are more than 40 years old.
This guide presents recommendations for preparing,examining and assessing the safety documents for a
research reactor (safety report, general operating
rules, on-site emergency plan, etc.). This safety guidefocuses particularly on the design and construction
stages of research reactors. It can be used not only as
part of new reactor licensing procedures but also
during periodic safety reviews of existing reactors.
Safety requirements should generally be applied in a
way that is proportionate to the risks presented by afacility. This guide aims to clarify the graded approachand makes practical recommendations for the different phases in the life of a research reactor.
This safety guide presents recommendations for theutilization and modiﬁcation of research reactors. It is
intended primarily for existing reactors but can also be
useful to organizations considering carrying out newexperiments at a research reactor.
This guide presents recommendations for the design,
production and qualiﬁcation of instrumentation andcontrol systems and the associated components andsoftware, including the architecture of those systems,
their safety classiﬁcation, their human-machine interface, and security with regard to malicious acts. These
recommendations are applicable both to instrumentation and control systems for new reactors andto the modernization of instrumentation and control
systems at research reactors already in operation.
This guide provides recommendations on how to meetthe requirements for the management of radioactive
waste generated at nuclear power plants and research
reactors (including subcritical or critical models). It
covers all the stages of the management of such
waste, from its generation until its elimination (butnot its elimination), including its treatment (pretreatment, treatment and conditioning). Radioactive waste
generated during normal operation and in the event ofan accident is taken into account. This guide covers allphases of the life of waste management facilities,
including the choice of site location, design, construction, implementation, commissioning, operation, closure, and decommissioning.

(Continued on next page)Aspects of the design and safety demonstration of research reactors at international level

53

Table 3.1. (Continued)
Reference

Description

Comments

NS-G-4.1

Commissioning of Research Reactors

NS-G-4.2

Maintenance, Periodic Testing andInspection of Research Reactors

NS-G-4.3

Core Management and Fuel Handlingfor Research Reactors

NS-G-4.4

Operational Limits and Conditions
and Operating Procedures for Research Reactors

NS-G-4.5

The Operating Organization and the
Recruitment, Training and Qualiﬁcation of Personnel for Research Reactors

NS-G-4.6

Radiation Protection and Radioactive
Waste Management in the Design
and Operation of Research Reactors

Commissioning is one of the most importantstages in the life of a reactor. Although this safety
guide is more directly applicable to the commissioning of newly designed and built research
reactors, it can also be used when re-commissioning a reactor after an extended shutdown or
major modiﬁcations, and when commissioning
new experimental devices in a research reactor.
This safety guide presents various international
practices considered satisfactory, particularly as
regards the preventive and corrective maintenance of structures, systems and components
of signiﬁcance for safety, and periodic tests toensure compliance with the operational limits andconditions deﬁned for the facility.
This guide presents recommendations on coremanagement and fuel handling for research reactors in accordance with the applicable safety requirements and the service limits associated withthe fuel. The guide covers core design and operation, core control parameters, the steps and processes involved in the receipt, handling and transport of fuel, core loading, and the handling andtransport of new or irradiated fuel.
This safety guide presents recommendations forthe establishment not only of operational limits
and conditions (OLC), but also of operating procedures. Detailed recommendations are made for
their development, formulation and implementation, both for the operation of the reactors andfor the experiments conducted in the reactors.
This guide is based on the premise that, for areactor to be operated under satisfactory safety
conditions, an appropriate and clearly deﬁnedorganizational structure must be put in place withqualiﬁed personnel, and a safety culture must be
developed. This safety guide makes recommendations concerning the operation of a research
reactor, and the recruitment, training and qualiﬁcation of the operating personnel (including those
involved in maintenance operations), based oninternational best practice.
This guide provides recommendations on radiation protection and the management of radioactive waste from research reactors. It identiﬁes
important elements that should be considered at
the design stage with regard to facilitating
radiological protection and radioactive waste
management, and good practices in developing
and implementing radiological protection
programmes during facility operation.

(Continued on next page)

Elements of nuclear safety – Research reactors

54

Table 3.1. (Continued)
Reference

Description

Comments

WS-G-2.1

Decommissioning of nuclear power
plants and research reactors

This guide provides recommendations to ensurethat the decommissioning process for nuclear
power plants and research reactors is conductedin a safe and environmentally acceptable manner.
It applies to these facilities and their sites. It
mainly addresses the radiological risks resulting
from the activities associated with the decommissioning of the reactors, and in particular thedecommissioning after the planned ﬁnal shutdown. A large number of provisions also apply to
decommissioning as a result of an abnormal eventthat has resulted in contamination or severe
damage to the reactor. In this case, the guide canserve as a basis for the development of special
decommissioning provisions. The guide does not
explicitly address non-radiological hazards, suchas those due to potential sources of ﬁre or thoseresulting from a release of abestos, which may begenerated by decommissioning operations but
which must also be managed.

Aspects of the design and safety demonstration of research reactors at international level

55

Table 3.2. Illustration of the diversity of fuel melt accidents studied for research reactors78.
Reactoryear commissioned– yeardecommissioned

Country

Power
(MW)

Fuel

Fuel melt accidents considered(fuel melt under water,
unless otherwise stated)

HIFAR
1958–2007

Australia(LucasHeights)

10

UAl enriched toaround 60% 235U

Total core meltdown (loss of cooling)

HFR
1961

Netherlands(Petten)50

Originally UAl enriched to 91% 235U,
then U3Si2 enriched
to around 20% 235U

(Reactivity accident excluded because
water circulation direction would prevent ejection of neutron-absorbing
rods
Blockage of a cooling channel in afuel element: does not lead to fuel
melt)

BR2
1963

Belgium(Mol)

100

UAl enriched toaround 93% 235U

Core melt (power excursion ‒ withaluminium-water interaction)

SAFARI-1
1965

South Africa(Pelindaba)

20

Originally UAl enrichedto 87%‒93% 235U,
then U3Si2 enriched toaround 20% 235U

Core melt

OSIRIS
1966–2015

France(Saclay)70

U3Si2 enriched toaround 20% 235U

Core melt (power excursion ‒ withaluminium-water interaction)

RHF
1971

France(Grenoble)

57

UAl enrichedto 93% 235U

Melting of the fuel element in thecore under water (power excursion ‒with aluminium-water interaction)
Various accidents leading to themelting of one or more fuel elements, in the core, during handlingor in a storage channel, under wateror in air, in the short term (< 24 h) or
longer term

ORPHEE
1980

France(Saclay)60

UAl enrichedto 93% 235U

Core melt (power excursion ‒ withaluminium-water interaction)

RSG-GAS
1987

Indonesia(Serpong)

30

U3Si2 enriched toaround 20% 235U

Melting of a fuel element (blockage)
Melting of ﬁve fuel elements (transient with postulated failure of theprotection system [ATWS])

FRM-II
2004

Germany(Garching)

20

U3Si2 enriched toaround 90% 235U

Total core meltdown (loss of coolingor power excursion, no aluminiumwater interaction)

OPAL
2007

Australia(LucasHeights)

20

U3Si2 enriched toaround 20% 235U

Melting of three fuel plates (partial
blockage of channels in a fuel element)
Melting of 36 UMo targets (loss ofcooling)78.

This table is based on information that IRSN was able to gather.

Elements of nuclear safety – Research reactors

56

Table 3.3. Selection of postulated initiating events for research reactors according to the
IAEA SSR-3 standard.
Loss of electrical power supplies:– Loss of normal electrical power.
Insertion of excess reactivity:– criticality during fuel handling (due to an error in fuel insertion),– startup accident,– control rod failure or control rod follower failure,– control drive failure or control drive system failure,– failure of other reactivity control devices (such as a moderator or reﬂector),– unbalanced rod positions,– failure or collapse of structural components,– insertion of cold water,– changes in the moderator (e.g. voids, leakage of D2O into H2O systems, etc.),– effects of experiments and experimental devices (e.g. ﬂooding or voiding, temperatureeffects, insertion of ﬁssile material or removal of absorber material),– etc.
Loss of ﬂow:
– primary pump failure,– reduction in ﬂow of primarycoolant (e.g. due to valve failure or a blockage in piping or aheat exchanger),– rupture of the primary coolant boundary leading to a loss of ﬂow,
– fuel channel blockage or ﬂow reduction (e.g. due to foreign material),– improper power distribution due to, for example, unbalanced rod positions in coreexperiments or in fuel loading (power-ﬂow mismatch),– reduction in coolant ﬂow due to bypassing of the core,– deviation of system pressure from the speciﬁed limits,– loss of heat sink (e.g. due to failure of a valve or pump or a system rupture).
Loss of coolant:– rupture of the primary coolant boundary,– damaged pool,– pump-down of the pool,– failure of beam tubes or other penetrations.
Erroneus handling or failure of equipement or components:– failure of the cladding of a fuel element,– mechanical damage to core or fuel (e.g. mishandling of fuel or dropping of a transfer ﬂask
onto fuel),– failure of the emergency core cooling system,– malfunction of the reactor power control,– criticality in fuel in storage,– failure of the means of conﬁnement, including the ventilation system,– loss of coolant to fuel in transfer or storage,– loss or reduction of proper shielding,(Continued on next page)Aspects of the design and safety demonstration of research reactors at international level

57

Table 3.3 (Continued)– failure of experimental apparatus or material (e.g. loop rupture),– etc.
Special internal events:– internal ﬁres or explosions, including internally generated missiles,– internal ﬂooding,– loss of support systems,– security related incidents,– malfunctions in reactor experiments,– improper access by persons to restricted areas,– ﬂuid jets or pipe whip,– exothermic chemical reactions,– drop of heavy loads.
External events (hazards):– earthquakes (including seismically induced faulting and landslides),– ﬂooding (including failure of an upstream or downstream dam and blockage of a river anddamage due to a tsunami or high waves),– tornadoes and tornado missiles,– sandstorms,– hurricanes, storms and lightning,– tropical cyclones,– explosions,– aircraft crashes,– ﬁres,– toxic spills,– accidents on transport routes (including collisions into the research reactor building),– effects from adjacent facilities (e.g. nuclear facilities, chemical facilities and waste
management facilities),– biological hazards such as microbial corrosion, structural damage or damage to equipment
by rodents or insects,– extreme meteorological phenomena,– electromagnetic interference (e.g. from solar events),– lightning strikes,– power or voltage surges on the external supply line.
Human errors

Chapter 4International experience feedback
for research reactors
The gathering of relevant information about events occurring at research reactors
during operation and the analysis of this information, which constitute what is known
as experience feedback, are essential to improve the safety of these reactors. Despite
the wide variety of different designs and operational conditions of these reactors, thelessons learned from an incident at a research reactor can prevent a similar incident
happening again at that reactor or at another reactor. For example, incidents of excessive exposure of operators or experimenters to ionizing radiation, loss of integrity ofwater tanks or radioactive effluent storage tanks, incidents caused by organizationalor human failures, and incidents due to the obsolescence or ageing of equipment, orto insufficient quality of operating procedures can offer lessons that apply to many different types of facility. Following the example of initiatives regarding experience feedback implemented by a number of countries – including France, a topic that will be
discussed in more detail in chapter 10 in the second part of this document – the IAEA
developed and implemented the Incident Reporting System for Research Reactors(IRSRR), the principles and operation of which are very similar to the system for powerreactors (Incident Reporting System, or IRS).
However, although experience with research reactors can be shared very widely atinternational level using the IRSRR system, not all incidents are fed into it.
Bilateral and multilateral relations have developed between research reactor operators which generally enable more targeted exchanges to take place. For example, every
18 months the International Group on Research Reactors (IGORR) organizes conferences where safety issues related to research reactors are explained and discussed.

Elements of nuclear safety – Research reactors

60

Finally, the concept of experience feedback should be broadened to include the analysis of events affecting other types of facility such as power reactors, from which generic lessons can be learned that are also relevant to research reactors; the example of
the Fukushima Daiichi nuclear power plant accident is a good illustration, which will be
discussed in more detail later on.

4.1. The IAEA incident reporting system (IRSRR)
The IRSRR system was set up by the IAEA in January 2000 and is the only global
platform for sharing experience of research reactor operation. The system is used to collect and disseminate technical information about safety-related events (including radiological events) at research reactors, including those that happened before the system
was set up. The information contained in the IRSRR database is technical information,
unlike the information in the INES79 database. The purpose of the INES database is toprovide quick general information to the media and the public about events that occur
at nuclear facilities, with an assessment of their real or assumed severity (INES classification).
The IRSRR guidelines for use define incident categories, the format and content of
the reports to be sent, and a list of identification and incident type codes. This information makes it easier to search for a particular event in the database, which can only beaccessed by the countries that contribute to it.
In particular, an incident report must state what happened during the event, andgive an analysis of the causes and the lessons learned, and the corrective measures taken to prevent it happening again.
Each of the 54 countries that contribute to the IRSRR system officially appoints anational coordinator, who becomes the contact person for the manager of the system
within the IAEA. These coordinators are responsible in particular for submitting reports
of incidents that have occurred in their country to the IAEA, and for disseminating information received from the IRSRR system within their country. IRSN has been designatednational coordinator for France. The incident reports that it sends to the IAEA are prepared jointly with the operators concerned.
For the IRSRR system to be effective, each contributing country must as quickly as
possible send the IAEA reports of incidents at its research reactors that meet the incident reporting criteria defined in the IRSRR guidelines. According to these criteria, relevant incidents are incidents considered to be significant as regards safety, incidents
from which lessons can be learned that could be useful for other facilities, and incidents
leading to significant radioactive releases or significant exposure of people to ionizing
radiation.
Digests are regularly prepared by the IAEA (with contributors from the Member
States), and the IAEA also organizes periodic meetings (approximately every two years)of the national coordinators, where the incident reports sent in by the participating

79.

International Nuclear Event Scale.

International experience feedback for research reactors

61

countries are presented and discussed. An IAEA document80 published in 2015 summarises the incidents entered into the IRSRR database up to 2015; it shows that the
majority of incidents at research reactors include causes related to organizational or human factors or causes related to the ageing of facilities. A breakdown of the identified
causes is given in figure 4.1 below.

Figure 4.1. Distribution of the identiﬁed causes of events entered into the IRSRR database, according
to IAEA-TECDOC-1762. © Georges Goué/IRSN.

4.2. Serious incidents and accidents at research
reactors
Modifications (which are quite common) to the configuration of a research reactor
core for experimental purposes, the associated handling operations, and the high reactivity “worth” of components of the core, all lead to higher risks of a reactivity accident
or an object being dropped on the core or on fuel elements stored nearby than at othertypes of nuclear facility. In the past, a number of reactivity – or criticality – accidents
happened at nuclear facilities (research reactors and other facilities) throughout theworld that led to serious irradiation of personnel (operators or experimenters), or even
their death; however, the frequency of these accidents has diminished considerably
since the early 1970s81.
A selection of a few serious incidents and accidents at different research reactors82
is presented in brief below.
80.
81.

82.

IAEA-TECDOC-1762, “Operating Experience from Events Reported to the IAEA Incident Reporting
System for Research Reactors”, 2015.
See the very comprehensive document published by the Los Alamos National Laboratory (run by
the University of California on behalf of the US DOE) ‒ entitled “A Review of Criticality Accidents”)(reference LA 13638, 2000 revision). From 1945 to the early 1960s, several accidents happened
each year at research facilities in the broad sense (reactors and other facilities); there were four in
1968, then two in 1971, one in 1983 and one in 1997.
The estimated doses are not always stated in the available sources; for some of these accidents,
the values given in different sources are not consistent with one another.

Elements of nuclear safety – Research reactors

62" 12 December 1952 – NRX reactor (42 MW) – Chalk River
Laboratories (Ontario, Canada)
A power excursion at the NRX reactor, a light water-cooled and heavy water-moderated reactor, occurred as a result of failures and human errors, especially the deliberate reduction of the flow of light water for cooling the fuel elements. Because lightwater acts as a neutron poison, this reduction in flow increased the reactivity andthe power of the reactor to around twice the maximum authorised power. The power
excursion was stopped by draining the heavy water. The core was destroyed and3.7 x 1014 Bq was released into the building basements in around 4,000 m3 of reactor
cooling water. 31 people were irradiated at effective doses ranging from 0.04 Sv to0.17 Sv. The accident led to a significant transfer of radioactivity into the environment(via the facility’s stack).

" 24 May 1958 – NRU reactor (135 MW) – Chalk River Laboratories(Ontario, Canada)
A fuel element in the NRU heavy water reactor caught fire while it was being
unloaded. This element had been damaged the previous day along with other fuelelements during a reactor power increase. This accident caused large-scale contamination of the reactor building and the irradiation of workers.

" 15 October 1958 – (Zero-power) research reactor at the Boris Kidric
Institute in Vinca (former Yugoslavia)
A power excursion occurred in the reactor when the heavy water exceeded the critical level due to incorrect regulation (the chambers used for reactor power measurement were saturated). This accident, which was halted by an operator who ordered
the cadmium safety rods to be dropped, did not cause any damage to the reactor core,but six people received significant amounts of radiation: one of them received around
4.3 Sv and died; the other five were treated in France by bone marrow transplant.

" 3 January 1961 – SL-1 reactor83 (3 MW) – National Reactor Testing
Area, Idaho, USA
A power excursion occurred during a maintenance operation to prepare the SL-1
reactor to be restarted. The maintenance procedure required the control rods to bewithdrawn by a few centimetres to reconnect them to their drive motors. The accident
occurred when one of the control rods was withdrawn too quickly and too far from theplanned position. The reactor power reached nearly 20 GW in 4 ms and the resulting
energy release caused a pressure wave that pushed the control rods upwards. This accident caused the death of three people (two operators were killed instantly by the explosion following the power excursion and a third died two hours later).
The accident and the lessons learned are described in more detail in chapter 8.
83.

Stationary Low Power Reactor Number One.

International experience feedback for research reactors

63" 30 December 1965 – VENUS reactor84 (0.5 kW) – Mol (Belgium)
A limited power excursion occurred as a result of a handling error. The experimental
programme on the day of the accident consisted of determining the “efficiency” of thecontrol rods based on the correlation between the displacement of the rods and thedisplacement of the level of the moderator (a mixture of heavy water and light water),with the reactor in a critical state. The operator made a handling error, withdrawing
a control rod before inserting another, despite the fact that the written instructions
stated that the other rod should be inserted first. There was no damage to the facility
but the operator received a severe dose of radiation (doses received: 5 Sv in thechest and 40 Sv on one foot). He was saved but had to have the irradiated footamputated.

" 7 November 1967 – SILOE reactor (15 MW) – Grenoble (France)
The partial melting of six fuel plates in a “control element85” occurred during a reactor power increase. The incident, attributed to a plate cooling failure, led to the releaseof around 2 x 1015 Bq into the pool water and 7.4 x 1013 Bq through the stack (mainly
noble gases). This event is described more fully in chapter 10.

" 23 September 1983 – RA-2 critical assembly – Constituyentes(Argentina)
A power excursion (representing 10 to 15 MJ of thermal energy brought to the fuelin a few milliseconds) was caused by failure to follow the safety instructions when modifying the core configuration of the RA-2 reactor86 (the reactor vessel had not been
emptied first). The doses received by the operator were around 23 Gy due to gamma
radiation and 1.7 Gy due to neutrons. The operator died 48 hours after the accident.
Two people in the reactor control room were irradiated (receiving doses of around
0.2 Gy due to gamma radiation and 0.15 Gy due to neutrons), along with five others
who received total doses of between 40 and 200 mGy and another two who received
total doses of around 10 mGy.

4.3. Complementary safety assessments carried out
internationally following the accident at the
Fukushima Daiichi nuclear power plant
Following the accident that occurred on 11 March 2011 at the Fukushima Daiichi
nuclear power plant, operated by TEPCO, a number of initiatives were rapidly introduced to enable complementary assessments to be conducted in the light of the eventsaffecting the Fukushima Daiichi plant, based on experience feedback from the accident.

84.
85.
86.

Vulcan Experimental Nuclear System.
Fuel element containing an absorbing element.
Critical assembly similar to EOLE (see section 5.2).

64

Elements of nuclear safety – Research reactors

The European Council meeting on 24 and 25 March 2011 demanded that the various
EU Member States conduct these complementary safety assessments, known as “stresstests”, on their nuclear power plants. A specification was drawn up for this purpose,
based on proposals by WENRA87.
Complementary safety assessments were therefore simultaneously carried out
in the different EU countries based on similar specifications, and in some cases
extended – as was the case in France and Belgium – to other types of nuclear facility
or even to other issues88. These complementary safety assessments could therefore
be conducted not only on nuclear power reactors, but also on research reactors, fuelcycle facilities, etc.
Some of the first lessons learned from the accident at the Fukushima Daiichi nuclear
power plant were indeed generic in nature. In particular they concerned the robustnessof facilities with respect to the extreme hazards that can affect nuclear facility sites,
emergency response, organization and also the role of the safety authorities. Because
these issues are also relevant to research reactors and fuel cycle facilities, many countries have included these in their list of facilities to undergo complementary safetyassessments, with priorities relevant to the risks they present (inventory of radioactive
materials, age, proximity to residential areas, etc.).
The complementary safety assessments carried out in the EU Member States havegenerally looked at:– the possibility of extreme hazards occurring that exceed those considered when
the facility was designed, leading to station blackout or total loss of cooling, sothat additional measures can be identiﬁed where necessary to limit theconsequences of these accident situations;– the actual physical conditions of structures, systems and components signiﬁcantto the safety of each facility and the potential effects of the failure of non-safetyclass elements on elements signiﬁcant to safety, should an extreme event occur(hence the need to conduct detailed inspections of the facility);– the ability of I&C and facility monitoring equipment to provide appropriate
information in the accident situations considered by the complementary safetyassessments (extreme hazards, loss of power or cooling).
The key features of the complementary safety assessments carried out on research
reactors in France are presented in section 10.2.
Complementary safety assessments have also been carried out or are planned incountries other than the EU Member States, prioritised on the basis of the risks presented by each facility.
In June 2011, the IAEA organized a conference at ministerial level. An action plan
was put in place by the IAEA to improve nuclear safety worldwide.

87.
88.

Western European Nuclear Regulators Association.
Issues concerning the contractors used by operators were therefore addressed in France.

International experience feedback for research reactors

65

In this context, in 2011 the IAEA began preparing a procedure for conducting safety
reassessments of research reactors, based on the lessons learned from the accident at
the Fukushima Daiichi nuclear power plant. The purpose of this procedure, which was
the subject of a final report89 published in March 2014, was to obtain consistency between the different approaches of different countries, and to form the basis for any
reassessments yet to be carried out. Some of the principles expressed in this IAEA report
are explained below.
In this report, the IAEA expressly states firstly that, although the inventory ofradioactive material, and consequently the potential hazard associated with research
reactors worldwide, is much lower than that for nuclear power plants, generally speaking there are aspects that justify safety reassessment in the light of feedback from theaccident at the Fukushima Daiichi nuclear power plant: “the majority of research reactors worldwide were designed decades ago, and their design requirements are not fully in
conformance with IAEA Safety Standard No. NS-R-4. In addition, many research reactors
are located near populated areas, and for some of these the leaktightness of their confinement buildings is inadequate. These issues complicate the management of accidents
that result in radioactive releases. In some other cases, the characteristics of the research
reactor site and the site area and site vicinity may have changed since the facility wasconstructed. Not all the above mentioned issues are reflected in the safety analysis formany facilities”. Whether a reassessment is required should be decided on the basisof the potential hazard associated with each research reactor.
In terms of feedback from the accident at the Fukushima Daiichi nuclear power
plant, the IAEA draws particular attention in this report to the role and responsibilitiesof the safety authorities, which need to be clearly defined for both normal operating
conditions and accident situations. Moreover, the safety authorities must have the necessary expertise to supervise and review the post-Fukushima reassessments to be carried out by operators.
The main objective of the reassessment is “to evaluate the robustness of the existing
reactor protection, in terms of design features and procedures, against the impact of extreme events, with an emphasis on fulfilment of the basic safety functions”. A reassessment should consist of:– a review of the design basis of the reactor facility (taking account of theexperimental devices and associated equipment), as described in the safety
analysis report;– a study of events that are beyond the design basis of the facility90, which can beinitiated by extreme initiating events, in order to assess their potential impact on
the basic safety functions and the adequacy of existing measures to mitigate theconsequences of accidents, in order to identify the safety improvements neededfrom both a technical and an organizational point of view.

89.
90.

IAEA report entitled “Safety Reassessment for Research Reactors in the Light of the Accident at the
Fukushima Daiichi Nuclear Power Plant” ‒ Safety Reports Series No. 80 ‒ 2014.
Beyond design basis accidents.

66

Elements of nuclear safety – Research reactors

These reassessments must refer to the current status of the facility as built and as
operated (maintenance carried out, modifications made, etc.), the most unfavourable
permitted operating conditions, including core configurations, and current and plannedexperimental devices.
Safety reassessments should consider the possibility of the simultaneous occurrenceof more than one external hazard, as well as events that could occur as a result of this.
On the basis of these reassessments, additional measures to prevent or mitigate theconsequences of accidents should be defined and implemented if necessary.
Reassessment of the site should look at changes in the site characteristics since thefacility was built. This includes changes in the distribution of workers on the site and in
the surrounding population, changes made to other facilities within the site area, including changes of use, changes in local transportation routes, changes in local land use andchanges in hydrology and topography. Accidents that could occur simultaneously at different facilities should be considered.
The potential impact of extreme hazards on access to the reactor site for operatingor on-site response personnel, and the availability of off-site response organizations andresponse personnel, should also be reassessed. In other words, the emergency response
measures must be assessed to make sure they are adequate and can be implemented,
including if an extreme hazard occurs that affects several facilities simultaneously.
Reassessments also provide an opportunity to verify:– the existence of an adequate chain of command for response to an emergency
and of procedures and means for effective communication during an emergency;– preparedness of the on-site response teams and off-site response organizations tomanage effectively an emergency affecting several facilities on a single site
simultaneously;– the availability of emergency equipment and the performance of periodic checks
on that equipment;– site accessibility for off-site response teams and the availability of the necessary
logistical support.
At a conference held by the IAEA in November 2015, various research reactor operators (e.g. the operators of the IRR1 reactor91 in Israel and the SAFARI-1 reactor inSouth Africa) presented the actions plans that they had proposed to their respective
safety regulators following the safety reassessments conducted on the basis of the
IAEA’s report mentioned above or the recommendations of ENSREG (European Nuclear
Safety Regulators Group92) in the case of the stress tests.
Generally speaking, and by way of illustration, through the installation of new
equipment that can withstand earthquakes associated with the sites, including safetymargins, or through the modification of existing equipment to improve this earthquake
91.
92.

Israel Research Reactor-1.
A European Commission consultative group of independent experts.

International experience feedback for research reactors

67

resistance, the reassessments have resulted in proposals to improve the safety of reactors such as:– seismic detection linked to the reactor protection system, causing an automatic
reactor scram in the event of an earthquake;– an extra system to shut down the chain reaction (injection of a soluble neutron
poison, etc.);– an emergency power supply in addition to the existing power supplies (mobile
generator or backup battery), addition of easily accessible external connections;– additional means of emergency cooling, ﬁre service connections, core spraysystems;– strengthening of the containment vessel to improve its resistance to external
natural hazards;– improvements to emergency ventilation systems and their ﬁltration systems;– reinforcement of the means provided for effective emergency response, creationof off-site emergency control rooms with feedback of the information necessary
to monitor the facility, etc.
Most of these measures had already been implemented at research reactors inFrance, at the time of safety reviews, or had been reinforced or supplemented during
the stress tests carried out following the accident at the Fukushima Daiichi nuclear
power plant (this is discussed in section 10.2).
Other proposed improvements resulting from the reassessments concern the safety
culture, organizational aspects, and training and qualification programmes of operating
personnel.
Schedules have been drawn up for the implementation of these proposed improvements.
In conclusion, the complementary safety assessments performed on research reactors on the basis of feedback from the accident at the Fukushima Daiichi nuclear power
plant will help to improve defence in depth, including as regards emergency response.
Peer review of the results of this work has been conducted under the auspices of the
IAEA, at various technical meetings.

Part 2
Research reactors in FranceChapter 5
Evolution of the French research
reactor “fleet”
5.1. The diversity and complementarity of French
research reactors
In the IAEA’s Research Reactor Database (RRDB), 42 reactors in France are identified
as being research reactors93 (including those no longer in operation, the Jules Horowitz
reactor (JHR) which is under construction, and the research reactors at defence-related
facilities94).
General de Gaulle created the French Atomic Energy Commission (CEA95) by decree
in 1945, giving it responsibility for directing and coordinating the development of applications for the fission of the uranium atom nucleus. In this context, a team led by Lew
Kowarski started up the first French research reactor in 1948, the ZOÉ atomic pile built
at the CEA centre at Fontenay-aux-Roses (figure 5.1). The core of this reactor, consisting of uranium oxide-based fuel elements (1,950 kg) sitting in heavy water (5 tonnes) inan aluminium tank surrounded by a 90 cm-thick graphite wall, stood within a 1.5 metrethick concrete containment wall designed to absorb the different types of ionizing
radiation emitted by the nuclear reactions in the core. The ZOÉ reactor was used up
to a power of 150 kW to study the behaviour of materials under irradiation, and at
93.

94.
95.

This database gives the full list of French research reactors. See also the CEA publication entitled“Research Nuclear Reactors”, a Nuclear Energy Division monograph ‒ 2012, or the publication (inFrench) “Les réacteurs de recherche” by Francis Merchie, Encyclopédie de l’énergie, 2015.
This publication does not cover research reactors used for defence-related purposes.
Which would later become the Alternative Energies and Atomic Energy Commission.

72

Elements of nuclear safety – Research reactors

Figure 5.1. View of ZOÉ, France’s ﬁrst “atomic pile”. CEA historic archives. © CEA/Documentation
service.

low power to characterize the neutronic properties of the materials used in atomic piles
at the time (worldwide).
In the 1950s, some ten research reactors were commissioned in France. Having no
industrial enrichment capability of its own at the time, France set about improving
knowledge of the nuclear data for reactors using natural uranium. The AQUILON reactor at Saclay was designed for this purpose. This reactor and the ALIZÉ reactor (also at
Saclay) were then used to support the design of the on-board reactors in the first French
nuclear-powered submarines. The PROSERPINE reactor, also at Saclay, was used specifically for studying “homogeneous 96 ” reactors, using plutonium in solution as
fissile material. PROSERPINE was light water-moderated. It was used to compare theneutron characteristics of two fundamental fissile elements: plutonium-239 anduranium-235.
In parallel during the 1950s, reactors were built for material testing and technological research. Thus the EL2 then the EL3 reactors were commissioned at Saclay for the
purpose of producing artificial radioisotopes for studying the behaviour under irradiation of materials of structures used in reactors.
Towards the end of the 1950s, it became apparent that there was a need for betterknowledge of the fundamental neutronics parameters involved in nuclear reactor core
physics. In response to this need in particular, the MINERVE reactor was designed andcommissioned in 1959 at the CEA centre at Fontenay-aux-Roses.
96.

The fuel in a homogeneous reactor is in liquid form (nitrate or sulphate).

Evolution of the French research reactor “ﬂeet”

73

A further twenty or so research reactors were commissioned in the 1960s. The
development of the nuclear energy industry was already in full swing at the time but
there were limited computing resources available. The use of critical assemblies ormockups97 and material testing reactors appeared necessary to complete the acquisition of knowledge and data to support the industrial development of nuclear energy.
France was attempting to develop the GCR98 (gas-cooled, graphite-moderated) reactor
type using natural uranium as fuel. The MARIUS research reactor (commissioned in1960 on the Marcoule site, then transferred in the mid-1960s to the CEA site at Cadarache) and the CESAR research reactor (commissioned in 1964 at Cadarache) were usedin the early 1960s to conduct studies for the nuclear energy industry.
The use of fast neutron reactors was also explored at this time, especially for the
purpose of using the plutonium resulting from the operation of the GCR reactors.
The development of SFRs led in particular to the construction:– of the HARMONIE reactor at Cadarache, which ﬁrst went critical in 1965 and wasused mainly to determine the neutron characteristics of radiological protection
materials (the lateral neutron shielding around the core in fast neutron reactors);– the MASURCA99 critical assembly, also situated at Cadarache and commissioned
in 1966, which was used to study neutronics and, much later, to conduct research
into the transmutation of the actinides present in highly radioactive nuclear waste.
The RAPSODIE reactor at Cadarache was the first fast neutron research reactor andran on plutonium100 fuel and liquid sodium coolant. Numerous irradiation experiments
were conducted in RAPSODIE between 1967 (the year of its first criticality) and 1982
(permanent shutdown in 1983), as part of the development of steel cladding for sodium-cooled fast neutron reactors (SFRs). Experiments known as “end-of-life testing”,
extending as far as the melting of fuel at the core of certain fuel rods, were conducted
in 1982 (DISCO and FONDU tests).
The CABRI reactor, the first French reactor designed specifically for studying accident situations in SFRs (in a sodium loop), was built at Cadarache at the start of the
1960s; the first criticality of this reactor took place in December 1963. Tests were also
carried out in the sodium loop to study accident situations in pressurized water reactors(tests known as REP-Na). The SCARABEE reactor, used in the 1980s for tests related tosodium-cooled fast neutron reactors (since shut down and dismantled), shared the mainequipment of the CABRI reactor. It had a sodium loop of larger diameter than the oneused in the CABRI reactor.
The willingness of the USA to supply highly enriched fuel with uranium-235 meantthat it was possible in the 1960s to design higher power reactor cores with more intense
97.

Reactors using fuel element arrangements representative of the cores being studied (“assembly”)
and operating at almost zero power (“just critical”).
98. UNGG (Uranium Naturel Graphite-Gaz) in French.
99. Breeding assembly at the Cadarache Research Centre.
100. The RAPSODIE reactor, like subsequent French SFRs, ran on mixed UO2-PuO2 fuel; axial andradial “blankets” of uranium-238 (depleted uranium), a fertile material under a fast neutron ﬂux,
were also placed around the ﬁssile zone.

74

Elements of nuclear safety – Research reactors

neutron fluxes, so the reactors could be used for material testing. In France, three material testing reactors were designed at this time: the 30 MW PEGASE reactor at
Cadarache, the 35 MW SILOE reactor at Grenoble (forced downstream water circulation; this reactor was in operation from 1963 to 1997), and the 70 MW OSIRIS reactor(figure 5.2) at Saclay (upstream water circulation; in operation from 1966 to 2015).
These reactors were each accompanied by a critical assembly: PEGGY for PEGASE,SILOETTE (figure 5.2) for SILOE and ISIS for OSIRIS.

Figure 5.2. Left, Osiris reactor core. View of the submerged neutron radiography installation (2004).
© L. Godart/CEA; right, view of the SILOETTE critical assembly. © CEA.

Unlike the high flux reactor (RHF101) in Grenoble and the ORPHEE reactor, SILOE
was a light water pool-type reactor built for irradiating materials and equipment. The
core (figure 5.3) consisted of elements containing fuel enriched to 90% uranium-235.
However, the SILOE reactor also had neutron channels not aimed directly at thecore, as well as a beryllium102 wall along one of the four sides of the core103. To start
with, there were only two radial channels. After the MELUSINE reactor was shut down in
1988, a tangential channel was added to SILOE, which aimed at the beryllium wall
through the slice. This brought the number of instruments to six, with two devices
per channel (spectrometers, diffraction meters). Despite difficult working conditions
for the scientists (high temperatures, confined spaces, etc.), this equipment gave excellent service from a scientific point of view and was used to train scientists, especially inpowder diffraction and single crystal diffraction, as well as polarised neutron scattering.
In 1969, France took the decision to stop building GCR reactors in favour of USdesigned pressurized water reactors. In the decade that followed, with experimental
101.
102.
103.

Réacteur à Haut Flux in French.
This material is a neutron source when struck by high energy gamma rays in particular.
Source: ARILL (“Association des retraités de l’Institut Laue-Langevin”): “Le réacteur de recherche
Siloé”.

Evolution of the French research reactor “ﬂeet”

75

Figure 5.3. View of the SILOE reactor core. @ CEA.

needs largely being met, few new research reactors were built compared to the 19501970 period.
However, two high flux reactors, with neutron beams for fundamental physics
experiments, were then commissioned: the high flux reactor (the 58 MW RHF) at
Grenoble, run by the Institut Laue–Langevin (ILL), which went critical in 1971, andthe ORPHEE reactor (14 MW) at Saclay, which went critical at the end of 1980.
In 1972, in association with EDF, the CEA set up the Pile Construction Department
within the Atomic Piles Division at the CEA. The Department was subsequently hived off
and attached to the company Technicatome104, which would become the TA branch of
the company AREVA. These entities and companies made a major contribution to thedesign and construction of research reactors, up to and including the Jules Horowitz
reactor.
As regards the development of fast neutron reactors, a large number of experimental irradiations were carried out in the PHENIX power reactor, at Marcoule, which wascommissioned in 1974, until its final shutdown in February 2010. As was the case with
the RAPSODIE reactor, later tests also known as “end-of-life105” tests related to safetyissues were carried out (e.g. the possibility of initiating natural convection of thesodium in different reactor circuits, the risk of cladding failure in the event of partial
melting in the core of a pin containing fuel pellets, etc.).
104.
105.

The company GAAA (Groupement Atomique Alsacienne Atlantique), which later became
Novatome, worked with the CEA and EDF on the design of the fast neutron reactors.
See the publication by Joël Guidez “PHENIX ‒ The experience feedback”, Chapter XV, Collection:
Hors Collection, EDP sciences, 2013.

Elements of nuclear safety – Research reactors

76

Similarly, the PHEBUS test reactor was commissioned in 1978 at Cadarache to study
cooling accidents in pressurized water reactors.
Finally, the CEA launched a project to build a new material testing reactor, the Jules
Horowitz reactor. The reactor, which is under construction at Cadarache, will take overfrom the OSIRIS reactor, the final shutdown of which took place at the end of 2015. We
will look at this new reactor in more detail later on.
Table 5.1 below presents the French reactors used either wholly or partially for experiments, with their commissioning date (excluding facilities used for defence purposes).

Table 5.1. List of French reactors used wholly or partially for experiments, with theircommissioning date.
Reactors using(light or heavy)water or air forcore cooling

Reactors
using liquidsodium forcore cooling

Criticalassemblies

Studies ofreactorphysics(including thedeterminationof nuclear
data),
radiologicalprotection,
irradiation

ZOE (1948)
EL2 (1952)
EL3 (1957)
MELUSINE (1959)
TRITON (1959)
NEREIDE (1960)
PEGASE (1963)
SILOE (1963)
OSIRIS (1966)
JHR (underconstruction)

RAPSODIE (1966)
PHENIX (1974)

AQUILON (1956)
PROSERPINE (1958)
ALIZE (1959)
RUBEOLE (1959)
MINERVE (1959)MARIUS (1960)
PEGGY (1961)
RACHEL (1961)
SILOETTE (1964)
CESAR (1964)
EOLE (1965)
ISIS (1966)
HARMONIE (1965)
MASURCA (1966)

Safety tests

CABRI (sodium loop,
1972)
PHEBUS (1978)CABRI (water loop)

RAPSODIE (1966)
PHENIX (1973)(for "end-of-life"
tests)?

Reactortype ?
uses

Studies of thephysics ofmatterTeaching

Neutron beamreactors (heavy
water/lightwater)

RHF (1971)
ORPHEE (1980)
MINERVE (1959)
ULYSSE (1961)
Argonaut class
SILOETTE (1964)
RUS « Cronenbourg »(1966)
Argonaut class
ISIS (1966)

Evolution of the French research reactor “ﬂeet”

77

5.2. Current situation
Since the ZOÉ pile, around forty research reactors have therefore been built andoperated in France. In mid-2018, with the shutdown of the OSIRIS reactor, there wereseven research reactors left “in operation”106. The others are scheduled for permanent
shutdown without utilization (PHEBUS), are decommissioned or dismantled, or have already been dismantled.
Of the reactors still in operation, three are critical assemblies: EOLE, MINERVE and
MASURCA, now all at Cadarache. The MINERVE reactor (figure 5.4) was commissioned
in 1959 at the Fontenay-aux-Roses centre but was transferred to Cadarache in 1977. It
is dedicated to the neutron characterization of materials (fissile, fertile, neutron-absorbing or structural materials) and to studying the physics of cores of different types ofreactor. It is a pool-type reactor with a maximum operational power of 100 W. The
reactor core, which consists of fuel elements in the form of UAl alloy plates, enriched
to around 93% uranium-235, is surrounded by graphite reflector elements and submerged in a large volume of demineralized water (140 m³), which protects the operators from ionizing radiation and removes the (small amount of) heat from the core.

Figure 5.4. The MINERVE pool. Loading a sample into the central cavity to measure the reactivity
effect using the “oscillation method”. © G. Lesénéchal/CEA.

The EOLE reactor (figure 5.5), commissioned in 1965, is in the same building as the
MINERVE reactor. It also operates at very low power (100 W maximum), but its design
is very different to that of the MINERVE reactor. The EOLE reactor, which has a variety
106.

ORPHEE, ISIS, MASURCA, CABRI, EOLE, MINERVE and the RHF.

78

Elements of nuclear safety – Research reactors

Figure 5.5. View of the EOLE reactor vessel conﬁgured for the PERLE experiment (2008). © P. Dumas/CEA.

of measuring equipment (γ spectrometry, fission chambers, thermoluminescentdetectors), can entirely characterize core configurations from a physics and neutronics
point of view. During every experimental programme conducted in the EOLE reactor, a
new core is loaded using the facility’s available fuel elements. The core is placed in asmall metal vessel (around 1 metre high by 1 metre in diameter) into which water,
maintained at a consistent temperature and possibly borated, is gradually injected until
criticality is reached. Measurements are then carried out on the fuel elements not only
while it is at power but also once the reactor has been shut down. By repeating thesemeasurements for different experimental core configurations (change of material,
replacement of a fuel element by water, insertion of an experimental device, etc.), it
is possible not only to characterize the effects of the tested materials and devices oncore reactivity, but also to assess characteristic neutronics parameters such as the
Doppler effect or the effect of the moderator (neutron feedback). The EOLE reactor,
for example, played a part in the qualification of neutronics modelling tools used todesign the Jules Horowitz research reactor (JHR).
The MASURCA critical assembly (figure 5.6), also at Cadarache, has the particularcharacteristic of being cooled not by water but by air. The experimental cores loaded
into it are much bigger (up to 6 m³ in volume) than those that can be loaded into
the EOLE and MINERVE reactors. The MASURCA assembly, which has a maximum powerof 5 kW, was specifically designed to study the characteristics of fast neutron reactor
cores. Each experimental core consists of tubes of square section filled by hand with

Evolution of the French research reactor “ﬂeet”

79

Figure 5.6. MASURCA reactor: core viewed from below, fuel elements being dropped. © P. Stroppa/
CEA.

small fuel elements (in the form of rodlets or platelets), neutron-absorbing elements or
coolant elements (sodium in solid form) representing the lattice to be studied from aneutronics point of view. The ability to create “à la carte” cores means that core concepts for very varied and innovative reactors, such as accelerator driven systems (ADS)and high temperature reactors (HTR), can be studied. The MASURCA assembly has been
shut down since 2007 and the CEA is going to carry out major renovation work on it toanswer neutronics questions related to the Generation IV fast neutron reactors, particularly for the ASTRID (Advanced Sodium Technological Reactor for Industrial Demonstration) project.
Whereas the MASURCA reactor has been kept in operation mainly to support studies related to the ASTRID project, experiments in the EOLE and MINERVE reactors were
stopped at the end of 2017; there are plans to build a facility named ZEPHYR to replacethem.
The low power research reactors also include reactors used for teaching. They are
valuable for delivering the teaching programmes of educational establishments specializing in nuclear, as well as the training programmes of nuclear operators and safety bodies. Within these programmes, the reactors used are either reactors dedicated almost
exclusively to training (the ISIS reactor at Saclay), or reactors that have training periods
included in their operation (MINERVE reactor at Cadarache).
The ISIS reactor (figure 5.7) was designed as a neutron mockup of the OSIRIS reactor
at a scale of 1:10. It has a maximum power of 700 kW and can be used to carry out tests
related to new configurations of the OSIRIS core and new fuels or new irradiation experiments in the reactor. The ISIS reactor underwent major renovation work between 2004
and 2006 in order to adapt it fully for training activities. In particular, the control room
was redesigned to accommodate participants in training sessions. A supervision

80

Elements of nuclear safety – Research reactors

Figure 5.7. Top, French Master’s course, practical work in the ISIS reactor control room (2013). © PF.
Grosjean/CEA. Bottom, practical work in the ISIS reactor; students from the École des Ponts et
Chaussées on the “Principles and operations on nuclear reactors” course (2010). © S. Renard/CEA.

software was developed for monitoring changes to significant parameters during
handling operations in the reactor. Around a hundred half-day practical training sessions
are carried out each year at this facility, which is now assigned solely to training; its
shutdown is scheduled for 2018.
For material testing, France particularly made use (until 2015) of the OSIRIS
reactor at Saclay. The corresponding activities will be taken over by the Jules Horowitz

Evolution of the French research reactor “ﬂeet”

81

reactor, which is under construction at Cadarache but is not expected to be commissioned until 2020107.
As a reminder, material testing reactors are designed to produce relatively high neutron fluxes and to accommodate devices inside the reactor core or around the edge ofit, in which to place the items to be irradiated.
The OSIRIS reactor (figure 5.8), commissioned in 1966, was an open core pool-type
reactor. The water acted simultaneously as moderator108, as coolant109, and as radiological shielding. Its core, which was fairly small (57 cm x 57 cm x 60 cm), contained
44 fuel elements and could release a maximum power of 70 MW. The water circulated
from bottom to top in the core. The high neutron fluxes, both inside the core andaround it, were greater than those in a PWR power reactor, making it possible to study

Figure 5.8. OSIRIS reactor pool. © Laurent Zylberman/Graphix-Images/IRSN.

107.
108.
109.

“Le chantier du réacteur Jules Horowitz”, Libération {Sciences2}, 25 January 2016.
A moderator is a material that slows down neutrons through a succession of collisions withatoms (generally hydrogen) present in the material.
A coolant absorbs and removes the heat produced in the fuel by the ﬁssion reactions.

Elements of nuclear safety – Research reactors

82

the accelerated ageing of materials under irradiation in these reactors. They could
also be used to produce artificial radioisotopes used in medicine for diagnosis by scintigraphy or for treating certain cancers (brachytherapy) and other diseases. Also, theirradiation of monocrystalline silicon ingots made it possible to alter the atomic structure of the silicon, giving it the properties of a semiconductor (silicon “doped” in thisway is used by the electronics industry).

" A new generation material testing reactor: the Jules Horowitz
reactor
The Jules Horowitz reactor110, or JHR, for which the design process was begun by
the CEA in 1998, should meet the need expressed by the European Commission for amodern, flexible research facility (the other European reactors that can perform thesame functions date from the 1960s, see table 5.2 below) to carry out experiments –around twenty at once – contributing to:– improving the competitiveness and service life of nuclear power reactors inoperation,– developing the performance of nuclear fuels in “third-generation” reactors suchas the EPR (European Pressurized Reactor111),– developing new materials and fuels for “fourth generation” (Gen IV) reactors suchas the one for the ASTRID project,– improving the reliability of European radioisotope supplies for the medical sector.
Table 5.2. Material testing reactors in Europe (source CEA).
Country
Belgium
Netherlands
NorwayFranceSwedenResearch reactor

Age (in 2017)

Power (MWth)BR2, Mol
HFR, Petten
HRP, Halden
OSIRIS
R2, Studsvik

54
56
57
Shut down in 2015 after 49 years in operation
Shut down in 2005 after 45 years in operation

60
45
19
70
50

Within the JHR project, the CEA is working with Belgian, Czech, Spanish, Finnish andJapanese research institutes and the companies EDF and AREVA (Framatome) in France
and Vattenfall in Sweden. In 2008, India’s Department of Atomic Energy (DAE) joined

110.

111.

Sources used: Nuclear Research Reactors, a Nuclear Energy Division monograph ‒ 2012,
pages 95 to 106, The JHR, CEA Cadarache website (http://www.cea.fr/english/Pages/researchareas/nuclear-energy/jules-horowitz-research-reactor-JHR.aspx ), which in particular links to thereport published on the ASN’s website “Réacteur Jules Horowitz ‒ Évaluation complémentaire dela sûreté au regard de l’accident survenu à la centrale nucléaire de Fukushima I” (CEA/DEN/CAD/
DIR/CSN DO 575 13/09/11), the Wikipedia article and its references, etc.
European version of a pressurized water reactor.

Evolution of the French research reactor “ﬂeet”

83

the seven original partners in the project. The agreements signed between these partners will give them access to the facility to conduct their own experiments.
The objective of the promoters of the JHR project is to create a major European
infrastructure open to international collaboration that will help to cover research anddevelopment needs over several decades.
The JHR is a closed core pool-type reactor. The core will be composed of fuel elements of circular cross-section, with curved fuel plates, cooled by water streaming inan upward direction (primary coolant system). This assembly will be surrounded byreflector elements (water and beryllium) and will be placed in a pool. In terms of performance, its maximum power will be 100 MW and the aim is to achieve a neutron flux ofaround 1015 neutrons.cm-2.s-1 (energy greater than 0.1 MeV), with a fast neutron flux ofenergy greater than 1 MeV of around 5 x 1014 neutrons.cm-2.s-1. A particular feature of
the neutron spectrum is that it will have two energy peaks, enabling material testing to
be carried out in the thermal neutron range (applications for common existing reactors)
and partially in the fast neutron range (applications for Gen IV fast neutron reactors112).
Irradiation devices can be inserted in the centre of fuel elements (see diagram at thebottom of figure 5.10), can be positioned in place of fuel elements, or can be placed in
the reflector (figure 5.9). Displacement systems in the core periphery can also be used
to simulate conditions representative of transients, incidents or accidents likely to occur
particularly in power reactors (slow power ramps).

Figure 5.9. Planned layouts in the reﬂector area of the Jules Horowitz reactor. © Georges Goué/IRSN.

Most of the samples that will be placed in the JHR core will be prepared and analysed in the fuel laboratories at the CEA centre at Cadarache, located close to the JHR to
reduce the transport of radioactive materials (and the associated risks).
112.

See the publication “Overview of Generation IV (Gen IV) Reactor Designs/Safety and RadiologicalProtection Considerations”, Reference Documents Series, IRSN 2012/158, available atwww.irsn.fr/EN.

Elements of nuclear safety – Research reactors

84

Figure 5.10. Jules Horowitz Reactor: diagrams of the nuclear unit, reactor block, core and a fuelelement. © ASN.

It is expected that the JHR will contribute 25% of European radioisotope production
for medical use, or even up to 50% if necessary. Since the OSIRIS reactor was shut
down, technetium-99m has been produced particularly at the HFR research reactor in
Petten (Netherlands) and at the BR2 research reactor in Mol (Belgium) – the Canadian
NRU reactor dating from 1957, which is responsible for more than 40% of global
production, is back in operation after various shutdowns, particularly following the discovery in 2009 of a heavy water leak at the base of the reactor vessel.
In terms of general architecture, the JHR consists of two buildings (see figure 5.10):– the reactor building, which houses the reactor itself, the equipment needed tooperate it, and the equipment used to monitor experiments (workstations forexperimenters, electrical equipment, instrumentation and control equipment, etc.);– the nuclear auxiliary building, which contains hot cells for preparing, conditioning
and examining experimental samples, and three storage pools.
Both buildings will be on the same foundation raft; they constitute the “nuclearunit”. Seismic isolation is achieved by means of aseismic bearing pads. This will be explained in more detail in section 7.4.2.
The reactor has three systems:– the primary coolant system, which cools the reactor core through the circulationof pressurized water (at about 10 bars at the core inlet). This closed circuit isinside the reactor building. The reactor core and part of the primary system aresubmerged in the reactor pool (ﬁgure 5.11);

Evolution of the French research reactor “ﬂeet”

Figure 5.11. Reactor block of the JHR. © DR.

85

Elements of nuclear safety – Research reactors

86– the secondary coolant system, which is isolated from the primary system andcools the primary system by means of heat exchangers placed between the twosystems in the reactor building. The pressure in the secondary system is higher
than the pressure in the primary system so that, if there is a leak between the
primary and secondary systems, the secondary system is not contaminated;– an external coolant system, which cools the water in the secondary system bymeans of other heat exchangers placed in another building at the facility (thecoolant building). This system will be connected by a channel to the Canal deProvence. The water will be returned to the EDF canal, ensuring that the waterin the canal remains below a temperature of 25°C, in accordance withregulations.
These three systems in series will reduce the risk of contamination being transferredfrom the core to the environment (the water in the EDF canal).
The JHR facility has three storage pools:– the spent fuel storage pool, which will be used to store spent fuel from thereactor before it is processed at the Cogema plant at La Hague;– the irradiated devices storage pool, which will be used to store (around thirty)
experimental devices and to perform examinations under water;– the irradiated components storage and dismantling pool, which will be used tostore components from the reactor’s internal structures, core structures(reﬂector) and tools used for handling and dismantling.
The fuel elements and experimental devices will be transferred between the reactor
and the pools or hot cells under water.
The general safety objectives used for the design of the JHR, in terms of radiologicalconsequences of incidents and accidents, are similar to those used for new generation
power reactors such as the EPR; this will be discussed in more detail in chapter 7.
The gaseous discharges associated with the JHR will be generated mainly whenexperimental devices are opened in the hot cells and when degassing the primary circuit. The ventilation systems will be fitted with HEPA filters and iodine filters to limit
the quantity of gaseous discharges. The activity of these discharges – consisting mainlyof noble gases (xenon, krypton, etc.), halogens (iodine, etc.) and tritium – is expected tobe similar to the activity measured at existing research reactors, considering the experiments conducted there.
Liquid waste should be generated mainly during experiments, decontamination of
the hot cells, and regeneration of the resins used to purify the water in the reactor pooland the storage pools. These radioactive effluents will be managed by the treatment
plant at the Cadarache Centre.
According to CEA estimations, when the JHR is in operation, gaseous discharges andliquid waste from the Cadarache Centre should remain at a few percent of the values
stipulated by the annual authorizations for the Centre.

Evolution of the French research reactor “ﬂeet”

87

The construction licence for the JHR was granted by decree113 in 2009 (it is not expected to be commissioned until 2020).
Among its reactors in operation, France also has two reactors delivering neutron
beams used for scientific research. They are the ORPHEE reactor, operated by the CEA
at Saclay114, and the high flux reactor (RHF), operated by the Institut Laue–Langevin at
Grenoble.
These reactors operate in cycles of several weeks, separated by shutdowns for refuelling and maintenance. In these reactors, heavy water is used to slow the neutrons produced by fission (neutron moderation) and make them usable for testing matter:– in the RHF reactor, heavy water is used as the core coolant (the core consists of asingle fuel element), placed in a heavy water vessel, with the whole assembly
sitting in a light water pool;– in the ORPHEE reactor, light water is used as the core coolant and heavy water isused as the reﬂector, with the whole assembly sitting in a light water pool (seeﬁgure 5.12).

Figure 5.12. Respective uses of light water and heavy water in the ORPHEE and RHF reactors. In bothcases, the water circulates downwards in the core. © Georges Goué/IRSN.

Because the energy of the neutrons must be controlled to suit the experiments
being conducted, special devices are used to modify this energy locally. A container
113.
114.

Decree No 2009-1219 of 12 October 2009.
The corresponding basic nuclear installation (INB N° 101) consists of the ORPHEE reactor andthe Laboratoire Léon Brillouin (LBB) where researchers from the CNRS and the CEA work in theﬁeld of neutron spectrometry.

88

Elements of nuclear safety – Research reactors

filled with hydrogen or liquid deuterium (at a temperature of around ‒ 250°C) is used
to obtain slow neutrons (“cold source115”) and a block of graphite heated to more than
1,000°C is used to obtain high energy neutrons (“hot source”).
The neutrons (thermal, slow or fast) are “collected” for experimental use via “beamtube ends” directed at the reactor core. The collected neutrons are then guided out ofthe pool where they are filtered to extract the neutrons with the correct wavelength forirradiation of the material sample being tested (in the experimental area or neutron
guide hall around the reactor – figure 5.13). The other neutrons in the beam are stopped
by a concrete wall which acts as a shield.

Figure 5.13. Left, a neutron guide hall (RHF). © Artechnique/ILL; right, “D10” device. © ILL.

These reactors also have vertical channels near the heavy water vessel, used mainly
for irradiation.
The ORPHEE reactor has nine horizontal (multiple beam) beam tubes at a tangent tothe core, which enable 20 neutron beams to be used (figure 5.14). The beam tube ends
are in the moderator (heavy water) near the core, where the heated neutron flux is at its
greatest; three beam tube ends are directed at two “cold sources”, and two others at
one “hot source”. The physicists doing research at ORPHEE belong to a laboratory
run jointly by the CEA and the CNRS, known as the Laboratoire Léon Brillouin (LLB),
and work in fields as varied as chemistry, biology, metallurgy and physics. The ORPHEE
reactor is also used for activation analyses in partnership with the Laboratoire Pierre Süe(CEA), for irradiating samples and for producing radioisotopes for industrial and medicaluse (Cis-bio international), and finally for doping monocrystalline silicon by nuclear
transmutation.
With a maximum power of 14 MW, the ORPHEE reactor (figure 5.15) delivers a neutron flux of up to 3 x 1014 neutrons.cm-2.s-1 in the heavy water vessel. Its core, which
consists of eight fuel elements of square cross-section, with flat fuel plates, containing
115.

Not to be confused with the external source of cooling of a reactor (water from a river, the sea,
air, etc.).

Evolution of the French research reactor “ﬂeet”

89

Figure 5.14. Horizontal cross-section of the ORPHEE reactor showing the nine beam tubes of theneutron channels. At the centre of the core, the red spots indicate the “cold sources” and the “hotsource”; the heavy water is represented in yellow and the light water in blue. © CEA.

Figure 5.15. ORPHEE reactor: diagram of the reactor block, vertical section. © CEA.

90

Elements of nuclear safety – Research reactors

highly enriched uranium (93%), is cooled by light water circulating at a rate of 7.5 m/s.
The assembly consisting of the reactor core and the heavy water vessel (made fromstainless steel) is submerged in a light water pool.
The high flux reactor at Grenoble (RHF, figure 5.16), an international research facility, has 13 horizontal beam tubes, four inclined tubes and two vertical tubes (one ofwhich is used for the startup neutron source). It can simultaneously deliver neutrons
to around forty different experimental devices. Nine beam tubes are directed at two“cold sources” and four beam tubes are directed at the “hot source”. The core of the
RHF consists of a single annular fuel element containing curved fuel plates of highly enriched uranium (93% of uranium-235). It is cooled with heavy water circulating at a rateof 5.5 m/s. It produces most intense neutron flux to date, of 1.5 x 1015 neutrons.cm-2.s-1(thermal neutron flux in the heavy water vessel). As with ORPHEE, the assembly consisting of the reactor core and the heavy water vessel (made from an aluminium alloy
known as AG3NET in the case of the RHF) sit in a light water pool.

Figure 5.16. Diagram of the RHF. © ILL.

The heavy water detritiation facility, which used to be near the ILL, has beenpermanently shut down, so the operator has decided to contract out the detritiationof the heavy water to a Canadian company.
In 2016 France was still operating a research reactor dedicated entirely to safety
testing, or more precisely to studying the behaviour of the fuel elements of light water
nuclear power plants in certain accident situations. This was the CABRI reactor(figure 5.17), located at the CEA’s Cadarache centre, which can be used to test a freshor irradiated nuclear fuel sample under the conditions which would result from aEvolution of the French research reactor “ﬂeet”

91

Figure 5.17. Diagram of the CABRI and its pressurized water test loop. © DPAM/IRSN.

reactivity-initiated accident in a power reactor. The reactor consists of a driver core andan experimental loop. The part of the loop in the centre of the driver core holds the test
device containing the fuel to be tested. The driver core supplies the neutron flux
necessary to obtain the desired power in the fuel being tested, and the experimental
loop makes it possible to apply thermohydraulic conditions representative of the conditions in a power reactor. A particular feature of this reactor is its controlled reactivity
injection system. Instead of the last ring of fuel rods, four assemblies in the driver coreare equipped with peripheral cylindrical tubes116, which are filled with pressurized
helium-3 before the reactor is started (this gas is a good neutron-absorber). Oncethe reactor has reached nominal power and the required thermohydraulic conditions
are obtained in the experimental loop, these tubes are depressurized by opening somevalves in a specific sequence, which alters the reactivity117 and therefore the power
delivered by the driver core. To study very rapid reactivity injections, it is possible toincrease the power of the CABRI reactor from 100 kW to 20 GW in a few milliseconds;
the power then drops again as rapidly as it increased due to neutron feedback (inparticular the Doppler effect).
In the past, the CABRI reactor had had a sodium loop, which was used for a numberof different programmes until the 2000s – not just for sodium-cooled fast neutron
reactors but also for pressurized water reactors (REP-Na tests). This sodium loop was
replaced by a pressurized water loop.
116.
117.

Also known as “transient rods”.
As the gas disappears from the core, the number of neutrons in the core increases, causing moreﬁssions.

Elements of nuclear safety – Research reactors

92

Some safety issues of nuclear power reactors exploredwith experimental programmes conducted at
French research reactors
Research reactors are essential tools for scientific and technological research andfor supporting the development of nuclear power reactors. The experiments
conducted in these reactors have helped to improve the safety of power reactors
as regards accidents, through better knowledge of the phenomena involved.
The OSIRIS reactor has been used to study the behaviour of fuel cladding inpressurized water reactors subject to a slow pressure increase (slow power rampsof several tens of seconds to several minutes). These tests were carried out on
sections of irradiated fuel rods and were used to establish limits for the use ofdifferent cladding materials.
Test programmes run at the CABRI reactor have studied the behaviour of fuelelements in power reactors in the event of the removal or ejection of neutronabsorbing elements from the cores of these reactors118.
From 1978 to 2001, the CABRI a reactor was used to study accidents involving
inadvertent control rod withdrawal in sodium-cooled fast neutron reactors (SFRs),
through (slow power ramp) tests conducted on single fuel pins119 in a sodium-filled
loop. In particular, the risk of ejection of molten fuel from a pin with a pre-existing
cladding defect was explored.
The SCARABEE reactor was also used from 1983 to 1989 to study, in a sodium
loop of larger diameter than the CABRI loop, hypothetical accidents involving theblockage or melting of fuel assemblies in an SFR. The tests were conducted on
small assemblies of up to 37 pins.
The sodium loop in the CABRI reactor was also used to study the behaviour offuel rods in pressurized water reactors (PWRs) under neutron-absorbing rod
cluster control assembly ejection conditions. This type of accident assumes thatthe cluster mechanism has ruptured. Ejection is caused by the pressure difference
between the reactor coolant system and the containment vessel. This violent ejection causes a local runaway effect in the nuclear reaction for several tens of
milliseconds (power pulse), leading to a rapid increase in fuel temperature. Neutron
feedback limits the power transient before reactor scram, which occurs in a second
phase. The sudden heating of the fuel pellets during the power pulse causes them toexpand rapidly and, in some cases, to release the fission gases in the fuel. Subject
to these stresses, the rod cladding can break up, releasing extremely hot fuel
118.
119.

See the publication “Current State of Research on Pressurized Water Reactor Safety”, Science andTechnology Series, IRSN/EDP Sciences, 2017.
Term used for SFRs. For PWRs, the term “rod” is used.

Evolution of the French research reactor “ﬂeet”

93

fragments. For pressurized water reactors, criteria were set in the 1970s based on
the results of the SPERT tests120 conducted in the USA on fresh or lightly irradiated fuel. The tests conducted in the CABRI reactor in the 1990s (and at the NSRR
reactor in Japan) on sections of industrial fuel rod pre-irradiated in pressurizedwater reactors studied the mechanical phenomena that occur during the first tensof milliseconds of the power excursion, when the cladding temperature is not reallyaffected. These were known as the REP-Na tests, and in particular they included atest on MOX fuel121 that had reached a burnup of 55 GWd/tU, and a test with a rod
clad with a new alloy known as M5®.
To study phenomena that occur after the first few milliseconds (drying andswelling of the cladding), and the consequences in terms of a pressure wave ofany dispersion of fuel in the coolant, IRSN has planned further tests in the CABRI
reactor’s pressurized water loop ‒ this is the OECD 122/NEA project known as theCabri International Programme (CIP), conducted in partnership with EDF andmany foreign safety organizations and companies.
The PHEBUS reactor has made a major contribution to the acquisition ofknowledge about the physics of accidents that can lead to partial or total core melt
in a PWR123. The international Phebus-FP programme (FP for fission products),
run by IRSN , has made it possible to simulate core melt on a small scale. The main
aim of this programme was to contribute to improving knowledge of the radioactive releases that can occur in the environment during this type of accident. Fivetests were conducted for this purpose from 1993 to 2004 in an experimental device
installed in the PHEBUS reactor. These tests aimed to reproduce the main physicalphenomena that could govern core melt in a pressurized water reactor and thetransfer of radioactive substances from the nuclear fuel into the containment vessel.
The experimental device (figure 5.18), which was used to simulate the core, thereactor primary coolant syste and the containment vessel, consisted of an in-pile
part, passing into the core of the PHEBUS reactor, and an out-of-pile part known
as the “FP container”. The fuel used in the experiment, which was first irradiated ina research reactor or power reactor, was inserted into the in-pile part of the device.
More than 200 measurement sensors and around 100 sampling devices constituted
the test instrumentation. Following operation of the PHEBUS reactor at power torecreate short-lived fission products such as iodine-131 in the test assembly, thepower was reduced and cooling of the test assembly was stopped. The test fuel thenheated up rapidly until it melted. The fission products released by the fuel cladding
were then guided into the FP container. The experiments carried out provided
important data for understanding the mechanisms of core degradation in a PWR
and the behaviour of the fission products released in the circuits. These tests also
120.
121.
122.
123.

SPERT (Special Power Excursion Reactor Test) is the name given to power excursion research
reactors at the Idaho Falls research centre in the USA.
Mixed Oxide Fuel (mixed UO2 + PuO2 fuel).
Organisation for Economic Co-operation and Development.
See the publication "Current State of Research on Pressurized Water Reactor Safety", Science andTechnology Series, IRSN/EDP Sciences, 2017, and the publication "Nuclear Power Reactor Core
Melt Accidents – Current State of Knowledge", Science and Technology Series, IRSN/EDP
Sciences, 2013.

Elements of nuclear safety – Research reactors

94

Figure 5.18. Diagram of the Phebus-FP facility. © Stéphane Jungers/IRSN -Source IRSN.

confirmed knowledge already acquired in laboratory experiments and helped to
improve and validate several codes for simulating core melt accidents developed
and used throughout the world, including some used by IRSN for its safety assessments or level 2 probabilistic safety analyses (ASTEC124 software).
....................................................................................................................................................................................................................

124.

Accident Source Term Evaluation Code (system of simulation codes for evaluating the physicalphenomena occurring during a core melt accident in a pressurized water reactor).

Chapter 6
Stakeholders and organizationof research reactor safety in France
The organization of safety in France has changed over time. While the intention is
not to provide a complete history of the organization of safety125 in this chapter, someof the aspects most relevant to a publication specifically about research reactor safety
are nevertheless worth mentioning.
The organization of safety originally relied on the French Atomic Energy Commission (CEA), which was given responsibility when it was created in 1945 for developing
all necessary aspects of the use of this type of energy – in particular by building andoperating research reactors. However, a decree was passed in 1973 setting up a special
safety body, the SCSIN (Service central de sûreté des installations nucléaires), within the
Ministry of Industry. This body underwent a number of changes and had various different names at different times, but it eventually finished up with the creation in 2006 of
an independent authority, the French Nuclear Safety Authority (Autorité de sûreté nucléaire, or ASN).
In addition, the part of the CEA concerned particularly with safety and radiologicalprotection research and assessment was turned into a separate institute, the Institutefor Protection and Nuclear Safety (IPSN), in 1976. The IPSN is the forerunner of the
IRSN, created in 2002, which is now independent of the CEA and includes the Officefor Protection against Ionizing Radiation (OPRI), previously under the authority of the
Ministry of Health.
125.

For this, see the work by Philippe Saint Raymond entitled “Une longue marche vers
l’indépendance et la transparence ‒ Histoire de l’Autorité de sûreté nucléaire française”, La
documentation française, 2012.

Elements of nuclear safety – Research reactors

96

6.1. Operators
The organization of safety in France ‒ obviously in line with the principles and recommendations issued by international organizations like the IAEA ‒ takes account ofspecific national factors. France’s largest nuclear facilities are operated by large organizations: Électricité de France (EDF) for power reactors, Cogéma, once part of AREVA(now Orano), for most fuel cycle facilities, and the CEA for most research reactors(and other facilities), the exception being the Institut Laue-Langevin (ILL), an international body, which operates the RHF at Grenoble.
French operators are therefore much less fragmented than in most other countries
and generally participate in the design of their facilities. They consequently have a particularly high level of expertise. The CEA also has specific scientific and technical expertise in fields related to nuclear safety, particularly through its heavy involvement inresearch and development programmes in this area.
A fundamental principle, promoted in IAEA documents, is that operators are responsible for the safety of their facilities, because only they can take the practical actionthat directly influences safety. In French regulations, this principle is set out in the Environment Code (Article L. 593-6): “The operator of a nuclear facility is responsible forcontrolling the risks and drawbacks presented by its facilities”.
However, operators must provide evidence of this to the public authorities responsible for protecting people and property throughout France. This evidence must be provided in the form of binding written documents sent to the ASN, containing theoperators’ own analyses. Operators may also have to provide any further details or
information considered necessary, in an appropriate form, in the context of inspections
carried out by the ASN, assessments by IRSN or meetings with the standing groups ofexperts commissioned by the ASN, or at meetings of local information commissions(CLI126) or the national association of local information commissions (ANCCLI127).
Moreover, in accordance with the Act on nuclear security and transparency adopted
in 2006 (known as the TSN Act – see section 6.2), all operators of basic nuclear installations must produce a report each year stating:– “the nuclear safety and radiological protection measures taken;– nuclear safety and radiological protection incidents and accidents subject to thereporting obligation (…) that have occurred at the installation, as well as themeasures taken to limit their development and mitigate the consequences forhuman health and the environment;– the nature and results of measurements of radioactive and non-radioactive releases
from the installation into the environment;– the nature and quantity of radioactive waste stored at the installation site, and themeasures taken to limit the volume and effects of the waste on health and on theenvironment, especially soil and water”.
126.
127.

Commission locale d’information in French.
Association nationale des comités et commissions locales d’information in French.

Stakeholders and organization of research reactor safety in France

97

This report is made public and a copy is sent to the local information commission
and to the High Committee for Transparency and Information on Nuclear Security(HCTISN128).
The roles of the ASN, the IRSN and the standing groups of experts are briefly
explained in the next section.

6.2. Control of nuclear risks in France
As explained in previous chapters, research reactors can vary greatly in terms ofutilization, technical characteristics and operating procedures. However, all research
reactors are categorized as basic nuclear installations (INB129) and are therefore subject
to the regulatory requirements applicable to all INBs.
The adoption of Act No 2006-686 of 13 June 2006 on nuclear security and transparency (known as the TSN130 Act) has been the most significant change in recent years
to the institutional and legal framework applicable to basic nuclear installations. Specifically, the TSN Act set up, for civil-related facilities and activities, an independentadministrative authority, the French Nuclear Safety Authority (ASN). The Act sets
out the general principles governing nuclear activities (in addition to the principle ofthe operator having prime responsibility, there are other such as the precautionary principle, the preventive action principle, the “polluter pays” principle, etc., which are briefly
explained in the focus section below). More recently, the Act on energy transition forgreen growth (TECV131 Act No 2015-992 of 17 August 2015) strengthened some aspects of the TSN Act, particularly as regards transparency and public information, management of subcontracting at INBs, and permanent shutdown and dismantling of INBs.

The principles of nuclear safety, radiological protectionand environmental protection in France132
Nuclear activities must be carried out in compliance with the fundamental principles set out in law and in international standards. In particular:– in France, the principles set out in the Environmental Charter attached to
the Constitution, and in different codes (Environment Code, Public
Health Code, etc.);
128.
129.
130.
131.
132.

Haut Comité pour la transparence et l’information sur la sécurité nucléaire in French.
Installations nucléaires de base in French.
Now codiﬁed in the French Environment Code.
Transition énergétique pour la croissance verte in French.
According to the ASN’s publication “The principles and stakeholders in nuclear safety regulation,
radiation protection and protection of the environment”.

Elements of nuclear safety – Research reactors

98– at European level, the rules deﬁned by directives establishing a
Community framework for the safety of nuclear facilities and for the
responsible and safe management of spent fuel and radioactive waste;– at international level, the fundamental safety principles established by the
IAEA and implemented under the Convention on Nuclear Safety, which
establishes the international framework for nuclear safety regulation andradiological protection.
There is significant overlap between these different measures. They can besummarised in the form of eight principles, as follows:– Principle of prime responsibility of the operator
This principle was presented in section 6.1.
– “Polluter pays” principle
The “polluter pays” principle is the adaptation of the principle of prime
responsibility of the operator to the terms of the Environment Code,namely that the polluter responsible for environmental damage must bear
the cost of measures to prevent and reduce pollution.
– Prevention principle (or principle of preventive action or rectiﬁcation
at source)
The prevention principle requires the implementation of rules and actions
to anticipate environmental damage, which must take account of the best
available techniques at an economically acceptable cost.
– Participation principle
The participation principle requires public participation in decision-making by
the public authorities; it stems directly from the Aarhus Convention. In the nuclear field, the practical expression of this principle is the organization of national public debates, which are mandatory prior to the construction of a
nuclear power plant, for example, and public inquiries, especially during theexamination of licence applications to construct or dismantle nuclear facilities.
– Precautionary principle
Under the precautionary principle, a lack of certainty in view of current
scientific and technical knowledge should not delay the adoption of environmental protection measures. It is defined in the Environmental Charteras follows: “Where there is the possibility of severe and irreversible damage to the environment, even though this is not a certainty given the current state of scientific knowledge, the public authorities shall ensure, byapplying the precautionary principle in the areas within their remit, thatprocedures are followed to assess the risks and that provisional, proportionate measures are taken to prevent the damage”. As regards the biological effects of small doses of ionizing radiation and low dose rates, theprecautionary principle assumes that the relationship between dose andeffect is linear, with no threshold.

Stakeholders and organization of research reactor safety in France99– Justiﬁcation principle
The Public Health Code states that “a nuclear activity or operation may
be performed only if it is justified by the advantages it provides, especially for health, society, the economy, or science, compared to the risks
it may pose of exposure of persons to ionizing radiation”.
– Optimization principle
The Public Health Code states that “exposure of persons to ionizing radiation resulting from a nuclear activity or operation must be kept to thelowest level that can reasonably be achieved, taking account of technical,
economic and social factors, and, where relevant, the medical objectivesought”. This principle, also known as the ALARA principle, can for
example, in the case of discharge permits, lead to the permitted quantities
of radionuclides in radioactive effluent discharged by nuclear facilities
being reduced, can mean that exposure monitoring at workstations is required to keep exposure to the level strictly necessary, and can mean monitoring is necessary to ensure medical exposure due to diagnostic
procedures remains within pre-established reference levels.
– Dose limitation principle
The Public Health Code states that “the exposure of a person to ionizing
radiation resulting from a nuclear activity may not cause the sum of received
doses to exceed regulatory limits, except when the exposure is for medical orbiomedical research purposes”. There are strict limits on exposure of thegeneral population or workers due to nuclear activities. These limits include
wide safety margins to prevent effects on health. They are also well below
the doses for which probabilistic effects (cancer) begin to be observed.
Exceeding these limits is considered to be unacceptable. In France it can leadto administrative or criminal sanctions. In the case of medical exposure, nostrict dose limit is set since this deliberate exposure is justified by the expected health benefit for the exposed person.
....................................................................................................................................................................................................................

According to Article 1 of the TSN Act, nuclear security encompasses nuclear safety,
radiological protection, prevention of and protection from malicious acts, as well as civil
protection in the event of an accident. The requirements for basic nuclear installations,from construction to permanent shutdown and dismantling, are laid down by the 2007
“INB procedures” decree 133 (and the 2016 amending decree 134 ) and the order of
7 February 2012 setting general rules for basic nuclear installations, known as the“INB” order. This order – which entered into force on 1 July 2013 – has gradually been
supplemented by the ASN’s regulatory decisions on particular generic issues. These
constitute the regulatory basis applicable to all INBs.
133.
134.

Decree N° 2007-1557 of 2 November 2007 on basic nuclear installations and on the control, as
regards nuclear security, of the transport of radioactive substances.
Decree N° 2016-846 of 28 June 2016 on the modiﬁcation, permanent shutdown and dismantlingof basic nuclear installations and on subcontracting.

Elements of nuclear safety – Research reactors

100

Between 1980 and 1992, 40 “fundamental safety rules” (RFS135) were established in
France on different topics and different types of INB. The purpose of these rules was to set
out the conditions be met by a particular type of facility for it to be considered compliant
with French technical regulatory practice, while giving the operator (and the designer) the
option of non-compliance if it could justify that the safety objectives were met by othermeans. Further texts of a similar nature are being produced, known as “ASN Guides136”.
Two fundamental safety rules137 specific to research reactors were established in
the 1980s and 1990s. They were:– the fundamental safety rule SIN N° C-12308/86 (RR1) of 4 August 1986, on
puriﬁcation equipment in research reactor ventilation systems. Because research
reactors are facilities with one or more vessels kept under negative pressure byventilation circuits providing “dynamic” conﬁnement, the rule sets out a numberof recommendations for the implementation of devices to ﬁlter and purify the air:high efﬁciency particulate air (HEPA) ﬁlters to trap the aerosols, and iodine ﬁlters(PAI138) consisting of solid adsorbent materials139. These recommendations
concern the design, implementation, installation and assembly, efﬁciency and useof this equipment, especially as regards in-service inspection. In particular the rulestates that PAIs must be preceded, where relevant, by systems that rapidly reduce
the relative humidity of the gases to be puriﬁed so that the efﬁciency of theseﬁlters is acceptable at ﬁrst use.
– the fundamental safety rule SIN N° C-12670/91 (RR2) of 1 July 1991 onprotection against ﬁre risks at research reactors. ASN Decision N° 2014-DC-0417
of 28 January 2014, supplementing the “INB” order, sets out the requirements forcontrolling ﬁre risks at basic nuclear installations; the safety approach followedby this Decision is explained in section 7.4.1.

Pyramid of official texts applicable in France to basic
nuclear installations
The pyramid of official texts applicable in France to INBs is shown infigure 6.1 below.
– Laws
A law (Act) is a written rule, generally passed by parliament (National
Assembly and Senate) following legislative procedure. A law can be
135.
136.
137.
138.
139.

Règles fondamentales de sûreté in French.
More than thirty ASN Guides were in existence as at mid-2018.
“Législation et règlementation, Sûreté nucléaire en France”, Les Journaux ofﬁciels, May 1999.
Pièges à iode in French.
Such as activated carbon.

Stakeholders and organization of research reactor safety in France

Figure 6.1. Diagram showing the pyramid of ofﬁcial texts applicable to INBs. © Georges Goué/
IRSN.

adopted on the initiative of parliament (proposition de loi) or of the government (projet de loi). Once it has been promulgated by presidential decree, everyone must abide by it. Before it is promulgated, it may be put
through a test of its constitutionality by the Constitutional Council.
– Decrees
A decree is a regulatory act signed either by the French President or by thePrime Minister. Some decrees (décrets en Conseil d’État) can only be enacted after consulting the Conseil d’État. Decrees are often adopted inapplication of a law. They may be supplemented by ministerial orders.
– Orders
An order (arrêté) is an administrative decision which is either general or
specific (to a sector or geographical area) in scope. Orders can be issued
by ministers (ministerial or interministerial orders), prefects (prefectoral
orders) or mayors (municipal orders).
– ASN Decisions
Act No 2006-686 of 13 June 2006 (TSN Act) lists the different categories
of regulatory and individual decisions that the ASN takes, for example:
regulatory decisions of a technical nature for the application of decrees
or orders on nuclear safety and radiological protection,
 commissioning licences for INBs,
 permits and approvals for the transportation of radioactive materials orfor medical facilities and equipment using ionizing radiation.
– ASN Guides
In replacement of the fundamental safety rules, the ASN Guides are
documents for use by professionals affected by nuclear safety and101

Elements of nuclear safety – Research reactors

102

radiological protection regulations (designers, operators, users or transporters of radioactive materials, health professionals). They aim to:
explain a regulation and the rights and obligations of persons
concerned by the regulation;
 explain the objectives of the regulation and where necessary describe
the practices which the ASN considers satisfactory;
 provide practical and useful information on nuclear safety andradiological protection.
...................................................................................................................................................................................................................

The equipment in research reactors may be subject to French regulations on pressure equipment, especially the order of 30 December 2015 on nuclear pressure equipment (known as the “ESPN140” order). This order lays down a number of requirements,
classifying equipment:– according to levels (three levels, N1, N2 and N3, in descending order of theradioactive emissions that could result from their failure);– and categories (ﬁve categories, 0, I, II, III and IV, in ascending order of other risks,particularly those associated with the volume and pressure of the ﬂuids they
contain).
Fixed equipment in research reactors and experimental devices (e.g. pressurized
loops) may be subject to the provisions of this order. This will not be discussed further
in this report141.
As stated earlier, the operator of an INB has prime responsibility for the safety of
the facility and must provide evidence that the measures taken to ensure the facility’ssafety are appropriate (the safety demonstration). This evidence is presented in a set of
documents, which are used by the public authorities to decide whether or not to grant
licences for the operation of facilities. These documents are:– the safety report, which describes the facility and speciﬁes the design of its
systems, structures and components and existing or planned measures to prevent
incidents and accidents and to limit the consequences of any incidents or
accidents that do occur;– the general operating rules (RGE142), an operational document setting out theoperating procedures, which must be consistent with the evidence presented in
the safety report;

140.
141.

142.

Équipements sous pression nucléaires in French.
However, please see the comprehensive paper in the journal Contrôle No. 186 from 2010,
entitled “Les équipements sous pression nucléaires dans les réacteurs de recherche” by F. Koskas,
P. Trémodeux, D. Bourguignon, J. Reuchet and D. Acker, CEA. Most equipment items in research
reactors subject to the “ESPN” order are classiﬁed as N2 or N3.
Règles générales d’exploitation in French.

Stakeholders and organization of research reactor safety in France103– the impact study justifying existing or planned measures to limit the impact of
normal operation of the facility on the public and the environment;– the on-site emergency plan (PUI143), which describes the speciﬁc organization,
resources and actions to be implemented by the operator in the event of an
accident affecting the facility that could cause radioactive substances (orchemicals) to be released into the environment;– the decommissioning plan, which explains the general measures put in place by theoperator with a view to the permanent shutdown and dismantling of the facility.
In addition, the ASN can, under conditions clearly defined by regulatory decision,place specific requirements on the operator related to the safety of the facility, or if
there are risks considered to be serious and possibly imminent, it can even suspend144
the operation of a facility temporarily on a precautionary basis (for example, a decision145 was taken in October 2009 to partially suspend the operation of the plutonium
technology facility (ATPu146) at Cadarache).
The safety documents for INBs produced by the operators are examined by the ASN,
which regularly seeks technical advice in this context from IRSN or, for the most important issues, from the standing groups of experts.

" IRSN
Within the French system, IRSN has the status of an industrial and commercial
public undertaking (EPIC147) and its missions are laid down in Decree No 2002-254
of 22 February 2002, then in Decree No 2016-283 of 10 March 2016. The TECV Act
mentioned above, which was promulgated on 17 August 2015, laid the foundationsof the “dual system” of two independent bodies, the ASN and IRSN, and wrote IRSN’s
missions into the Environment Code.
IRSN is supervised by the five ministries responsible for the environment, industry,
research, defence and health. It is the main expert in nuclear and radiological risks forboth civil and defence facilities and activities. It assesses exposure of humans and theenvironment to ionizing radiation and proposes measures to protect the population in
the event of an accident. It contributes to public policy on nuclear safety and on healthand environmental protection against ionizing radiation, as it did when the TECV Act
was being prepared.
Its nuclear safety expertise is based on scientific and technical knowledge; for thispurpose, IRSN devotes significant resources to:– monitoring and analysing experience feedback from events in France andelsewhere in the world;

143.
144.
145.
146.
147.

Plan d’urgence interne in French.
In “procedures” decree no. 2007-1557 of 2 November 2007.
Decision No. 2009-DC-160 of 14 October 2009.
Atelier de technologie du plutonium in French.
Établissement public à caractère industriel et commercial in French.

Elements of nuclear safety – Research reactors

104– studies and research and development148, including the development ofsimulation software.
Research requiring major resources is carried out in collaboration with other partners, in various contexts (national, European, international), sometimes with the
involvement of universities or the CNRS.
IRSN employs around 1,700 people of whom 1,200 are general and specialist researchers and experts (in mechanics, criticality and neutronics, thermohydraulics, statistics and probability, fire, earth sciences, medicine, biology, agronomy, metrology, etc.)
spread across nine sites.
IRSN also takes part in public debates and seminars organized by local informationcommissions and by ANCCLI ‒ and by the Information Commission (CI) in the case ofdefence-related nuclear facilities.
At the request of the relevant authority (ASN, or DSND for defence-related facilities), IRSN examines the files submitted by the operators and gives the authority its
opinions and recommendations. IRSN’s expertise provides valuable support for decision-making; it finds information corresponding to the best state of technical or scientific knowledge in situations where the decision-maker is confronted with issues forwhich it cannot immediately provide a response.
In the context of the ASN/IRSN “dual system”, the TECV Act placed an obligation on
IRSN to publish all its expert opinions immediately, before ASN had stated its position.
IRSN’s role has a regulatory context but does not simply amount to verifying compliance with regulations. It consists of providing technical clarity as a result of a technical dialogue with the operators. This clarity is based on its wide-ranging and in-depth
technical and scientific knowledge – which comes from experience feedback, studies
and research –, detailed analysis of data, and the ability to synthesise different specialist
contributions. To give an opinion, different components of an overarching problem need
to be taken into account, and sometimes these may at first seem irreconcilable.
Through the diversity of its expertise, IRSN is able to integrate these different components in its opinions.
Technical dialogue with operators is essential, partly to confirm IRSN’s experts’
understanding of the safety and radiological protection issues presented in documents
submitted by the operators, and partly to avoid a drift towards the submission of applications with no technical or operational substance. Technical dialogue is also a way of
sharing safety concerns with operators.

" Standing groups of experts
Where required by some safety or radiological protection issues, the ASN relies on
the support of advisory committees, set up in 1972 and renewed a number of times,
148.

The publication “Current State of Research on Pressurized Water Reactor Safety”, Science andTechnology Series, IRSN/EDP Sciences, 2017, presents some of the research and development inwhich IRSN is involved ‒ and has been for more than 40 years in some cases.

Stakeholders and organization of research reactor safety in France

105

named standing groups of experts. There are eight standing groups149 of experts (GPEs),
each with its own area of expertise (nuclear reactors [GPR], transport [GPT], laboratories
and plants [GPU], radiological protection of workers and the public [GPRAD], radiological protection of health professionals, patients and the public for medical applicationsof ionizing radiation (including industrial applications and research) [GPMED], waste[GPD], nuclear pressure equipment [GPESPN] and – a new one in 2018 - dismantling[GPDEM]).
The standing group members are appointed on the basis of their individual expertise.
They come from universities and expert bodies, particularly IRSN, designers (AREVA-NP
then Framatome, etc.), operators (EDF, CEA, AREVA-NC then Orano, etc.) and researchbodies (CEA, etc.) in the relevant areas. Since June 2014, the broad representation inthese standing groups has been enhanced by the presence of representatives from civilsociety (members of CLIs, representatives of NGOs, etc.). Each standing group of experts can also seek assistance from anyone (in France or elsewhere) with recognised
expertise in specific areas.
For each of the issues dealt with, the standing group of experts’ discussions are usually based on assessments conducted in advance by IRSN or by the Nuclear Pressure
Equipment Department (DEP150) in the case of the GPESPN, and presented by them.
They formally record the conclusions of their examinations in opinions and recommendations sent to the ASN office that referred the matter to them. The standing groups’
opinions to the ASN are made public.
The standing groups of experts to which issues related to research reactors are referred are:– most often, the standing groups of experts for nuclear reactors (GPR),– the standing groups of experts for nuclear pressure equipment (GPESPN),– the standing groups of experts for laboratories and plants (GPU) concerning theoverall management of safety and radiological protection within CEA or thepermanent shutdown and dismantling of reactors (in association with the GPR).

6.3. Key stages in the life of a research reactor
From an administrative point of view, the key stages in the life of a research reactor
are similar to those for the power plants in the French fleet. Schematically, these key
stages correspond to the following types of licence or prescription (“procedures”
decree):– the initial construction licence issued by decree on the basis of a set of
documents including, among other things, an impact study, a preliminary version
149.

150.

Groupe permanent d’experts in French of réacteurs (GPR), transport (GPT), usines (GPU),
radioprotection des travailleurs et du public (GPRAD), radioprotection dans les applications
médicales (GPMED), déchets (GPD, équipements sous pression nucléaire (GPESPN) anddémantèlement (GPDEM).
Direction des équipements sous pression in French.

Elements of nuclear safety – Research reactors

106of the safety report, and a risk control report presented in an appropriate form for
local consultations and the public inquiry;– the commissioning licence issued by the ASN on the basis, in particular, of an
updated version of the safety report, a summary report of the facility startup
tests, etc.;– the decommissioning “prescription” issued by decree, following a public inquiry,on the basis of a special set of documents including the updated decommissioning plan, the impact study and the updated safety report and generalsurveillance and maintenance rules (RGSE151).
Because substantial modifications may be made to the design or utilization of a research reactor during its operating life (e.g. new experimental programmes), specific licences may be necessary, possibly including amendments by decree to the original
construction licence decree.
These substantial modifications may cause the research reactor to spend periods on“standby”. Under French regulations, a new licence issued by decree is required if theoperation of an INB is interrupted for more than two years152. Special requirements
may be imposed for periods on standby, such as the requirement for a minimum number of personnel to be present to carry out appropriate surveillance, and periodic tests
and inspections at suitable frequencies.
For new INBs, the submission of a “safety options report” has become common practice. In the case of research reactors, it can apply not only to new reactor projects (e.g.
the Jules Horowitz reactor) but also to large-scale modifications to reactors in service(such as the renewal of the CABRI reactor with installation of the pressurized water loop).
Finally, the obligation to carry out periodic safety reviews of their facilities (in practice every 10 years), stipulated in the TSN Act, applies to research reactor operators.
From the point of view of documentation, there are two major milestones in a periodic
safety review, involving not only the operator, but also the ASN and experts (IRSN, advisory committees):– the submission by the operator of a safety review preparation ﬁle specifying theperimeter and scale of the compliance review and safety reassessment that it
plans to carry out (see section 9.2);– once the examinations and the safety reassessment studies are complete, thesubmission by the operator of a report presenting its conclusions including, where
necessary, the changes it plans to make in order to improve safety at the facility.
151.
152.

Règles générales de surveillance et d’entretien in French.
However, as a result of the adoption of the TECV Act No 2015-992 of 17 August 2015, Article
L 593-24 of the Environment Code states that “if a basic nuclear installation ceases to operate fora continuous period of more than two years, it is deemed to have been permanently shut down,
but the minister responsible for nuclear safety may, at the operator’s request, extend this twoyear period by a maximum of three years, by means of an order explaining the grounds for thisextension, having first sought the ASN’s opinion. At the end of the period stipulated in the firstparagraph of this Article, the facility operator is no longer permitted to operate the facility…”.

Stakeholders and organization of research reactor safety in France

107

6.4. Internal licensing scheme
Decree No 2007-1557 of 2 November 2007 (the “procedures” decree) introduced
the possibility for INB operators to set up an internal licensing scheme enabling themto dispense with reporting to the ASN some minor modifications to their facilities ortheir general operating rules. The operator must make an application to do this, showingthat it has an internal control system and presenting sufficient guarantees of quality,
independence and transparency, and must obtain the ASN’s approval for the scheme,
specifying:– the type of modiﬁcations or operations to be handled in this way;
– the process used to approve the operations, in particular with automatic
notiﬁcation, prior to any operation, of a body that is independent of the persons
in charge of the operation;– the identities of the persons authorised to issue internal licences;– the procedures for periodically reporting to the ASN on the operations planned or
performed.
The requirements applicable to a scheme of this kind were subsequently clarified by
the ASN in 2008 in its Decision No. 2008-DC-0106 of 11 July 2008.
For example, the internal licensing scheme proposed by the CEA was approved in2010. The corresponding decision153 listed the INBs concerned, the type of modifications that could not be licensed internally, and the criteria to be met for a modification
to be eligible for internal licensing. Most of the CEA’s research reactors are on the list of
facilities for which the internal licensing scheme approved in 2010 can be used.
As part of this, the CEA sends the ASN, every six months, a provisional programmeof operations likely to be internally licensed in the coming year, giving its justification
for the approval of these operations by the internal licensing scheme. These programmes are examined by IRSN, which can express reservations to the ASN regarding
the rationale for using the internal licensing scheme or regarding the measures plannedby the operator in question.
More recently, Decree n°2016-846 of 28 June 2016, which amends several aspectsof the “procedures” decree (modification, permanent shutdown and dismantling ofINBs, use of subcontracting), introduced two regimes for all INB operators:– a “reporting regime” for minor modiﬁcations (obviously ones that do not have an
impact on the safety report or the impact study for the facility), a list of which is
given in an ASN decision, taking account of the type of facility and the scale of
the risks and drawbacks it presents, the operator’s technical capabilities and theinternal control measures it has implemented in preparation for these
modiﬁcations;– a “licensing regime” for other modiﬁcations.
153.

ASN Decision No. 2010-DC-0178 of 16 March 2010.

Chapter 7
Safety principles
for French research reactors

7.1. General safety principles, concepts, approaches
and objectives
This chapter presents the general safety principles, concepts, approaches and objectives that have guided the design and operation of French research reactors. It also highlights changes that have been made over time, which have generally brought practices
into line with those adopted for nuclear power reactors, including those of the European
Pressurised Water Reactor (EPR). Several features specific to research reactors will becovered, including the most important, which involves taking into account core melt
accidents in the design of some French research reactors in the 1960s.
The nuclear safety and radiological protection measures adopted for the design andoperation of nuclear power or research reactors must limit the number of incidents, thepotential occurrence of accidents and meet the fundamental safety objective as statedin IAEA document SF-1, which is to “protect people and the environment from harmful
effects of ionizing radiation”. This objective is of course entrenched in French law, andspecifically in the Public Health Code (Article L. 1333-1) and in the Environmental Code(Article L. 110-1).
Design principles focus on various aspects, including the intrinsic characteristics ofthe reactor (e.g. core neutronics), the general architecture of systems, material redundancy and diversification, protection against internal and external hazards, radiologicalprotection systems, the choice of coolants used and the effluent management andElements of nuclear safety – Research reactors

110

treatment measures, the choice of materials, etc. Beneficial feedback can be capitalised
on by adopting proven practices for the design and manufacture of equipment. It is also
important to adopt the best available techniques154 such as can be applied to the facility in question.
Document SF-1 and, in France, the abovementioned texts, the French Act on nuclear
security and transparency (TSN) and the Order setting general rules regarding basic nuclear installations, also state a number of major principles, such as the primary responsibility of the operator to prevent accidents and limit their consequences should theyoccur, introducing the “defence in depth” principle.
The abovementioned fundamental objective is generally broken down into generalsafety objectives that are expressed in a qualitative manner for the various events studied for a facility, based on their estimated frequency of occurrence. For the Jules Horowitz Reactor project, these objectives were set basically in keeping with those adopted for
the EPR. Therefore, for the most frequently foreseeable incidents, their consequencesmust not require any counter measures for the public and the environment, and also
remain within the authorised limits for gaseous and liquid discharges. For the most serious accidents studied involving core meltdown, their consequences in terms of the extent and duration must only require very limited counter measures to protect the public
and the environment (no permanent relocation, no emergency evacuation beyond thefacility’s immediate vicinity, limited sheltering, etc.). In other words155, the following
must be avoided:– early radioactive releases that would require off-site emergency measures butwith insufﬁcient time to implement them;– large radioactive releases that would require protective measures that could not
be (sufﬁciently) limited in area or time.
Some aspects of theses general safety objectives are developed in greater detail in
section 7.1.4.
Like power reactors, research reactors present risks associated with the radioactive
materials that they use. Ionising radiation is released from fission reactions and by theradioactive products created by these fission reactions, or by activation. The primarychannel of exposure is direct radiation from the nuclear reactor or the associated systems as radioactive sources. Several measures are implemented to provide protection
against exposure (staying away from the source, use of absorbent materials such as
lead, concrete or water). Another potential channel of exposure is contamination fromthe release of radioactive substances into the atmosphere. Measures taken to ensurethat these substances are contained in normal or accident operating conditions are
therefore fundamental.
154.

155.

This concept is explained in Appendix I of the Order dated 26 April 2011 pertaining to theimplementation of the best available techniques, as stipulated in Article R. 512-8 of the French
Environmental Code.
These objectives are formalised in Council Directive 2014/87/EURATOM of 8 July 2014
amending Directive 2009/71/Euratom establishing a Community framework for the nuclear
safety of nuclear installations.

Safety principles for French research reactors

111

Research reactor safety relies on various principles, concepts and procedures thatare not necessarily specific to these types of reactors:– installation of several physical conﬁnement barriers between radioactive substances and workers, the public and the environment in order to contain thesesubstances. For reactor core radioactive substances, three “barriers” are generally
put in place (speciﬁc measures for research reactors will be identiﬁed later):

fuel cladding,the boundary of the core cooling system or reactor pool,the building housing the reactor core,– implementation of measures to ensure the three fundamental safety functions156:
control over nuclear chain reactions,removal of heat produced from radioactive substances and nuclear reactions,

conﬁnement of radioactive substances.

– the adoption of a redundancy or technological diversiﬁcation principle for themost important safety systems (which perform the two primary fundamental
safety functions), in order to achieve sufﬁcient reliability for these systems. Thisis mainly the case for reactor protection and engineered safeguard systems,
which are involved in defence in depth;– the adoption of an analysis-based deterministic safety approach157 incorporating
suitable conservative measures, and a number of postulated events158 (related to
failures speciﬁc to the facility [including human errors], or internal or external
hazards – see section 7.1.2), even though probabilistic studies can provide useful
insight (see below). However, applying the deterministic approach to research
reactors requires case-by-case analysis (particularly to establish the list of
postulated events) due to the diverse range of designs and risks which thesereactors present.
The cladding of fuel elements (plates, rods), often made of aluminium alloy, must at
the very least maintain its leaktightness in situations corresponding to postulated
events with the highest estimated frequency. This means that heat transfer between
the fuel and coolant must be controlled (or more specifically, the ratio between theheat released by the fuel and the coolant flow), failing which, the temperature of cladding would rise irremediably, causing distortion, failure, or even melting (aluminium
melts at 660°C).
156.
157.

158.

The ﬁrst two of these three safety functions contribute to maintaining the conﬁnement barriers.
Approach which, over the course of time, has indirectly taken into account probabilistic
considerations, particularly by classifying operating conditions into categories based on theestimated frequency (or probability) of initiating events. The design rules depend on these(addition or not of a single failure, way of taking uncertainties into account, criteria to becomplied with for equipment, etc.).
Postulated initiating events in IAEA documents, événements déclencheurs (initiating events) in
French regulations.

Elements of nuclear safety – Research reactors

112

Furthermore, potentially major heat increases or surges could occur in the reactor
core. If the chain reaction is not controlled, the energy released could cause fuel meltdown.
In a nuclear reactor, the reactivity is controlled using two types of elements:– the intrinsic neutronic characteristics at the core, related to the type of fuel andcoolant, and the core geometry (which determines neutron leakage): delayed
neutron fraction (β and expressed in pcm), neutron feedback linked to the
Doppler Effect in the fuel and the effect of dilation or contraction of structures
and the coolant, etc. Several values for these characteristics are given as an
example in section 7.2 for different types of research and power reactors;– added components, mainly in the form of rods or plates made of neutron
absorbing materials that can be inserted into or removed from the core manuallyor automatically if thresholds associated with speciﬁc reactor operating
parameters are exceeded.
The design studies and choices must be such that these components ensure optimum behaviour of the reactor in the event of disturbances such as reactivity insertion
accidents. The aim is to avoid a prompt criticality as much as possible159, and maintain, in shutdown situations, a significant margin (negative or deficit reactivity) withrespect to a critical state, with absorbers inserted in the core (apart from safety absorbers maintained in withdrawn position160). Furthermore, the number of absorbers
and each of their reactivity contributions must ensure that in the event of a reactor
shutdown, the shutdown must be able to occur even if the most effective absorberdoes not drop.

7.1.1.

The defence in depth principle applied to research
reactors

A general outline of the defence in depth principle was presented in chapter 3.
However, specific features of the defence in depth principle require further explanation for research reactors:– the ﬁrst level of defence in depth seeks to prevent operating anomalies andstructure, system and component (SSC) failures. This requires high quality in thedesign and manufacture of these SSC’s and in the operation of the reactor(including preventive maintenance). Maintaining quality can require particularattention for research reactors161, for several reasons:
159.
160.
161.

Prompt criticality occurs if the core reactivity, with counter reactions taken into account,becomes higher than the delayed neutron fraction.
For example, to provide negative reactivity in the event of a core loading error.
The information below can also apply to other nuclear facilities, such as power reactors, if plans
are made to extend their service life. The level of attention to be focused on these issues must ofcourse be adjusted according to a graded approach, depending on the risks presented by thefacility in question.

Safety principles for French research reactors

113they may have a long service life which may be requested to be extended
beyond what was originally planned at the time of design,because of this, the risks associated with aged equipment and obsolescencecan become a problem,the necessary recruitment of new operating personnel entails risks ofknowledge not being properly passed on. This can lead to operating errors
and even signiﬁcant events162,

research reactors can experience phases of non-use with reduced monitoring and maintenance operations,– for the second and third levels of defence in depth, the low pressure of reactor
coolant in most research reactors means that safety injection systems do notneed to be installed163. The Jules Horowitz Reactor is the only research reactor
with this type of system due to the power density in the core and the coolant
pressure (a dozen bars at the core inlet). For many research reactors, theirintrinsic characteristics allow them to be cooled via natural convection;– for the fourth level of defence in depth, for many research reactors, a design-basis
accident with fuel melt was adopted for the design or veriﬁcation of a suitable
design164 of the reactor pool, the reactor building superstructures and theventilation and ﬁltration systems. This subject is covered in further depth later inthis chapter.
Some research reactors have also been built in areas that have gradually become
more urbanised. This increases the attention that needs to be focused on reducing
the consequences of accident situations and ensuring that emergency plans are suitable.
This can be a prerequisite for their continued operation.
In France, various design and construction codes can be used or serve as a reference(for those formally addressing pressurised water reactors) for a project to build a
research reactor and its associated systems, or for modifications to be made to an
existing research reactor (new experimental system, modifications made under a safety
review, etc.). In this regard, the RCC-MRx design code, developed by the CEA andmanufacturers, has been applied to the mechanical equipment of the Jules Horowitz
Reactor (see focus below). The RCC-E (design and construction rules for electricaland I&C components of PWR nuclear islands), and RCC-CW (design and construction
rules for civil works in PWR nuclear islands) can serve as references for research
reactors.

162.

163.
164.

This concern in particular involved the PHENIX reactor when it returned to operation in the early
2000s after a long period of being shutdown for renovation and safety improvement work. Dueto the unique nature of some research reactors, maintaining knowledge and skills on site isequally essential for aspects related to design, construction and commissioning tests.
Even though research reactors have reactor makeup water systems or water capacity
communication systems.
Due to the potential radiological impacts of such an accident.

Elements of nuclear safety – Research reactors

114

Codified design and construction rules for mechanical components, particularly in research reactors: the RCC-MRx165
The RCC-MRx “code” results from the merger of two documents in 2009:– the RCC-MR, developed in 1985 for sodium-cooled fast neutron reactors(reactors operating at high temperatures of up to 500°C under normal
operation);– the RCC-MX, developed in 1998 by the CEA, AREVA-TA and
AREVA-NP for the speciﬁc needs of the Jules Horowitz Reactor project(reactor and its associated experimental auxiliary systems). It can also
apply to the design and construction of components or systems forresearch reactors in operation.
The RCC-MRx extends the potential scope of application to nuclear fusion
reactors (e.g. ITER project). It provides rules for mechanical components involved
in areas subject to significant creep (fast neutron reactors) or significant irradiation(fast neutron reactors, research reactors and their experimental devices). It provides the mechanical characteristics for an extensive range of materials (steel,
800 alloys, aluminium and zirconium alloys that meet the neutron transparency
needs for research reactors), design rules for thin shells and box structures, andnew welding processes (electron beam, laser, diffusion, etc.).
The 2015 version of the RCC-MRx reflects feedback from the use of previous
editions, particularly in current projects, such as the Jules Horowitz Reactor. This
includes feedback on inspection and welding procedures for aluminium processes.
The edition was developed and updated with special attention paid to consistency between the RCC-MRx and other reference documents that interact withthe code, including RCC-M, official French legislation and European and international standards.
Some of the subjects covered by the RCC-MRx are given below.
1.

INTRODUCTION Scope of the code
 French ESP/ESPN regulations
 …
2. MATERIALS – GRADES, PRODUCTS, PROCUREMENT Material selection
 Product procurement conditions
165.

According to the AFCEN website. This section makes reference to the 2015 version of the RCCMRx, which was the most recent edition at the time writing.

Safety principles for French research reactors

3.

4.
5.

6.

7.

DESIGN – ANALYSIS General design rules
 Design by analysis
 Design rules for shells-vessels, supports, pumps, valves, piping,bellows, box structures, heat exchangers
PROPERTIES OF MATERIALS (APPENDIX A3)
AND WELDED JOINTS (APPENDIX A9)
EXAMINATION METHODS Mechanical, physical and chemical tests
 Ultrasonic examination
 Radiographic examination
 Liquid penetrant examination
 Leak detection methods
WELDING Acceptance of ﬁller materials
 Qualiﬁcation of ﬁller materials
 Welding procedure qualiﬁcation
 Qualiﬁcation of welders and operators
 Technical qualiﬁcation of production workshops
 Production welds
 Weld deposited hardfacing on steel
 Mechanical tests
 Special provisions of aluminium and zirconium alloy welding
 …
FABRICATION
 Marking procedure Cutting – repair without welding Forming and dimensional tolerances Surface treatment
 Cleanliness Brazed and bolted mechanical joints
 Heat treatments …

...................................................................................................................................................................................................................

115

116

Elements of nuclear safety – Research reactors

7.1.2. Events selected for the design and safety demonstrationof research reactors
The design of a research reactor and its related safety demonstration is based on theidentification of all events (internal failures, internal and external hazards) which could
affect the facility. However, depending on the event in question, the estimated frequency of the event is more or less high. For example, complete failure of a pipe is considered less likely than a moderate leak from the pipe.
For the oldest research reactors, a small number of events related to internal failures
specific to equipment or operator errors were selected. These have an envelope nature
and are broadly broken down into three major categories – normal events, incidents andaccidents.
For the most recent research reactors or for safety reviews of the oldest research
reactors, in line with practices applied for power reactors, a number of envelope “operating conditions” (up to several dozen) are adopted and classified into four categories
based on the estimated frequency of the “family166” of initiating events they cover.
Table 7.1 , at the end of this section shows the different categories of operating conditions with some of the operating conditions of a neutron beam reactor given as examples.
Different “operating conditions” are studied to determine various thermomechanical loads on the components of the facility, called design basis situations, which are also
divided into categories. Component design involves checking or ensuring that the design
choices made comply with design and construction code criteria (e.g. RCC-MRx)
selected based on the design basis situation studied. The criteria selected also dependon other considerations such as the component’s importance for safety (its safetyclassification) and its role (whether active or passive) in the situation in question.
“Service limits” for the core fuel of a research reactor are generally associated withthe various operating condition categories. Particular attention must be paid to ensuringthat 1st and 2nd category operating conditions (normal operating conditions and frequent transient conditions) do not cause cladding leakage or fuel melt.
The approach involving operating condition categories was not really put into practice for research reactors until the 2000s. The first case where it was actually applied
was with the CABRI reactor, involving the installation of a pressurised water loop anda complete safety review of the reactor. The same approach was then used in preparing
the construction licence application for the Jules Horowitz Reactor.
One of the specific features of research reactors concerns the establishment of firstcategory, or normal operating conditions. Besides the stable operation of the reactor
and normal startup and shutdown transients for the reactor, all the normal transientsassociated with the planned irradiation experiments should be taken into account. Thisis because during the basic design phase for a research reactor, the designer or operator
166.

Events linked to the neutron reactivity of the core, events linked to reactor cooling, etc. Table 3.3
in the ﬁrst section shows events grouped into families.

Safety principles for French research reactors

117

does not always have sufficiently detailed information on the experiment programmethat will be carried out. The chosen approach therefore involves defining a sufficiently
broad envelope of normal transients for the potential experiments, in terms of changes
over time, for the reactor, fluid temperatures in the reactor’s various systems, pressurein these systems, fluid flows, neutron flux in the core, etc.
Furthermore, to establish the list of incidents and accidents that can occur in a research reactor, or second, third or fourth category operating conditions, the potential
failures or errors that could occur during experiments and impact the reactor itself must
be taken into account. This can raise some problems if the various types of experimental
systems for the reactor have not yet been fully defined.
Various technical exchanges took place in the 2000s between the CEA, ASN and
IRSN concerning interactions between a research reactor and its associated experimental systems when the CEA was developing its own design guidelines for experimental
systems. For ASN, creating these guidelines was a condition for establishing an internal
authorisation system167 at the CEA. The aim of the guidelines was to formalise several
major principles and an analysis approach to be used specifically for designing experimental systems based on various information. This included potential risks posed by
the system, the number and robustness of “barriers” separating the test area within
the system and the reactor core168, and gripping and hold-down mechanisms169 forthe system.
In the guidelines, as established in January 2007, the recommended analysis approach was based on a “lines of defence” concept170. The guidelines also define therules allowing the CEA to internally authorise the installation of a new experimental
system in one of its research reactors.
The guidelines generally improved and facilitated analysis and safety inspections forexperimental systems. Although the ASN did not issue a formal opinion on the guidelines, even though it was involved in work meetings and discussions on it, it recognised
them by authorising the CEA to implement and organise its internal authorisation
system.
The foregoing only concerns the operating safety of the reactor (with its experimental systems). It is important to remember that the reactor environment can be a sourceof hazards that can affect facilities. Two types of hazards must be considered – internal
hazards, which originate within the facilities, such as a fire, and external hazards, such as
an earthquake or airplane crash. All the potential sources of hazards must be identified
and covered for the design of the reactor and associated safety demonstration. External
167.
168.
169.

170.

Concept already covered in section 3.6 in the ﬁrst part of this document.
With one of the constraints being to obtain a sufﬁciently transparent neutron separation
between the reactor core and the test area.
For example, this concerns experimental systems that are likely to increase core reactivity in theevent of unplanned vertical movement or ejection. This type of event could be the naturalconsequence of energetic phenomena which could occur – or even intentionally be initiated –within a system, depending on the objectives of an experiment being conducted with thesystem.
See footnote 168 below.

Elements of nuclear safety – Research reactors

118

hazards also determine design basis situations for components, often called load cases,
where the general objective for hazards is to ensure that they do not prevent fundamental safety functions from being performed, despite their direct and indirect effects.
Therefore, like the pressurised water reactors in the nuclear power reactor fleet, the“load case” approach has been supplemented (for safety reviews and new research reactor projects) by the implementation of an “event-level earthquake” approach, whichtakes into account the fact that an earthquake can be the cause of other internal hazards due to the failure of components not designed for earthquakes. It should be notedthat in principle, this type of approach can be applied to other hazards besides earthquakes. The approach is used to:– identity components not speciﬁcally designed for earthquakes;– study the impacts should they fail in the event of an earthquake in order todetermine whether they can jeopardise the functional requirements of components designed for earthquakes and that perform fundamental safety functions;– if this is the case, decide on any measures to be taken: reinforce components notdesigned for earthquakes, protect major components that could be affected.
It is assumed that an earthquake will cause the loss of off-site power supplies171(loss of off-site power).
Just as for power reactors from the nuclear power reactor fleet, an additional category of operating conditions corresponding to multiple failures or accumulated events(which can be highly unlikely) is now taken into account for the design and safety
demonstration of research reactors. An example of this is a station blackout172, or aseismic margin earthquake173 while a heavy load is being lifted in the reactor building,with the requirement that the load not be dropped. For this, the designer of the Jules
Horowitz Reactor uses the expression risk limitation conditions (RLC), which include
controlled severe accidents (CSA) under the 4th level of defence in depth.
Finally, just as for reactors in the nuclear power reactor fleet, particular attention
must be paid to events excluded from the list of operating conditions. These events
are not covered by specific measures to limit their consequences (as they may beunachievable). Their exclusion must therefore be justified by proving that their occurrence is physically impossible or highly unlikely with a high level of certainty. In the latter case, a case-by-case analysis should be performed, as a generic probability thresholddoes not appear to be relevant 174. Preventing “excluded” events requires stronger
design, construction and in-service inspection measures compared to those adopted
to prevent events whose occurrence has not been excluded.

171.
172.
173.
174.

LOOP: Loss Of Off-site Power.
Combination of loss of off-site power and main emergency diesel generators (SBO: station
blackout).
See section 7.4.2.
See the “technical directives for the design and construction of next-generation pressurised water
reactors”, established by the GPR with German experts in October 2000 and used for the EPR
reactor project.

Safety principles for French research reactors

119

The abovementioned approach is gradually being applied to old research reactors
during their safety reviews. Besides the case of the CABRI reactor mentioned above, thisincludes the ORPHEE reactor at Saclay, and the RHF.
Some of the events studied for research reactors are therefore similar to thoseadopted for reactors from the nuclear power reactor fleet, such as a breach or evencomplete failure of a reactor coolant main pipe, the inadvertent removal of an absorbercomponent from the core area, or partial or complete loss of electrical power. Someother events are specific to research reactors given the experiments that are conductedin them or planned.
Safety analyses and assessments carried out by IRSN as part of work to upgrade the
CABRI reactor, which included the installation of a pressurised water loop to replace thesodium loop, led to the adoption of rules and practices used for pressurised water reactors ‒ the loop, related systems, its containment tank constituting the coolant circuit,related systems and the containment building of a PWR. The following are examples ofsome of these aspects:– while the operating conditions associated with the reactor itself were deﬁned bydrawing heavily on events adopted for pool-type research reactors, the operating
conditions associated with the loop were naturally drawn from the operating
conditions adopted for pressurised water reactors;– the water loop containment tank was designed to withstand a “design pressure”
equivalent to the pressure attained in the event of break of the loop (equivalent
to the primary coolant main pipe in a PWR), corresponding to the loss of coolant
accident (LOCA) studied for this type of reactor175. The recommendations formetal containment vessels in the ASME design and construction code, which is
widely used across the world for light water reactors, were used as a point ofreference in this area;– the risk of complete failure of the part of the loop in the reactor (“in-reactor cell”)
which could have severe consequences on the driver core (sudden depressurisation of the loop water which could compact assemblies in the driver core andprevent absorber rods from dropping) should be made sufﬁciently unlikely. The
safety valves on the loop’s coolant system obviously help prevent such an event.
However, they needed to comply with regulations for safety components (valves)for pressure devices;– the pressurised water loop complies with requirements contained in theregulations for pressurised devices (“ESPN” Order).
These cases of combined use of the rules and practices used for research reactors
and pressurised water reactors did not create any problems, which suggests good consistency and compatibility between the approaches.
175.

This involves a complete double-ended guillotine break of the loop inside the tank containmentof the loop (ﬁgure 5.17) (i.e. 2A, where A refers to the cross-sectional ﬂow area of the coolant in
the system), combined with a compressed air pipe break, which could be caused by the ﬁrst
break.

Elements of nuclear safety – Research reactors

120

As stated above, in some cases, probabilistic safety assessments can provide useful
insight along with the deterministic approach for new projects, major modifications orsafety reviews of research reactors176. For example, targeted probabilistic assessments
can help guide design decisions. A probabilistic assessment of potential residual heatremoval failures can be used to choose design options for the general architecture ofcooling systems, redundancy and equipment diversification. Probabilistic safetyassessments can also be used to confirm or modify the safety classification ofcomponents. Furthermore, if probabilistic safety assessment models are not available,
a simplified “lines of defence” approach177 can also provide useful insight, as was
the case in the early 2000s with the safety review of the high-flux reactor in
Grenoble.

7.1.3.

Reference accidents

As stated earlier, when the first research reactors were being designed around fifty
years ago, potential incidents and accidents were taken into account. Incidents and accidents began being studied, especially what are referred to in France as “reference accidents”. These accidents were considered as worst-case scenarios and used to assess theacceptable nature of technical and organisational provisions adopted to ensure thesafety of the facility in question.
These reference accidents were defined taking into account the specific features ofreactors and generally considering the failure of several systems or human errors, which
would or could potentially damage fuel elements or the reactor core.
For water-cooled research reactors that use uranium- and aluminium-based fuel(with aluminium cladding), the BORAX-type accident, named after the American facility
where tests for this type of accident were conducted, was adopted in France. This typeof accident is representative of the risks involved with a sudden insertion of high reactivity into the core, i.e. partial or complete core meltdown potentially followed by asteam explosion in the pool.
Reactivity insertion causes a runaway chain reaction that can be limited by the effects it produces as increased fuel and water temperatures have a negative effect onreactivity (neutron feedback). However, if the reactivity insertion is too quick or substantial, the neutron feedback is not enough to prevent damage to the fuel. In the caseof the BORAX-type accident, which concerns reactors that use uranium- and aluminium-based fuel, fuel and cladding quickly reach their melting temperature(660°C178). The fuel can then disperse in the water, which remains relatively cool given

176.

177.

178.

See section 3.4.3. In 2010, IRSN conducted a feasibility study for a Level 1 PSA for the Jules
Horowitz Reactor. See the presentation made at the PSAM 2010 conference: “10th International
Probabilistic Safety Assessment, Feasibility study to develop a PSA for the Jules Horowitz research
reactor”, Laborde A., Georgescu G., Cochemé F., Lanore J.-M.
This approach was presented by M. Lavérie (head of the SCSIN from 1986 to 1993) at aconference held in 1982 in Lyon on liquid metal cooled fast neutron reactors (see Proceedings of
the LMFBR Safety Topical Meeting, Lyon (1982), p.I-335.
This value corresponds to the melting temperature of aluminium.

Safety principles for French research reactors

121

the kinetics of the accident, and cause a steam explosion due to the sudden transfer ofenergy from the melted substances to the water.
Due to the destructive impacts of such an accident, the initial focus is to prevent the
failures that could cause it. However, the accident could still potentially occur. As its
kinetics are too rapid for an emergency shutdown to be sufficiently effective, measures
are taken to limit its consequences. These measures are mainly based on the ability ofthe pool to resist a potential steam explosion and maintain the melted core under water(as the water provides cooling and a biological shield), and the ability of the reactor
building to withstand the accident and contain the radioactive substances released in
the building. Outside France, this type of accident has not been fully taken into account(fuel-water interaction) for the design of pool-type research reactors with a uranium andaluminium alloy-based fuel, except for the BR2 reactor at the Mol centre in Belgium.
For the OSIRIS, ORPHEE and RHF, an “in-air” melt accident involving a fuel element
being handled in the reactor (caused by failures during handling) was also adopted.
Unlike an underwater core melt accident such as the BORAX-type accident, an“in-air” melt accident causes more radionuclides to be released in the reactor building
as there is no water to trap the fission products. The possibility of “in-air” core meltdown began being taken into account when the RHF was being designed.
Chapter 8 will cover reference accidents adopted for French research reactors andthe BORAX-type accident in particular.

7.1.4.

Application of general safety objectives

The general safety objectives were expressed qualitatively in section 7.1. However,just as with nuclear power reactors, the designers and operators of research reactors canadopt general safety objectives expressed quantitatively in terms of “acceptable” radiological consequences for humans and the environment, in the form of “reference
values” for doses, different categories of operating conditions and the conditions of
the complementary domain (BDBA or DEC). Although this is useful for structuring basic
designs and assessing the choices made at this stage, in line with the Farmer diagram(figure 7.1), these “reference values” can under no circumstances be considered as
acceptability criteria, as the radiological consequences must always be limited as far
as reasonably possible while taking into account economic and social factors (optimisation principle).
Safety is above all assessed by applying the defence in depth principle and not justcomparing the radiological consequences of pre-established values. In particular, calculating the individual radiological consequences would not reflect their severity, which
depends on the number of people affected (which can be high for research reactors
located in highly urbanised areas) and the degree and duration of contamination resulting from an accident.
In addition, designers and operators can apply the general safety objectives as“relay” criteria or “decoupling” criteria used to study operating conditions anddetermine whether measures to limit their consequences are sufficient (percentage
of fuel element cladding failures, percentage of molten fuel, etc.).

122

Elements of nuclear safety – Research reactors

Figure 7.1. Farmer diagram showing the relationship between probability and consequences.

7.1.5. The graded approach in France
The Order of 7 February 2012 establishes the general rules for the design, construction, operation, permanent shutdown, dismantling, maintenance and monitoring of basic nuclear facilities. It states that “Their application is based on an approach that is
proportional to the extent of the risks or drawbacks inherent to the installation”. The Order particularly underscores the “proportional approach” for the number and effectiveness of confinement barriers (especially for the design of research reactors, as thenumber of barriers can vary from one reactor to the next), the qualification of the facility’s major components, the frequency of emergency exercises or the monitoring of
external service providers.
The use of a deterministic approach that defines and studies operating conditions
from internal initiating events, internal hazards (linked to the reactor itself) and external
hazards (linked to the reactor site) for the design, safety demonstration or safety reviews of research reactors automatically leads to safety measures that are adapted
to the research reactor in question and its site, and proportional to their risks.
It should also be noted that the safety classification of equipment within the same
nuclear facility means that a number of their requirements are proportioned to theirimportance to safety (safety coefficients for their design, types of welding authorised
by design and construction codes, scope and nature of completion inspections, inservice inspections, etc.).

7.2.

Speciﬁc safety features of research reactors

7.2.1.

Power densities, fuel and core neutron characteristics

Despite having much lower overall power, the power densities generated by research reactors are often higher than for power reactors, given the size of their core,Safety principles for French research reactors

123

Table 7.1. Operating conditions: categories and examples for a pool-type reactor.
Categories ofoperatingconditions

CATEGORY 1
Normal operating
conditions

Order of magnitude for
Examples of operating conditions for a
the annual frequency
pool-type reactor, with neutron channels
per reactor (and upper threshold(indicated by *), using heavy water
expressed as a probability)(indicated by **) – Excluding events to betaken into account for fuel transfer casks(loss of cooling, etc.)

CATEGORY 2
Minor yet frequent
incidents

Number of occurrences deﬁned
according to the operating
programme(P = 1)Up to several occurrences
per year(P < 1)

CATEGORY 3
Unlikely accidents< 10−2(P < 10−2)Stable states and normal transientconditions (including irradiation
experiments)



Loss of fuel cladding leaktightness

Coolant leak or break of smallequivalent diameter (e.g. Φ < 10 mm)
 Partial loss of coolant ﬂow
 Total loss of secondary coolant
system ﬂow
 Leak affecting a heat exchanger
between light water and heavy
water (**)
 Coolant pump shutdown during
shutdown
 Loss of integrity of a thimble casing
resulting in heavy water entering thethimble (*)(**)
 Leak or break affecting efﬂuent
discharge systems
 Short-term loss of offsite
electrical supply (e.g. < 1 hour)
 …




Inadvertent removal or withdrawal of anabsorber element (possible in Cat. 2)

Coolant break of “intermediate”
equivalent diameter(e.g. 10 mm ≤ Φ < 100 mm)
 Break of a standard aluminium thimble(*)
 Failure of a heavy water sleeve (**)
 Clogging of a core fuel element
cooling channel
 Clogging of several channels of a fuelelement in a storage area
 Dropped transport cask containing fuelelements in the facility
 …
(Continued on next page)

Elements of nuclear safety – Research reactors

124

Table 7.1. (Continued)
CATEGORY 4
Major yethypotheticalaccidents< 10−4(P < 10−4)

Beyond designbasis area< 10−6, 10−7
per family

Absorber ejection (potentially causing core meltdown)– possibly studied as an additional operating condition
if multiple failures are involved

In-pool reactor block failure (causing reciprocaltransfers between light water and heavy water) (**)
 Coolant break of large equivalent diameter(e.g. Φ ≥ 100 mm)
 Break of a zirconium alloy thimble179
 Core coolant bypass’(potentially causing core meltdown) In-pool double-ended guillotine break of a water
inlet collector180 in the core181
 In the hot cell, accidental cutout of a fuel element
 …
Additional operating conditions (some may cause melting in
the core or core meltdown under water or in the air in theevent of fuel element uncovery) Inadvertent removal of an absorber with failure of
the reactor protection system Failure of the main heavy water system with failure of
the vacuum relief valve (*)
 Loss of secondary coolant system ﬂow with failure of
the protection system
 Total failure of a thimble with isolation failure(“window” and safety valve or upstream and downstream
safety valves’182) (**)
 Complete loss of offsite and back-up electrical power supply
 Loss of offsite electrical power supply and failureof the reactor protection system
 BORAX-type accident (reactivity accident)
 Loss of entire reactor water inventory (heavy andlight water) (**)
 …

Other accidents studied or excluded by prevention
measures
Uncovery of stored fuel elements
Failure of the two “heat source” or “heat sink” vessels (*)
 Explosion of a “cold source” thimble, causing
internal damage to the reactor block (*)
 Core meltdown with total containment failure
 …



179.
180.
181.
182.

For example, in the case of the RHF, a break in the “stack”, located above the core tank.
Case of the RHF: see ﬁgure 5.12.
In the case of the RHF, this would result in light water entering the fuel assembly in the core
(instead of heavy water).
See the description of these components in section 7.3.2.

Safety principles for French research reactors

125

Table 7.2. Core power densities and coolant temperatures for different types of reactors.

Powerdensityin kW/l
Coolant temperature
at core inlet andoutlet in °C(*)

Pressurised
water reactor

Sodium-cooled
fast neutron
reactorOSIRIS

RHF

JHR

~ 100

~ 300

~ 300

~ 1,200~ 600

286–323(*)

350–550

38–48

30–48

25–36

These values are for Bugey 900 MWe PWRs.

in order to obtain the neutron fluxes required for experiments or irradiation183. Table 7.2
shows several power densities in the cores of different types of reactors, including
power reactors.
The power density generated depends on the type of fuel used. It can be high with
fuel that is highly enriched in fissile uranium-235. Several types of fuel are used inresearch reactors, depending on their use. For critical assemblies where flexible use isessential, operators generally have a broad inventory of fuel elements in the form of
rodlets or platelets, allowing them to create cores “à la carte”. For this type of reactor,
core assemblies are created manually in the installation itself.
For irradiation reactors and “neutron beam outside” reactors, whose main purpose isto produce strong neutron fluxes, it is essential for fuel assemblies to be properly cooled
when the reactor is in operation. Fuel elements are designed to meet this purpose. For
example, the use of curved plates (figure 7.2) provides greater stiffness and ensures thatthe desired spacing is maintained between the plates in various degraded or hazard conditions (earthquake, etc.).
As stated in chapter 2, as part of international efforts to prevent nuclear weapons
proliferation, procurement of highly enriched with uranium-235 fuels can be a problem. A number of research reactors have therefore converted to the use of silicidefuel, using a U3Si2 formula alloy that reduces uranium-235 enrichment to less than
20% while maintaining the potential and capacities of these reactors. However, this“conversion” can raise problems for some research reactors due to dimensional andother constraints, making it difficult to make changes, especially in their cores. To

183.

Research reactor designs must achieve the best compromise between several contradicting
requirements. This includes designing a small core to achieve high ﬁssion densities, creating a
sufﬁcient experimental volume to install all experimental devices, extract high power densities
without negatively affecting the neutron performance of the core or hinder its experimental use(“Les réacteurs de recherche”, Francis Merchie, L’Encyclopédie de l’énergie, 2015).

126

Elements of nuclear safety – Research reactors

Figure 7.2. Curved plate fuel element used in the FRM-II reactor in Garching, Germany. © FRMIITechnical University of Munich.

compensate for the loss of uranium-235 enrichment, new higher density uranium alloys184 are being studied, but these would come with other drawbacks (more frequent
replacement of core fuel, less efficient neutron absorbers, etc.). This issue is still being
explored and is at the heart of the question around choosing the type of fuel for theJules Horowitz Reactor185. Research is being carried out to develop and qualify othertypes of fuel. The CEA and other organisations186 are studying fuel made of 20% enriched uranium-235 and molybdenum grains with aluminium alloy cladding (currently
called UMo).
Aluminium (or aluminium alloys such as AG3NET or zirconium) is widely used inresearch reactors for fuel, fuel cladding, internal structures and components (such as
neutron channels). To achieve a good thermodynamic yield, nuclear power plants
operate at the highest possible temperatures, whereas apart from a few exceptions,research reactors are “cold” reactors. This allows for the use of these types of materials,
which have much better neutron characteristics than steel (neutron transparency),
although they may have poorer mechanical properties depending on their composition
and treatment (in terms of yield strength, rupture elongation, etc.).
In terms of neutronics187, the thermal neutron fluxes that can be used for experimental programmes must achieve values of 1.1013 to over 1.1015 neutrons.cm-2.s-1.
The neutron flux in a reactor is made up of fast neutrons resulting directly from fission,
thermal neutrons after slow-down in the moderator, and intermediate neutrons in the
184.
185.
186.

187.

NUREG-1313 silicide has a density of 4.8 gU/cm3. With new fuel, the aim is to achieve a densitythat is approximately twice higher.
“Les combustibles nucléaires”, Monograph by the CEA Nuclear Energy Division, 2008.
The United States (ANL), Canada, Russia, South Korea and Argentina are contributing to thequaliﬁcation of this new fuel. Experiments have been conducted in the OSIRIS reactor, and the
HFR and BR2 reactors are also being used.
“Les réacteurs de recherche”, Francis Merchie, L’Encyclopédie de l’énergie, 2015.

Safety principles for French research reactors

127

Table 7.3. Neutron parameters for the cores of different types of reactors.

Maximum ﬂux inneutrons.cm-2.s-1
Doppler effectModerator
effectEffective beta(delayedneutronfraction)

Pressurised
water reactor

Sodium-cooled
fast neutron
reactorPHENIX(*)

OSIRIS

RHF

JHR

1 to 3.1013

4.5 1015

5.4 1014

1.9 1015(**)

1.1 1015

3 pcm/°C

0.6 pcm/°C

3 pcm/°C

from 10 to
60 pcm/°C

generally
0.06 pcm/°C
but positive insome areas of
the core

14 pcm/°C

2.5 pcm/°C
17 pcm/°C(including
Doppler effect)

20 pcm/°C

500 to700 pcm

325 pcm

731 pcm

713 pcm

730 pcm(*)

The values given are for the PHENIX reactor operating at a maximum power of 350 MWth(power adopted for its operation from 2003 to 2010).

(**)
This corresponds to the sum of 1.5 1015 neutrons.cm-2.s-1 of thermal neutrons available in theend of thimbles, and 3.5 1014 neutrons.cm-2.s-1 of fast neutrons in the core fuel element.

process of slowing down (slowing occurs via successive collision of neutrons against
the nuclei of moderator atoms). Depending on whether the reactor is well-moderated
or under-moderated, the neutron spectrum will have a more or less fast component,
which could be detrimental or desired, depending on the objectives of experimental programmes.
Furthermore, the spatial distribution of neutrons is not uniform and decreases fromthe centre to the core perimeter, with localised disturbances due to things such as the
movement of control absorbers and the presence of experimental devices. This causes
variable distribution of the residual heat over time and space and therefore the presenceof “hot spots” that need to be well-anticipated and managed from a thermal hydraulicstandpoint in order to prevent fuel from overheating beyond set limits and being damaged. This safety concern will be covered in section 10.1.1, with the discovery in 2004 ofseveral melted fuel rods in the CABRI reactor driver core.

7.2.2. Usage rates
Another feature of research reactors is the specific ways they are used. Irradiation
reactors or “neutron beams outside” reactors operate in cycles. During a cycle, they are
generally in steady-state operation 24 hours a day. At the end of a cycle, they are shut
down for refuelling. In this way, such reactors can provide a stable supply of neutrons(beams for experiments) and over a significant period of time (irradiation).

128

Elements of nuclear safety – Research reactors

The operating programmes for critical assemblies vary significantly and are closely
linked to the test programmes performed, which may last from a few months to several
years. Such test programmes start with construction of the experimental core, which
may take several months. The test phase proper then follows, when the reactor may
operate for just a few hours a day, or throughout the day. However, it is usually shut
down every night. This phase may also involve changes to the core configuration, inorder to meet testing needs.
For reactors used for specifically safety-related tests, preparation times for tests orseries of tests may be fairly long. One example of this is the test loop on the CABRI
reactor, which has required several years of work to change. The time between two
tests may also be long, for example because special provisions are required to handle
a degraded test fuel element. The actual test period can, however, be very short in comparison with the preparation periods and the times between tests.

7.2.3.

Organisational and human factors

One aspect of research reactors, compared with other nuclear facilities such as nuclear power reactors, is the particular involvement of people in reactor operation andthe use of reactors for research. People do perform a range of operations in most nuclear facilities, such as process management, refuelling, maintenance, monitoring, butwith research reactors people may often have to handle fuel elements using handlingpoles or put together the fuel elements (this is the case, for example, for some criticalassemblies).
In addition, the large amount of handling of experimental devices placed in or near
the reactor core is to be noted.
Moreover, in many research reactors, there are two different groups of workers
whose actions have an impact on safety: the reactor operating teams who are responsible for running the reactor within safe limits, and the scientists that use the experimental devices in order to generate research outputs. The latter group may not be soconscious of the safety limits and reasons for such rules. The authority of the facility
manager over both groups of workers is therefore essential.
Furthermore, after a test campaign, many human operations may be necessary, suchas disassembling or reassembling systems in preparation for the next experiments, orcleaning components. The potential safety and radiological protection consequencesof such operations must be clearly understood.
Finally, research reactor activities very often are evolving and discontinuous overtime. Activities can change, depending on the planned research programmes, and eventhe slightest consequences of such changes must be considered in terms of safety andradiological protection. Moreover, whenever major changes occur, involving longerterm stoppage of some activities in order to undertake equipment modifications, theeffect of such stoppages on staff skills must be assessed.

Safety principles for French research reactors

129

Risk assessments relating to human activities in research reactors can draw on a
specific approach188 which involves:– determining which activities are “safety-sensitive”, meaning activities which
could have signiﬁcant safety consequences if incorrectly performed;– identifying what provisions are in place to ensure such activities can be
performed reliably;– assessing the effectiveness of those provisions.
The sensitivity of any given activity can be assessed on the basis of a range offactors: potential consequences of incorrect performance, complexity of the tasks,
repetitive nature of the operation, number of workers involved, coordination requirements, etc.
To illustrate the point, two activities in French research reactors can be mentionedthat are deemed to be particularly sensitive:– for the MASURCA model, the fabrication of “à la carte” fuel elements fromrodlets or platelets in the storage warehouse (criticality risk in the event of error);– for the ISIS reactor used for successive training sessions, the setting of safety
thresholds (risk of inadequate reactor protection in the event of an unexpectedtransient).
In general, the experiments may require reconfiguration of the protection system,and such adjustments must be made in a reliable and traceable way.
Although facility operators have identified the vast majority of activities which
could have significant safety consequences in the event of error, other activities that
may have less obvious safety effects or which are sensitive chiefly due to the complexity of the operations to be performed may require further analysis.
As mentioned above, any needs for coordination between different teams areusually included in the aspects considered when assessing whether a given activity
is sensitive. This is the case, for instance, for experiments that require preparationand especially close coordination between the operating personnel and the scientificresearchers. Thus, the tests undertaken under the Phebus FP programme (see focus at
end of chapter 5) required in-depth preparation to mitigate any risks of conflict ofinterest: the instruments used included redundant and diversified measurement devices and the test procedures specified various predetermined shutdown thresholds.
The goal was to avoid stopping the tests too early, given the test objectives, but stillto ensure the reactor would be shut down and containment maintained if there was
any risk of excessive damage to the “barriers” between the test fuel and the drivercore. Test procedures were developed for the operators, to specify in particularwhether or not tests should be continued, based on the instrumentation status(whether the temperature measurement devices were in service, failed or saturated,

188.

“Contrôle” Journal no. 176 of July 2007: “Les facteurs organisationnels et humains et la sûreté desréacteurs d’expérimentation”, F. Jeffroy and M.-L. Delaporte-Normier, IRSN, p 47.

Elements of nuclear safety – Research reactors

130etc.) and on predetermined limits. These provisions were submitted to the French Nuclear Safety Authority (ASN).

7.3.

Features of research reactors by main safetyfunction

This section presents the main technical features of research reactor that are important for safety.

7.3.1.

Controlling core reactivity

Core reactivity (annotated ρ and expressed in pcm – per cent mille) is a parameterused to represent the neutron population (number of neutrons) in a core and its variation over time. When the population is stable, the reactor is said to be “just critical”
and reactivity is zero (ρ = 0). This population results from the neutrons generated byfission reactions, neutrons emitted later by some fission products (so-called “delayed
neutrons”) and neutrons that leak out or are captured (e.g. in absorbent materials).
Operators control the reactivity in a reactor core by using neutron-absorbing materials(also known as “neutron poisons”) such as boron, cadmium and hafnium. These materials are used in control absorbers (or safety absorbers in research reactors). These aremobile components inserted into the reactor core to enable its reactivity to be adjusted
and controlled. Vertical absorber movements are controlled by mechanisms that areusually found above the core. However, in some cases, to facilitate access to experimental or irradiation devices, absorber motion may be controlled by mechanisms inthe bottom of the reactor block. This is true of the OSIRIS and Jules Horowitz reactors,
which have a room under the reactor pool that houses these mechanisms. This meansthat the potential risks of water leakage – possibly involving contaminated water in theevent of a reactor accident – into reactor basements need to be managed by installing
waterproof coatings in the control mechanism rooms.
Some absorbers are used for reactor control (control absorbers) and others are used
for reactor scram (safety absorbers). To shut the reactor down, all absorbers are fully
inserted into the reactor, thus bringing it to sub-criticality (ρ < 0), with an adequate
deficit reactivity margin (or shutdown margin). Once the reactor has been shut down,
safety reasons may require some safety absorbers (one or two) to be withdrawn fromthe core zone, in order to maintain an appropriate negative reactivity level in case ofhandling errors, for instance during core operations such as refuelling. When the reactor
starts up, operators first withdraw the safety absorbers from the core, maintaining it ina sub-critical state189, and then the control absorber(s) is (or are) gradually withdrawn
from the core until it reaches criticality (ρ = 0). This absorber (or these absorbers) arethen used to increase or decrease reactor power and to compensate for fuel burn-up
when the reactor is in operation. The safety absorbers are generally held axially outside

189.

This is a design requirement for the core and absorbers.

Safety principles for French research reactors

131

the zone of the core190 (usually by means of electromagnets). In incident or accident
conditions, the electromagnets are disabled, and the absorbers drop or are rapidly inserted (with a pressurized gas device) into the core or core zone to cause automatic
reactor shutdown (see figure 7.3).

Figure 7.3. Position of the safety absorbers and control absorbers in a pool-type reactor in shutdown
conditions (left) and in operation (right). © Georges Goué/IRSN.

Each reactor has a protection system connected to various redundant sensors (temperature, pressure, neutron flux, etc.) and actuators. The signals emitted by the sensors
are processed using an appropriate and safe “voting” logic. The monitored parameters
and the threshold values that trigger safety actions (chiefly a safety absorber drop)
are specific to each reactor. The threshold values are determined by “operating conditions191” studies. A safety absorber drop may also be triggered by signals from outside
the reactor (e.g. earthquake, impact on the reactor building, loss of required negative
pressure in a room) or by signals from sensors that monitor certain operating parameters
relating to the experimental devices, when this is deemed necessary for reactor safety.
The protection system is a key element in research reactor safety. Various options
are used in design, in order to ensure a high level of protection system reliability, including redundancy, technological diversification and the physical separation of measurement pathways. A single failure criterion is used to check that no single failure can
190.
191.

The safety absorbers may indeed be outside, but close to the core, as is the case with the RHF,
for example.
Conservative margins are added to the operating conditions in order to take into accountuncertainties, for example with the measured reactor values or the time required to activate
protective systems.

Elements of nuclear safety – Research reactors

132

prevent a system from performing its allocated safety function. This can be achieved byredundancy, which means that system elements are duplicated (or more) and distributed across different “channels” or “trains” to ensure that each path can performthe system function. In addition to redundancy, the “trains” can be separated fromone another geographically, to ensure that no hazard, such as a fire, can affect all trainsat the same time (referred to as a common mode failure). Diversification means using,as far as necessary, different designs or technologies for the components on the redundant trains of a given system, to ensure that the system is sufficiently reliable. Furthermore, design of important “active” components should be “fail safe”, meaning that any
component failure should switch it to a state that is favourable for safety. For instance,a “safe” position for the absorbers would be full insertion into the reactor core. The absorbers control system is designed with electromagnets that drop them into the core(for mechanisms located above the fuel zone) if electrical power is lost.
Core loading is an important operation, involving loading the fuel elements into thecore, and is performed under procedures that require many checks and controls. Hardware design provisions can be used to physically prevent positioning errors that could
jeopardize reactor safety.
During periodical safety reviews, in addition to the protection system describedabove, some research reactors have had a back-up system added to stop the chain reaction in some accident conditions under which core deformation could prevent or dangerously delay absorber insertion (e.g. in the event of a major earthquake). This may be
as simple as a system to inject a neutron absorber in aqueous solution into the reactor
coolant. This type of system has for instance been implemented on the CABRI reactor(borated water injection) and has been adopted as a core melt accident management
provision on the Jules Horowitz reactor.
As well as the conventional reactivity control strategies described above, it is also
important to prevent failures that could lead to reactivity insertions in a core.
From research reactor design phase, study is therefore required into any absorbermechanism malfunction that could lead to absorber withdrawal or ejection from thecore zone (generating a reactivity insertion) instead of insertion into the core or corezone to control reactivity. Design provisions can be implemented to restrict the amplitude or rate of absorber withdrawal, as has been the case for the Jules Horowitz reactor.
Likewise, specific leakage scenarios or reactor block structure failures (reactor vessel,
thimbles of neutron beams, etc.) that could lead to reactivity insertion into a core (e.g.
for the RHF, ingress of light water into the heavy water flowing in the core) require
analysis and appropriate in-service monitoring of the relevant structures in order to ensure their occurrence is sufficiently unlikely.

7.3.2.

Cooling the reactor

This safety function is not particularly problematic for very low power reactors, up
to approximately 100 kW, in which the heat naturally dissipates through reactor
structures. For higher power reactors, it is obviously essential to have enough coolant,
and the core can be cooled either by the natural upward flow of this coolant in theSafety principles for French research reactors

133

reactor core (natural convection), or by a stronger flow of coolant which requires forced
convection. In the latter case, the reactor core is cooled via a reactor coolant system,
which uses circulator pumps to generate the coolant flow. This reactor coolant system
is itself cooled by a secondary cooling system, in order to prevent radioactive releases,
since the reactor coolant can potentially be contaminated.
The reactor coolant system may be an entirely closed circuit, or may be partiallyopen to the reactor pool. Coolant system failures (loss of flow, pressure loss, loss of
coolant) are detected by the protection system, which can trigger alarms or even shut
down the reactor automatically. Residual heat still needs to be removed, and the levelof this will depend on previous reactor operating regimes, in particular its operating
power. For reactors that operate at a power of a few megawatts, natural convection
may provide sufficient flow to cool the fuel in the reactor after shutdown. However,in order to start this flow, water from the pool in which the core is submerged must
be able to get into the fuel elements. Valves in the core coolant pipes, at the entrance
to the core, ensure that this connection can be made between the reactor coolant system and water from the pool. When the reactor is operating at power, these valves are
kept closed by the pressure differential between the water in the pool and the reactor
coolant system. They open naturally when the pressure differential reduces (e.g. loss ofreactor coolant flow). These valves are generally duplicated to prevent any loss of thisconnection between the pool and the reactor coolant system in the event of a valve
failure. (This is an application of the single failure criterion). Depending on the residual
power released by the reactor core, it may also be necessary, in the first few minutes
after reactor shutdown to maintain a higher coolant flow rate than the natural convection rate. The reactor coolant pumps therefore have flywheels, which slow them down
gradually, to maintain sufficient reactor coolant flow in the reactor core for some timeafter shutdown. The valves and flywheels mentioned above are components that needno external supply of electricity, compressed air or other utilities to operate.
In some research reactors, natural water convection in the core can even remove heatfrom low operating power, and this possibility is provided for in the general operating rules
for these reactors. This enables valve operation and natural water convection in the core
to be checked in normal reactor operating conditions. In reactors whose core is cooled innormal operating conditions with a downward water flow (high-flux reactor in Grenoble,
ORPHEE), natural convection does not start immediately upon shutdown, because it requires the flow direction in the core to be reversed. For such reactors, this switch of direction obviously needs to be checked in commissioning tests and in operation.
For high-power research reactors such as the 100 MW Jules Horowitz Reactor which
is currently under construction at the Cadarache site, the level of residual heat releasedmeans that forced core cooling flow must be provided for several hours after reactor
shutdown. Residual heat removal requires the use of “active” systems, both normal systems and safeguard systems for accident conditions. These safeguard systems include
pumps and heat exchangers that exchange heat with one or more cooling systems. Given the safety-importance of such systems, the design, manufacturing and operating
requirements are high and include specifications concerning in-service monitoringand maintenance. These systems are provided as redundant, with each system geographically separated and individually capable of removing all residual heat. They areElements of nuclear safety – Research reactors

134

provided with back-up electrical power via batteries and generators, and the pipe
lengths and number of flanges and unions are kept low in order to reduce risks of leakage or pipe break.
For research reactors whose core sits in a pool, the water inventory in the poolneeds to be maintained in all possible situations. Maintaining this water inventory is
one of the ways cooling function is managed, and is also a protection against ionisingradiation. A drop in water level in the pool may be due to a leak in it or a leak or break in
a circuit connected to it. To prevent a water level drop, one design provision is to ensurethat all pipes penetrating the structure of the pool open out above the level of the reactor core. This applies in particular to the auxiliary systems, such as the “hot layer” system referred to below in section 7.3.3, which remove surface impurities from the waterin the pool, or the make-up water system that makes up for water that evaporates fromthe pool.
In neutron beam reactors, the neutron channels (see figure 7.4) that penetrate thepool walls cannot comply with this provision because, by definition, they are located on
the same level as the reactor core. A neutron beam channel is therefore fitted with:– a “window” (in most cases192), which is a membrane made of a sufﬁciently
neutron-transparent material (usually aluminium or an aluminium alloy), which
separates the in-reactor part of the channel from the outside air in the areas usedby scientists; this window is designed to withstand accidental loading (such as
ingress of water into the channel in the event of a thimble failure, or a possible
BORAX-type accident in the core);

Figure 7.4. Section through a thimble from the high-ﬂux reactor in Grenoble. © ILL.

192.

In the the RHF, for example, thimbles H6 and H9, which are used for inserting samples onto a
trolley where they will receive the highest neutron ﬂux close to the core, do not have“windows”. In this case, the redundant seal is provided by other valves downstream of the safetyvalve.

Safety principles for French research reactors

135– a shut-off valve at the pool wall, or “safety valve” that is permanently open when
the reactor is in operation, to provide a double leaktight. If water enters thethimble, a time switch can trigger valve closure.
Furthermore, the channels have neutron beam shutters, which are separate components, in addition to the “windows” and safety valves described above.
Given the water flow velocity in the reactor coolant system, any leak in a portion of
the system outside the pool could drain the system through a siphon effect. To avoid
this, the reactor coolant pipes have vacuum relief valves (see figure 7.5), whose role isFigure 7.5. Schematic diagram showing “passive” siphon breaker systems on a cooling system.
© Georges Goué/IRSN.

136

Elements of nuclear safety – Research reactors

to break the siphon effect, by letting air into the leaking system (either passive or active
air injection using a valve or similar device).
In some French research reactors, including pool-type reactors such as OSIRIS,ORPHEE and JHR, a concept referred to as a “water block” is used to mitigate against
the risk of reactor core uncover following a break on the reactor coolant system (seefigure 7.6). This concept ensures that all rooms containing portions of a system in whicha break or leak could drain the pool are sufficiently leaktight and of an appropriate
volume. If there is a break of the system, water flows out into a leaktight room until
it is completely filled. The quantity of water lost to the leak is limited by the volumeof the room, which stops the pool from draining while it is still at a high enough levelto prevent uncover of the fuel elements as a result of the reactor coolant pipe break.
This however requires either strict operating procedures (doors kept closed), or design

Figure 7.6. “Water block” concept: limiting water level drop in the reactor pool in the event of acoolant system break. © Georges Goué/IRSN.

Safety principles for French research reactors

137

provisions (door position reported in the control room), to ensure that the relevantrooms remain tightly sealed.
Finally, the reactors pools of French research reactors that use a uranium-aluminium
alloy-based fuel are designed to withstand the steam explosion from a BORAX-type
accident.

7.3.3.

Conﬁnement of radioactive substances

The key principle for confining radioactive substances, both for research reactors
and for all other basic nuclear installations in France, is to place several “barriers” between the substances and the environment. For the nuclear fuel, these “barriers” areas follows:– the ﬁrst conﬁnement barrier is the metal cladding around the fuel elements;– the second conﬁnement barrier is generally the coolant circuit boundary;however, as previously mentioned, in some research reactors, this system isconnected with the reactor pool and therefore does not form a proper
conﬁnement barrier;– beyond this, the ﬁnal conﬁnement barrier comprises the building housing thereactor core (the lowest part being the basemat, the reactor pool ﬂoor or somerooms, depending on facility conﬁguration).
It is important to highlight here that this final confinement barrier generally includes
the building itself, providing “passive” confinement, and a ventilation and filter system,
providing “dynamic” confinement.
Moreover, in neutron beam reactors, the heavy water systems contain tritiatedwater formed by neutron activation of deuterium atoms in heavy water. This requires
these systems to be appropriately sealed, given the radiological risks associated withtritium.
The reactor building must be designed to restrict leakage into the environment.
There must therefore be as few as possible piping or cable penetrations, and these must
be sealed with appropriate materials. Since a building is never perfectly airtight, its passive confinement is generally supplemented by a dynamic confinement system, maintaining a slight negative pressure in the building compared with the outside pressure(the RHF is a special case, discussed later). With this pressure differential, air will preferentially leak from the outside in to the building. Such “active” confinement systems
require equipment such as extractor and blower fans, along with filtration systems(high-efficiency particulate [HEPA] filters and iodine filters) that trap dangerous substances before they can be released into the environment in the air.
In the event of an incident or accident involving the dispersal of radioactive
substances inside the reactor building, the ventilation systems are usually turned
off automatically with reactor shutdown, in order to initially provide static confinement of the radioactive substances. This reduces the associated risks because theshort-lived fission products begin to undergo radioactive decay. Ventilation systems

138

Elements of nuclear safety – Research reactors

can be turned back on later, in order to filter air releases. However, during the static
confinement phase, pressure increases inside the building because the air is heatedby the suspended fission products, and some of the building’s atmosphere may escape into the environment without being filtered, through “natural” leakage. Some
research reactors, such as ORPHEE and JHR, therefore have a “leakages groupingarea”, which is a room adjacent to the reactor building that contains a ventilation
system with filters. All piping and cable penetrations from the building enter thisroom (see figure 7.7), enabling it to collect the majority of leaks from the building
before they are released into the environment.

Figure 7.7. Schematic diagram of provisions implemented to prevent direct leakage from a reactor
building atmosphere into the environment. © Georges Goué/IRSN.

Another provision is to create an annulus around the reactor building, in which the airpressure is always higher than inside the building. This approach was adopted for the RHF.
The choice of strategy for this ultimate confinement (third barrier and associatedsystems) depends on the composition and quantities of radioactive substances that
could be released in accident conditions, and on the kinetics of such releases. Other
considerations such as the proximity of local communities may also feed into the
choice. This is a key decision for reactor new-build projects, and the choice mustfeature in the Safety Options Report which is filed with the Safety Authority for
examination.

Safety principles for French research reactors

139

It should also be noted that most research reactors have an emergency ventilation
system to remove air at a lower flow rate and maintain a slight negative pressure in thereactor building after the normal ventilation system shuts down. This emergency
ventilation system, fitted with HEPA filters and iodine filters, filters any radioactive releases, spreads them out over time and measures the level of radioactivity released.
There is an automatic switchover from normal to emergency ventilation if a predetermined level of radioactivity is exceeded in the reactor building.
Two further features of some research reactors are also worth a mention:– as mentioned above, the reactor coolant system of some research reactors isconnected to the reactor pool. In order to protect operators or scientists working
on the edge of the pool, these reactors have a “hot layer” system, which sends
hot water (40°C) to the top of the pool and removes it again from the top layer
by suction on the other side. This “hot layer” has a depth of between 2 m and
4 m, and the water recovered is treated continuously using ion exchange resins.
The temperature differential created by this “hot layer” keeps radioactive
substances down in the colder water lower in the pool;– in some cases, such as the CABRI reactor (see ﬁgure 5.11), the reactor coolant
circuit may run partly outside the reactor building; in this case, both the reactor
coolant tanks outside the reactor building have a double lining and a retention
tank193.

7.3.4. Criticality risks
A criticality accident can expose people close to the affected area to severe levels ofradiation, and can even cause death. Measures are therefore taken to maintainsubcritical conditions whenever criticality is not required, whether in the reactor corewhen it is shut down or in any other part of the facility using plutonium, uranium thatis more than 1% enriched in uranium-235 or certain minor actinides such as curium or
americium.
A sufficient quantity of fissile nuclei are required to trigger a chain reaction in any
given medium. This means that in any medium there is a mass below which a self-sustaining fission reaction is not physically possibly. One way of preventing a chain reaction is therefore to restrict the mass of fissile materials194. The limitations imposed bythis control strategy, when used in isolation, are usually fairly stringent, and it is thus
applicable to a container, glovebox or laboratory that uses small quantities of fissile
materials, but not, on its own, to rooms containing larger quantities of fissile materials,
such as critical assembly fuel element storage areas.
In such cases, two simple principles are used to guarantee subcriticality:– reducing neutron generation as much as possible by reducing the likelihood ofﬁssion reactions;
193.
194.

Tanks with very low water pressure.
An isotope is referred to as “ﬁssile” if its nucleus can split (undergo ﬁssion) under bombardmentfrom fast or slow neutrons. The only naturally-occurring ﬁssile isotope is uranium-235.

Elements of nuclear safety – Research reactors

140– encouraging as far as possible neutron leakage out of the medium in question, or
neutron absorption by non-ﬁssion capture195.

Slowing down the neutrons – key to maintaininga chain reaction
When they are generated in a fission reaction, neutrons have high kinetic energy(around 2 MeV), and the probability of causing a further fission is fairly low. However, as they move through material, the neutrons collide with nuclei in the medium and gradually lose some of their energy. This increases the probability of theircapture and of further fission. The lighter the nuclei that the neutrons encounter,the more they are slowed down (the slowing-down process is often called “moderation”). Hydrogen is thus a very good moderator.

Figure 7.8. Uranium-235 ﬁssion reaction. © Georges Goué/IRSN.
...................................................................................................................................................................................................................

Water and hydrogenated materials are “moderators” (see focus), increasing the likelihood of uranium-235 fission, and therefore raising the criticality risks. Water may
therefore be prohibited in some rooms, even as a fire-fighting substance, with a specificlow-hydrogen extinguishing powder used instead. This is a criticality control methodthat involves limiting moderation.
195.

Neutrons can be captured by nuclei of the structural metals, the moderator, the fuel cladding,absorber rods or even by ﬁssile nuclei without triggering ﬁssion. These neutrons are hence lostfor the chain reaction. The affected materials are activated by these captures (meaning they
have become radioactive).

Safety principles for French research reactors

141

The potential presence of hydrogenated materials in waste or around fuel must be
taken into consideration in criticality studies.
The geometric characteristics of the equipment in which the fissile materials arecontained have a significant influence on neutron leakage. The geometric “criticality
control method” has the advantage of low sensitivity to human operating errors. However, it must be adopted from equipment design phase wherever possible, taking into
account any hazards and conditions that could change the “geometry” of fissile materials, such as corrosion and accidental deformation through temperature increases,
earthquakes, etc. If such equipment is changed or modified, measures must be taken
to ensure that appropriate geometric characteristics are retained.
When neutrons exit a fissile material, they continue moving and may end up returning to their original fissile medium because of collisions with the nuclei of these materials (neutron reflection). Some of the neutrons leaving a fissile medium may also entera nearby piece of equipment that also contains fissile materials, and cause fission reactions there (neutron interaction). Both these phenomena must be taken into account instudies on criticality risks.
Finally, criticality risks can also be managed using “neutron poisons” such as boron,
cadmium or hafnium, which are very good for absorbing neutrons.
Decisions as to the criticality control method(s) to be used for a facility (e.g. fuelelement storage pool, fuel rodlets or platelets storage area for the MASURCA assembly)
may lead to strict restrictions on specific parameters, taking account not only of normal
conditions but also potential abnormal conditions (such as earthquakes) that may affectthe fissile materials. Materials that may be present in the vicinity of the nuclear materials being studied obviously have to be taken into account in criticality studies, becauseof the potential neutron interactions that may increase criticality risks.
Fuel elements are often handled by operators in a research reactor, and in some handling phases, criticality risk prevention is largely based on organisational and humanmeasures to ensure compliance with the restrictions defined in the criticality studies.
Such measures may include hold points in handling operations or, for instance in the caseof MASURCA, the use of sizing moulds that do not allow more than a permitted numberof fuel strips. These provisions were adopted following a 2005-2006 safety review thatanalysed criticality risks at the facility in the light of organisational and human factors.

7.4.

Hazards

As with other basic nuclear installations, there are two types of hazards to consider:– internal hazards, originating inside the facility,– external hazards, originating outside the facility.

7.4.1. Internal hazards
The main internal hazards that can affect research reactor safety are flooding(following a pipe or tank leak or failure), fire and explosions and load drops. Since

142

Elements of nuclear safety – Research reactors

research reactors do not usually use high-pressure coolants, the risks of pipe “whip”196
are lower than for pressurised water reactors, for instance. These issues may howeverneed to be considered for test loops. The reactor safety consequences of each typeof hazard have to be assessed and appropriate prevention and mitigation measurestaken.
Electrical components are deemed to be sensitive to internal flooding, since any
contact with water can lead to short circuits and outbreaks of fire.
Any rooms that contain, or could potentially contain, fissile materials are also
sensitive to flooding, because of the criticality risk.
Provisions such as low walls at the entrance to rooms and placing fissile materials
storage cabinets at a certain height may be adopted. It is also important to avoid routing water pipes through sensitive rooms or rooms containing flood-sensitive equipment,
as far possible.
A waterproof coating may be fitted in some areas of a facility, as appropriate, toprevent internal flooding from water that could come in from outside the building as
external flooding at ground level or through a rise in the groundwater level.
Alongside flood risks, the large range of electrical equipment used for experiments
may make it harder to manage fire risks in a research reactor. Fire risk management isnecessary throughout the duration of facility operation. A fire took place in August
1979 in the room housing the electronic equipment cabinets for the hodoscope197 at
the CABRI reactor. The fire was found to have been caused by a transformer in the bottom of one cabinet overheating. Because all sides of the cabinet were closed, the fire hadalready developed significantly when the detector sounded the alarm. With dark, corrosive smoke filling several rooms quickly, the investigations and firefighting efforts weresignificantly hindered, since the most active area of fire was hidden by the electroniccabinet, and the rooms had no smoke extraction system. This resulted in confusion
for quite a long period of time as to which room the incident started in. The fire was
eventually fought with water spray systems and fully extinguished only after two hours.
All the hodoscope electronic cabinets198 were destroyed and the hodoscope could not be
used for eight months.
A Basic Safety Rule was established in 1991, specifically for fire risk management
in research reactors (see section 6.2). More recently in 2014, an ASN decision199
established rules for fire risk management in all basic nuclear installations in general.
Four levels of application of the defence in depth principle are outlined:
196.

197.

198.
199.

Complete pipe rupture can lead to movements known as “whip” in the pipe branches on eitherside of the break. The violence of the whipping depends on the ﬂuid pressure inside the pipe
system.
This device is used to observe the behaviour of fuel elements (speciﬁcally movements of theﬁssile material) placed in the CABRI reactor test section in experiments that simulate accident
conditions leading to fuel melt and liquidation.
Some documents also report damage to the reactor protection system relay due to the
propagation of smoke.
ASN Decision 2014-DC-0417 dated 28 January 2014.

Safety principles for French research reactors

143– “preventing outbreaks of fire;– detecting and quickly extinguishing outbreaks, firstly to prevent them leading to afull fire and secondly, to return to normal operating conditions or, failing that,
achieve and maintain a safe state200 in the facility;– limiting the hazard and spread of any fire that cannot be controlled, in order tominimise the impact on nuclear safety, and to enable a safe state to be achieved
and maintained in the facility;– managing accident conditions resulting from any fire that cannot be controlled
such as to limit consequences for people and the environment.”
The first three levels of these rules are about avoiding jeopardising fundamental
safety functions. Any equipment performing such functions must obviously be protected from the consequences of a fire.
As for other basic nuclear installations, prevention of the outbreak of fire in research
reactors involves using low-flammable materials as much as possible, and limiting combustible materials to the quantities strictly necessary in those rooms or areas designated for their storage such as pools or warehouses, etc.
Facilities are also equipped with fire detection systems that notify operators of any
outbreaks of fire and automatic actions may be triggered, such as stopping air supply
from the ventilation system and closing fire dampers to limit the spread of the fire.
Finally, research reactors have firefighting systems that are appropriate to thetypes of fire that may occur and the equipment to protect. There are however various
specific features that are worth highlighting. For example, in core fuel element handling and storage areas at the MASURCA facility (for fuel rodlets or platelets, solid
sodium etc.), firefighting systems using graphite-based powders are installed for fires
that could involve solid sodium elements, given the energy-releasing nature of the sodium-water reaction (sodium fire, emission of oxide and peroxide sodium aerosols).
Moreover, as has already been stated in section 7.3.4, water may be prohibited insome rooms with criticality risks because water is a neutron moderator. This applies
to the fissile element storage and handling areas in the MASURCA storage and handling building.
Facilities are organised into fire compartments to prevent the spread of any fire thatis not quickly extinguished. A fire compartment is a clearly contained volume, closed off
with walls such that a fire inside a compartment cannot spread to the outside (or viceversa) during a certain period of time, allowing firefighting systems to be used. By using
fire compartments, common mode loss of a safety function can be avoided, as long as
the function is provided by two redundant systems located in two different fire compartments. This is usually the case for a nuclear reactor protection system (that triggers
reactor scram) and for electrical power supply systems, etc.

200.

ASN Guide No. 22 on the design of pressurised water reactors, released in 2017, deﬁnes a safe
state as follows: “stabilised condition of a facility in which subcriticality, residual heat removal andthe containment of radioactive substances can be maintained in the long term.”

Elements of nuclear safety – Research reactors

144

In some older research reactors however, fire compartmentation was not planned in design phase. Special attention is therefore paid to this issue, especially in safety reviews, when
the possibility of improvements and upgrades in this area can be specifically examined.
Some fire compartmentation non-conformities have been discovered in basic nuclear installations in general, by the facility operators themselves or during inspections by
the French Nuclear Safety Authority (ASN). Further study is ongoing into reducing firerelated risks, focusing on the possibilities of unburned gases and soot spreading outsideof the compartment in which the fire started, such as to jeopardise the redundant trainsof safety-classified systems in other fire compartments. IRSN is continuing to performresearch and development work on this topic201.
For research reactors, the prevention of explosion-related risks is generally based on
reducing the possible sources and distancing them from any safety-important equipment. Explosion risks associated with the experimental devices placed inside research
reactors (including the “long-term” associated equipment such as “hot sources” and“cold sources”) are discussed later.
Load drops are events that can occur during the handling of relatively heavy items(fuel elements or assemblies, experimental devices, transport packaging, etc.). Prevention of such events involves adopting robust design provisions and ensuring in-service
monitoring of lifting equipment. However, it is not really feasible to rule out any
possibility of load drops. For this reason, metal plates on shock absorbers (sometimes
referred to as “resilient bearing pads”) have been fitted to some reactor pools in orderto protect their bottom or parts of their bottom from load drops. Likewise, someresearch reactors have “lifting accompaniment devices”, which slow the fall of any load
being handled if the lifting equipment fails.

7.4.2.

External hazards

External hazards may have human 202 or natural causes. Manmade hazards are
related to the presence of industries and transport routes in the vicinity of the facility.
Natural hazards will depend on the site at which the research reactor is built, and may
include earthquakes, flooding, fire, lightning, violent winds and tornados and extreme
temperatures.
When a new research reactor project is considered, the prevention of external
hazards is firstly based on the choice of site, avoiding choosing a site that will engenderinsurmountable difficulties for facility protection and design. It is important todetermine the external events that could constitute hazards for the facility; the determination method will vary depending on the hazard type considered.
It should be noted that some research reactors have been close to or on the site ofuniversities or other academic centres (e.g. the Strasbourg university reactor, which has
now been shut down).
201.
202.

See publication “Current state of research on pressurized water reactor safety”, Science andTechnology Series, IRSN/EDP Sciences, 2017.
Malicious acts are not covered in this document.

Safety principles for French research reactors

145

For hazards caused by the industrial environment (e.g. chemical plants) or humanactivities (all forms of transport, including civil and military aviation), thehazard-causing events are usually identified on the basis of a probabilistic-type
analysis. If the likelihood of occurrence is very low (of the order of 10−7 per year),current practice under the fundamental safety rules (see chapter 6) is to consider
the hazard improbable enough to disregard in terms of facility protection or design
verification.
The main risks associated with land-based transport routes and the industrial environment around a research reactor are a gas cloud explosion (explosion of a truck carrying hazardous materials or a warehouse storing hazardous materials) or a toxic gas
cloud drifting to the facility. These risks were closely studied for the RHF at Grenoble,
which is located close to an industrial area, a motorway and a railyard. In addition to thedesign provisions, supplementary considerations are taken into account as necessaryduring safety reviews, including an analysis of preparedness for potential emergency situations (crisis management).
The natural hazards considered are determined on the basis of available historical
data, which is then extrapolated to define hazards in pessimistic terms, which may
be associated with a given recurrence period.
ASN Guide No. 13, which was released in 2013, discusses how to determine trigger
events relating to the various possible causes of external flooding and how to define theappropriate protection provisions203. For every research reactor site, all possible causesof flood risks need to be explored, including heavy rainfall, rain-induced river level rises,
flash flooding from dam failure and rises in the groundwater level, etc. French research
reactors are not built on the coastline, which rules out risks from high tides andtsunamis, etc.
With regard to the risks of heavy rainfall, rainwater drainage systems are designed
to ensure that no water enters the facility and, if necessary, sills may be installed atcertain doors.
The safety of the RHF at Grenoble in the event of dam failure, given its location at
the confluence of the Rivers Drac and Isère, both of which have a number of dams, is an
issue that has been analysed repeatedly in periodic reviews as well as in the complementary safety assessments (stress tests) carried out in France in the wake of the
Fukushima Daiichi nuclear powerplant accident. This issue of safety reviews is addressedin section 9.2.
The following paragraphs describe in greater detail the way in which seismic risks
are managed. Given their locations, the risk that an earthquake of significant intensity
may occur can be relatively high for some research reactors. This type of hazard, itshould be noted, affects the whole of a facility simultaneously and can therefore leadto common mode failures.

203.

On this subject, see the 2013 IRSN Report “L’aléa inondation - État de l’art préalable àl’élaboration du guide inondation pour les installations nucléaires”.

146

Elements of nuclear safety – Research reactors

With regard to seismic risks, until the 1970s, research reactors built in France werebuilt under the then-applicable earthquake protection rules204, which were not specificto any particular type of building, such as a basic nuclear installation. In 1974, when
nuclear power reactors were being developed in France, the CEA Nuclear Safety Department205 drafted report DSN50 (on behalf of the standing group of experts for nuclear
reactors) entitled “Protecting powerplants from earthquakes”. The report surveyed
relevant French and international practice and made a number of proposals, especiallyabout how to determine which ground response spectra206 to use (with a dynamic
analytical method) to assess the “response” of the structures to an earthquake. These
proposals formed a basis for facility operators to work with, and prefigured fundamental
safety rule RFS I.2.c, which was released in 1981 by the Nuclear Facility Safety Central
Service for pressurised water reactors, proposing a deterministic method that would be
acceptable for determining which seismic motions should be taken into account inearthquake design for such reactors. In 1992, fundamental safety rule RFS I.1.c extended
this method to be applied to all basic nuclear installations, including research reactors.
This method starts with surveying the strongest known earthquakes in the area aroundthe facility site, based on available geological and seismological data, in order todetermine the intensity of a “maximum historically probable earthquake”. The intensity
is increased, to give what is known as a “safe shudown earthquake”, which is used as areference for facility safety. In 2001, a new fundamental safety rule (RFS No. 2001-01),
drawn up with the help of IPSN experts, was released by the Nuclear Safety Authority
after several years of discussion between relevant parties. This new Rule maintained adeterministic approach, but also introduced some further developments about how
paleoearthquakes and site effects should be taken into account. Moreover, for sites
with very low seismic risks, a minimum spectrum is defined, for which peak groundacceleration (PGA: acceleration corresponding to infinite frequency) is set at 0.1 times
gravitational acceleration (g)207.

Paleoearthquakes & Site effects
Paleoearthquakes are strong earthquakes that occurred in ancient times. They
can be identified through the traces they have left in geological deposits in the
Quaternary. The purpose of studying them is to understand and characterise theoccurrence of such earthquakes and to supplement knowledge about seismicity
204.
205.
206.
207.

Recommendation AS 55 (1955), drafted following the Orléansville earthquake in Algeria in 1954,
earthquake protection rules PS62, 64, 67, 69, etc.
The IPSN was only established as part of CEA in 1976.
Response (in terms of accelerations) of resonators at various natural frequencies, under theeffects of the earthquake in question.
For zones of moderate seismicity, accelerations can be up to 0.3 g approximately. For highseismicity zones such as Japan or Turkey, accelerations can be up to a range between 0.4 and0.6 g.

Safety principles for French research reactors

147

around a site, beyond the period for which instrumental data (over the last century)or historical records (over roughly the last millennium in France) are available.
Site effects that require study are potential amplifications of seismic motions dueto the presence of a layer of low mechanical strength soil close to the surface (up to
30 metres below ground level).
In addition, in some specific cases, complex geometry or thick sedimentary layers (e.g. a sedimentary basin) may cause amplification or temporal prolongation of
the seismic motion. These are referred to as site-specific effects, and are not caused
only by soil properties in the first 30 metres below the surface.
Site effects have to be especially taken into account at a research reactor suchas the RHF at Grenoble, because of the presence of an alluvial basin (figure 7.9,

Figure 7.9. (Top) example of site effects in a coastal area of Mexico © J.F. Semblat, A. Pecker(IUSS Press, 2009); (bottom) example of site effects in the Grenoble basin during the 1996
Chambery earthquake. © All rights reserved.

Elements of nuclear safety – Research reactors

148

bottom side). The Saclay facilities are built on alluvial-type soil (but in a
low-seismicity zone) and the Cadarache facilities are on a mixed rock/sedimentsoil.
...................................................................................................................................................................................................................

Since all facility components are simultaneously affected by the seismic motions,facility safety relies on robust design 208 of a set of key equipment that provides
the main safety functions and if necessary, for a nuclear reactor, ensures it is placedin a safe state209. Alternatively, under an “event-level earthquake” approach (seesection 7.1.2), design must ensure that components cannot themselves jeopardize
safety-important equipment (e.g. by falling).
Calculations can be used to verify equipment behaviour under seismic loads(this method is used for concrete and metal structures). Full-scale testing on shaking
tables can also be used for components such as natural convection valves or electricalcabinets or even safety absorbers (to check their ability to be inserted into thecore zone in earthquake conditions, even if the core has been deformed by theearthquake).
Of the various equipment items that present potential hazards to safety-important equipment210, special attention is paid to handling cranes – particularly for research reactors whose core is directly accessible via the reactor pool (reactor
coolant system connected to the pool). If a handling crane or its trolley were to drop,
significant damage could be caused to the top part of a core, the instruments, absorber mechanisms, a pressurised circuit, reactor coolant pipe, natural convection valves,fuel elements or other components, and this could lead to a criticality accident orreactivity insertion accident, a sudden steam release or could prevent the safety absorbers from inserting properly into the core or the core from cooling properly. Some
French research reactors have a system that detects seismic loads over a specific level
and triggers a reactor scram, which reduces the consequences of an earthquake-driven
crane or trolley drop. This system can ensure that subcriticality is maintained, butcannot necessarily guarantee that the fuel elements will be properly cooled, sincethese elements may have suffered deformation. It therefore seems essential to prevent any cranes or trolleys from falling, regardless of the cause. Design and manufacture must comply with tried-and-tested best practices, in-service inspections must be
performed (including the statutory checks applicable to lifting plant and accessories),and operating rules must be complied with, to reduce any crane motions above at-riskzones to the strict minimum.

208.

209.
210.

ASN Guide 2/01 dated 26 May 2006 addresses the way seismic risks should be taken into
account in the earthquake-resistant design of basic nuclear installation civil works (with the
exception of long-term radioactive waste disposal facilities.
See note footnote 191.
Some cranes may themselves be treated as safety-important equipment, requiring the generalprovisions adopted for such equipment, for example in-service inspections, maintenance,
traceability of modiﬁcations, etc.

Safety principles for French research reactors

149

Improving knowledge on the behaviour of structures underseismic loading: handling cranes
It is not easy to predict the behaviour of a crane and its trolley under seismic
loads, with the potential to slip, slide and bump against its end buffers. There havebeen some difficulties in this regard during safety reviews, particularly when seismic motions were reassessed, leading to a significant increase in the loads to betaken into consideration. In the 2000s, IRSN and the CEA initiated studies on thisissue, including tests on the AZALÉE shaking table at the CEA Saclay research
centre (see figure 7.10). The focus of this work was to provide better understanding of the “response” of such complex structures to seismic motions, and to assess
the robustness of the simplified methods used by facility operators to design structures.

Figure 7.10. Handling crane undergoing testing on the AZALÉE shaking table at the CEA Saclay
research centre. © CEA.
...................................................................................................................................................................................................................

It should also be noted that there are systems that can be used to limit the motions
that will affect a building and its equipment in the event of an earthquake. For instance,
the reactor building basemat at the Jules Horowitz Reactor (JHR) on the Cadarache site,
in a region with a history of strong earthquakes, such as the Lambesc quake in 1909,
was laid on reinforced concrete bearing pads that were fitted with layers of elastomer
and steel (see figure 7.11). This system (referred to as “seismic base isolation”) reduces

150

Elements of nuclear safety – Research reactors

Figure 7.11. View of aseismic bearing pads during construction of the Jules Horowitz reactor (2009),
from “Le Blog des Énergies”. © DR.

high-frequency horizontal seismic loading211 for items such as floor-mounted equipment and handling cranes in the building. There is an obvious issue in keeping the bearing pads and elastomer layers in working condition throughout the duration of reactor
operation, given their potential for ageing. It is therefore necessary to ensure that thebearing pads and elastomer layers can be replaced if any anomalies are detected during
planned inspections.
JHR also includes a design provision that reduces impact risks from differential motions between the reactor building and auxiliary building. These two buildings, whichmake up the “nuclear unit” are built on the same basemat.
As stated previously, several French research reactors, such as MASURCA, RHF and
JHR, feature accelerometers that send a signal to the reactor protection system. If a
specific level of seismic loading is detected, the protection system triggers a reactor
scram early enough to ensure that the safety absorbers are inserted far enough into
the core zone when the bigger shocks come.
Research reactors are generally facilities with low sensitivity to weather-related
hazards such as extreme heat or cold. For many research reactors, residual heat removal
does not require any external heat sink other than the air, and their electrical power
211.

The adoption of this base isolation system increases the amplitude of accelerations at thesystem’s natural frequency (approx. 0.5 Hz). France has experience in this area, since the four
units at the Cruas-Meysse plant were installed on this type of base isolation system in 1977,
because the ground response spectrum at the site was above 2 Hz, the design spectrum EDF
adopted for its nuclear powerplants. AFCEN has published a document on such seismic baseisolation systems: “French Experience and Practice of Seismically Isolated Nuclear Facilities”,
PTAN RCC-CW 2015.

Safety principles for French research reactors

151

requirements can, if necessary, be reduced to mere monitoring of the main safety-important parameters.
Research reactor buildings are fitted with lightning conductors, and lightning arresters are fitted to the electrical installations.

7.5.

Experimental devices and research reactor-speciﬁc
equipment

One feature of research reactors is that they include experimental devices or equipment, some of which is placed right in the reactor core, or in nearby peripheral areas.
These devices and equipment items may include simple irradiation devices, more complex experimental circuits, neutron channels, “hot sources” and “cold sources”. As statedin section 7.1.2, any interactions between these devices and components and the reactor core have to be analysed from a safety perspective, both in normal reactor operating
conditions and in incident or accident conditions that could affect the reactor and theexperimental devices.
Analysis of any experimental device or component requires the various potential“danger sources” to be identified, which could, in degraded conditions up to and including the complete rupture of the device or component, or its “removal” from the corezone, have a negative impact on reactor safety or radiological protection. These danger
sources include fissile materials, absorbent materials, radioactive or toxic products,
products that may be explosive in air, products that may be violently reactive in water,pressurised liquids or gases and high-temperature materials that may enter into thermodynamic interaction with water in the reactor core.
Depending on the properties of their materials, experimental devices or equipment
may, in particular, modify core reactivity, since their materials may have neutron
absorption (poison), reflection or moderation properties. The reactor protection system
must therefore be capable of controlling any reactivity insertion in the core that could
be caused by an inadvertent movement, such as an uncontrolled withdrawal from thecore. For simple irradiation devices, this can be achieved through a design limit on thereactivity contribution of the relevant device or component; in such cases, the limit isalso included in the technical operating specifications. For larger devices whose reactivity contribution cannot be sufficiently limited, design provisions are required to preventor limit uncontrolled withdrawal (latching or hold-down devices).
For experimental loops, other risks may need to be considered, for example becauseof the use of pressurised fluids (e.g. to represent the conditions of pressurised water reactors – 155 bar [figure 7.12]) or reactive elements such as sodium which has a violent
reaction with water. These loops may also contain molten materials, when the studyof meltdown conditions is one of the objectives in an experiment on a fuel element.
Demonstration tests on mock-up assemblies may be necessary in order to assess theeffects of explosion of an experimental loop on the nearby fuel elements in the reactor
core. It is worth mentioning the OTHELLO loop for the OSIRIS reactor, which was
designed for studies on high-temperature reactors (HTR): in the mock-up assembly,
the loop had notches cut into it so that it would rupture at a given pressure.

152

Elements of nuclear safety – Research reactors

Figure 7.12. Schematic diagram of the pressurised water circuit in the CABRI reactor core. © Stéphane
Jungers/IRSN.

The “hot sources” and “cold sources” used in “neutron beam ouside” reactors
generally contain liquid hydrogen (H2) or deuterium (D2) in the first case and graphite
at more than 1,000 °C in the second. Any failure of the casing(s) of such equipment
would bring their contents into contact with water in the reactor core, causing a hydrogen, deuterium or steam explosion risk212 which could affect the core or the reactor
confinement barriers. To prevent this risk, the main strategies are firstly to ensure there
are “barriers” or casings of appropriate number and strength between the danger source
and the reactor core, and secondly to manage the specific parameters of these devices(e.g. deuterium pressure, temperature).
One final key point in the design of experimental devices or equipment is material
ageing. The materials will be subjected to neutron flux, which will gradually modify theirmechanical properties. This applies especially, in “neutron beam outside” reactors, tothe end parts of neutron channels (thimbles and their tips), which are constantly close
to the reactor core. Neutron channels are generally made of aluminium or an aluminium
alloy, or a zirconium compound such as Zircaloy. These materials are used for theirneutron “transparency”, but are weakened by exposure to neutron radiation. For thisreason, such equipment (thimbles or core boxes, for example) must be replaced as
appropriate during the service life of a research reactor. The effects of ageing can be
212.

Steam explosion risk from thermodynamic interaction between graphite at 1,000 °C and water.

Safety principles for French research reactors

153

anticipated by monitoring samples or specimens of the relevant materials that are
irradiated in areas closer to the core than the experimental equipment itself (or actuallyin the core). This can help define the required frequency of equipment replacement.

7.6.

Radiological protection and waste substances

7.6.1.

Radiological protection

The French system of radiological protection is based on three major principles,
which are part of the Public Health Code:– justiﬁcation of any activities that have a risk of exposure to ionising radiation;– optimisation of radiation exposure to the lowest level reasonably possible, taking
account of economic and social factors;– limitation of individual radiation exposure doses.
French regulations establish annual individual dose limits for members of the public
and workers (table 7.4).

Table 7.4. Exposure limits for members of the public and workers as a result of nuclear
activities, as stated in the French Public Health Code (Article R. 1333-8) and Labour Code(Article R. 4451-13).
Type of dose

Members of the
publicper year

Annual effective dose
Equivalent dose to the skin, forearm,feet and ankles (average dose per 1 cm² area)
Equivalent dose to the lens of the eye

1 mSv
50 mSv

Exposed workers(adults)
any twelve consecutive
months
20 mSv
500 mSv

15 mSv

150 mSv213

In addition, the Labour Code requires facility operators to determine regulated monitoring zones around any sources of ionising radiation. These zones are defined in the“Zoning” Order of 15 May 2006 (table 7.5).
There are a wide variety of sources of ionising radiation in a research reactor and its
related facilities, including fuel elements, neutron beams, start-up neutron sources,
calibration sources and sources used for X-ray inspections. Likewise, a variety of operating activities can cause exposure to radiation:
213.

The values given here are from ICRP Publication No. 60 from 1991. ICPR Publication No. 103
from late 2007 gives recommended values of 15 mSv for members of the public and 20 mSv forworkers. French regulations were reviewed in 2018 (Health Code, Environment Code, Labour
Code).

Elements of nuclear safety – Research reactors

154

Table 7.5. Limits for monitored and regulated zones deﬁned in the “Zoning” Order (excluding
natural irradiation).
Type of zone

ColourEffective doseFree access zone

< 0.080 mSv/mth

Monitored zone

< 0.0075 mSv/hControlled zone

< 0.025 mSv/hSpecially regulated controlled zone

< 2 mSv/h< 100 mSv/h

Prohibited controlled zone

≥ 100 mSv/h– reactor core loading or unloading,– loading, unloading or modifying experimental irradiation devices or circuits,– preparing fuel elements or assemblies, or irradiation or activation experiments,– performing measurements on irradiated materials or fuels,– in-service inspections, etc.
The facility operator uses analysis of the activities and of the characteristics of theionising radiation sources to categorise rooms in the facility into “free access”, “regulated”, “specially regulated” or “prohibited” zones, in which the above limits must becomplied with, through the implementation of technical and organisational measures.
Figure 7.13 shows some examples of physical protection that might be used. Concrete
blocks or lead walls are often used for this purpose (e.g. around the neutron guides inareas used by the physicists conducting experiments). For operations involving small
irradiated objects, concrete or lead bricks will be placed around objects to which accessis required, while still providing protection from ionising radiation. In some cases, operators may wear lead aprons.
In order to check compliance with the applicable dose limits, workers wear a measurement device appropriate to the nature of the ionising radiation at all times, providing ongoing exposure monitoring. Operational dosimetry214 is also used to warn them if
214.

Operational dosimetry, also known as active dosimetry, involves real-time measurement of
external exposure using a personal operational dosimeter. This device is provided and monitoredby the Radiological Protection Ofﬁcer under the responsibility of the Facility Manager. The
electronic system in an operational dosimeter means that the dose received by the worker can
immediately be read off. Measurements can be taken during a speciﬁc task or over a given duration(entry into a controlled zone). The devices have audio or visual alarm systems that are triggered if
predeﬁned doses are exceeded. This provides wearers with permanent information about theradioactive risk to which they are exposed. Wearers or the department responsible (using remotemonitoring) can track and optimise exposure levels during the period of exposure itself.

Safety principles for French research reactors

155

Figure 7.13. Effectiveness of various protections against different types of ionising radiation.
© Georges Goué/IRSN.

a predetermined dose rate is exceeded, or a predetermined dose is exceeded over a certain duration.
If any work has to be performed on the facility, a safety analysis is performed, which
includes a focus on radiological protection. A radiological protection optimisation study
is conducted, which aims to ensure that personal doses, the number of people exposed
and the likelihood of unplanned exposure during the work is kept as low as reasonably
possible, taking into account economic and social factors. The main stages of the study
are as follows:– assess exposure conditions, including potential exposure occurrences if theoperation does not take place as planned;– select an appropriate upper limit for the dose restrictions;– identify the possible protection options;– select the best option in the applicable circumstances;– implement the chosen option.
Operating experience is taken into account. The results are assessed, particularly inthe perspective of future operations of the same type.
Optimising radiological protection does not necessarily mean minimising doses.
Optimised protection comes as the result of an assessment and discussion, whereby
the risks of the anticipated exposure are compared with the resources available for personal protection. The best option does not necessarily mean the one with the lowest

Elements of nuclear safety – Research reactors

156

doses. Moreover, radiological protection is not just about individual exposure levels; thenumber of people exposed must also be taken into account. The collective effective
dose is a key parameter in optimising worker protection. When protection options
are compared to achieve optimisation, careful consideration should be given to the distribution of individual exposure levels within the population of exposed people.
The experimental equipment or devices themselves may also be sources of ionisingradiation. This is the case for example with experimental loops in which fuels are
subjected to transients that could lead to cladding failure or fuel melt, contaminating
the test circuits themselves. The components in these loops are fitted with biologicalshielding and specific handling equipment such as transfer casks are used to limit
ionising radiation within the facility.

7.6.2. Waste liquids and gases
The management of waste liquids and gases from research reactor operation is
generally similar to their management in any basic nuclear installation. However, two
specific types of waste deserve a mention in this context:– tritiated water produced from neutron capture by the deuterium in the heavy
water used in “neutron beam outside” reactors (RHF and ORPHÉE);– waste generated in experimental loops in which experimental fuel meltdown may
occur or even be targeted.
Specific arrangements are put in place to manage these specific waste products (atORPHEE, for example, there is a detritiation installation, and at the high-flux reactor in
Grenoble there is a heavy water drum unloading installation, with the heavy water treated in a different facility).
The releases of waste liquids and gases from French research reactors are given intable 7.6, along with the annual limits established by official orders or decisions.

7.7.

Emergency preparedness and management(crisis management)

Any significant release of radioactive substances that would require protection
measures to be taken for local populations (e.g. evacuation, confinement to closed
homes, distribution of stable iodine tablets, food restrictions) would mean that four
initial levels of defence in depth had failed or proved ineffective. Specific measures
are defined within the nationwide crisis management plans, which apply to all basic
nuclear installations, including research reactors. These plans are not described in detailhere215, other than to mention the aspects that are specifically relevant to research
reactors.
215.

See for example: “La gestion d’une crise nucléaire : des responsabilités partagées” on the ASN
website or “Face à un accident nucléaire”, IRSN, Livrets des professionnels Collection ‒ December
2008.

Safety principles for French research reactors

157

Table 7.6. Releases from two research reactors (RHF, OSIRIS-ISIS) and annual limits.
RHF
Maximum annual value
over 2010-2015 period
Gaseous waste (GBq)
Liquid waste (GBq)

Annual limits(Order dated 03/08/2007)

Noble gases
Tritium

1,200
12,000370

10,00075,0001,000

Carbon 14

460
0.3

2,000
1.5

Iodides

3.4 x 10−3
1.3 x 10−3

1
0.1

Other βγ emitters, aerosols

3.1 x 10−4
0.13
OSIRIS-ISIS reactors (INB No. 40)

0.1
1Type of releases

Maximum annual value
over 2010-2015 period
Gaseous waste (GBq)
Liquid waste (GBq) (*)

Annual limits(ASN Decision No. 2009-DC0156 dated 15/09/2009)

Noble gases

7,356
‒
297
3.4 x 10−3

10,000‒2,000
0.5

Carbon 14

1.14
7.6 x 10−4

20
10−2

Iodides

4.5 x 10−4

0.5

Other βγ-emitters

6.3 x 10−4
2.3 x 10−3‒
1.7 x 10−4

0.01
2 x 10−2‒
5 x 10−3

Type of releases

Tritiuma-emitters(*)

Liquid waste released into the chemical waste system. Active liquid waste is also sent to the Saclay andMarcoule treatment plants.

Crisis management measures include “on-site emergency plans”, which the facility operators are responsible for activating, and “off-site emergency plans” which are
the responsibility of the public authorities. These emergency plans were generally
initiated in the early 1980s, following lessons learned from the 1979 Three Mile Island
nuclear powerplant accident in the USA216. In the case of research reactors operatedby CEA, the relevant Director of the centre or his/her representative (or the On-CallCentre Manager outside working hours) is responsible for activating the “on-site
emergency plan”. In the case of the RHF, this responsibility falls to the Head of Reactor
216.

See document quoted in footnote 129.

Elements of nuclear safety – Research reactors

158

Division at Institut Laue-Langevin or his/her deputy (or the On-Call Duty Engineer).
Whatever the circumstances, the authorities must be alerted within two hours at thelatest.
The on-site emergency plan ‒ some aspects of which are based on a “design study”
included in the safety report (see below) ‒ defines organisational measures, intervention methods and the necessary means to be implemented by the facility operator in
emergency situations, in order to protect staff, the public and the environment fromionising radiation and to maintain or restore facility safety. It may also specify procedures for implementing measures that are the facility operator’s responsibility under theoff-site emergency plans (alerting and sheltering in “reflex mode”).
If a facility operator implements its on-site emergency plan, it must regularly
provide updates on its accident-stricken facility and issue a prognosis anticipating
potential developments of the situation. This information is shared and discussed with
the French Nuclear Safety Authority and IRSN. One of the “crisis management tools”
is the so-called 3D-3P diagnosis and prognosis approach217 developed in the 1990s by
IPSN and EDF for French nuclear powerplants. In principle, it is applicable to French
research reactors. However, it needs to be adapted in a few ways in order to take
into account their specific features, including their layout and the number of confinement barriers.
There are other “crisis management tools” (in addition to simplified simulation
software – see chapter 11), including summary documents on “standard accidents”.
Based on facility characteristics and the associated risks, facility operators responsible for research reactors consider one or more representative accidents (or “standard
accidents”) and plan crisis management measures to manage such situations. These“standard accidents” are selected from the accidents studied in the safety demonstration and presented in a chapter of the Safety Report218 entitled “On-site Emergency
Plan Design Study”. These “standard accidents” represent the various potential dangers
for the facility and are not only radiological dangers (accidents entailing chemical-related consequences may for instance be included). BORAX-type accidents are included in these “standard accidents” for many French research reactors, because theylead to core melt and overpressure in the reactor building, which could cause releases
into the environment. Less severe accidents may also be included as “standard
accidents” in the on-site emergency plan219, including:– cladding failure on a fuel plate under water, in the reactor core;– a fuel plate melting under water, in the reactor core;– a fuel element melting in air in the reactor building during reactor core unloading;

217.
218.
219.

The number “3” refers to the three conﬁnement barriers in pressurised water reactors.
As required by Decree No. 2007-1557 dated 2 November 2007, known as the “procedures”
decree.
With reference to INSAG-10, a facility operator (in France) may make the decision to activate
the on-site emergency plan for accidents that come under defence in depth level 3. (BORAXtype accidents come under level 4).

Safety principles for French research reactors

159– drop of a transport package containing multiple fuel elements, etc.
Some “standard accidents” may assume multiple internal failures or the occurrenceof a natural hazard more intense than that considered in facility design.
In the event of an accident involving significant fuel damage, operating staff and researchers in the reactor building and adjacent rooms, such as the control room, may haveto be evacuated, due to the dose rates generated. Direct radiation exposure outside thereactor building may also be significant in the event of a core melt incident in air (e.g. core
uncovery) or if a fuel element melts during handling in the reactor building. For this reason, French research reactors all have emergency control rooms located at a safe distancefrom the reactor, given the dose rates that could be generated by the accident-stricken
facility. This emergency control room includes information required for accident management (neutron and thermohydraulic parameters in the reactor core, water levels, dose
rates, real-time measurement of activity released through the stack, etc.). Some facility
systems can also be controlled from this location, such as the emergency ventilation
system, which can be used to “manage” atmospheric releases in accident conditions.
Summary documents are produced and updated for different “standard accidents”(by IRSN in particular). These documents specify the potential consequences of theaccident, with different variants depending on the weather conditions, time between
reactor shutdown and the accident220, ventilation systems configuration and possible
aggravating factors under the “prognosis” part of the 3D-3P method (e.g. iodine filtersin operation or out of service).
Summary sheets describing the research reactors are also available to the crisis
management teams, specifying the radiological inventories in the cores and spent fuelstorage pools, and the characteristics of confinement barriers and ventilation and filtering systems, etc. These sheets are vital for research reactors, since a relatively small
number of people have genuinely in-depth knowledge of these reactors.
The public authorities will analyse the conditions for evacuating or confining local
people to their homes, under the “off-site emergency plans”. Alongside these plans,
short-, medium- or long-term measures to control the consumption or sale of potentially-contaminated foodstuffs are also prepared. The local Prefect is responsible for
deciding on the implementations of such measures.

7.8.

Safety aspects for decommissioning research
reactors

Under the applicable regulations, the facility operator responsible for a research
reactor now has to present the general principles and provisions for future facility
decommissioning in a “decommissioning plan”, at the time of the construction licenceapplication. The information in the plan must, where relevant, be updated at the time of
the facility commissioning application and at the time of safety reviews. Finally, as for
220.

This time period will determine the residual power to be considered, which generally reduces
exponentially over time.

160

Elements of nuclear safety – Research reactors

any basic nuclear installation, any facility operator that plans dismantling of a research
reactor must file a specific application at the appropriate time.
In France, several research reactors have already been dismantled, including theStrasbourg University Reactor (RUS) and HARMONIE; the SILOE reactor at Grenoble
has now been fully dismantled and the ULYSSE reactor in Saclay is at an advanced stageof dismantling. Some other reactors are currently being dismantled. The strategy is toaim for “immediate” dismantling221 after final reactor shutdown, in order to draw asmuch as possible on the skills and knowledge of operators who are still present. The
dismantling of the PHENIX reactor has therefore been ordered, following on from thedecision by the CEA to shut it down.
Current regulations emphasize the need to take decommissioning into account as
early as possible in the life of a facility – from design phase – in order to facilitate dismantling operations and minimise the related risks. With this in mind, it can be notedthat the complete removal of the reactor vessel was planned as part of the design of“neutron beam reactors” such as ORPHEE and the RHF.

221.

ASN Guide No. 6 (revised version dated 30 August 2016) on INB ﬁnal shutdown anddecommissioining quotes the French Environmental Code, which requires the licensee
responsible for operating a basic nuclear installation to “start decommissioning work as quickly
as possible, in economically acceptable conditions and in compliance with the principles set forthin Article L. 1333-1 of the Public Health Code and in Article L. 110-1, paragraph II hereof”.

Chapter 8
The reference accidents selected
for French research reactors
8.1. Deﬁnition and examples
The reference accidents222 considered for French research reactors are accidents ofinternal origin (e.g. equipment failure, errors) that are considered likely to have the most
severe consequences on the integrity of the fuel elements or the entire reactor core.
They are very improbable in nature as they assume the occurrence of multiple failures.
For some of them, reactor scram (insertion of absorber elements into the core) failure isassumed223, or is considered ineffective given the rapidity of the accident.
The reference accidents adopted for French research reactors are primarily reactivity
insertion accidents224 in the core. Others may be loss of coolant or fuel element uncovery.
222.

223.

224.

The meaning of the expression “reference” for these accidents in (French) research reactors isdifferent from that of the reference transients, incidents and accidents deﬁned in the “technicalguidelines for the design and construction of the next generation of nuclear power plants withpressurized water reactors” established by the GPR and German experts, and used for the EPR.
These “reference” transients, incidents and accidents are broken down into four categories,
depending on the estimated frequencies of the groups of events they represent; they correspondto the “operating conditions” of categories 1 to 4.
Transients with reactor scram failure are also known as ATWS (Anticipated Transients Without
Scram) according to English terminology used for power reactors. They were studied following
the Three Mile Island accident in 1979.
Readers are reminded that the expressions “insertion”, “injection”, “introduction” or “input” areused synonymously. The expression “power excursion” refers to the power transient caused by
the insertion of reactivity.

Elements of nuclear safety – Research reactors

162

Reference accidents contribute to the very design of reactor containment, or at least
verification of the design choices adopted for containment. Other external loads are taken into account for containment design or verification, including earthquakes, planecrashes, external explosions, etc. The term containment covers the third confinement
barrier, consisting of the reactor building superstructures above and, depending on
the configuration, below, the floor of the reactor pool or pools and underground rooms,
the basemat, and the systems and equipment involved with dynamic confinement, suchas ventilation systems, discharge filtration systems, etc. Other system penetrations (e.g.
Systems contributing to reactor cooling) should also be taken into account. At the design phase, studies precisely define the functional requirements and technical characteristics of equipment contributing to reactor containment: thickness of concrete walls,
rebar ratio, cable prestressing values, thickness of metal coatings for reactor pools,
materials used, types of welds selected, ventilation rates, efficiency of filtration systems
before discharge into the environment, etc.
For pool-type reactors using fuel composed of uranium and aluminium225 (OSIRIS,ORPHEE, high-flux reactor in Grenoble, JHR), a BORAX-type accident - whose main aspects will be outlined in the following sub-chapter - constitutes a reference accident.
However, other reference accidents may also be studied for these reactors: clogging
of water channels located between the fuel plates, a fuel element melting in air (during
handling or core uncovery); these are then not reactivity accidents, but cooling accidents, resulting in fuel melt more or less quickly. Fuel melt in air accidents generally
have the greatest radiological consequences (external radiation through the containment building, transfer of radionuclides into the environment); these accidents draw
more on the containment capacity of the reactor building with regard to its superstructures, whereas BORAX-type accidents generally226 put more stress on the walls of thereactor pool.
For a reactor like the RHF located in the immediate vicinity of the city of Grenoble,
the results of studies of reference accidents (meltdown of fuel underwater, meltdown offuel in the air) are especially important for assessing the acceptability of the installation’s design, particularly the containment building and associated systems.
The reference accidents currently227 selected for French research reactors, otherthan pool-type reactors, are listed briefly below.

" EOLE and MINERVE reactors
For the EOLE reactor, the reference accident selected is the inadvertent lifting of acontrol absorber while the reactor is in operation, with supposed reactor scram failure(absorber not inserted into the core). The resulting reactivity insertion does not lead tofuel meltdown (UO2).

225.
226.
227.

Section 2.1 showed that all UAlx, U3Si2 and UMox formula fuels also contain aluminium, added at
the end of the grinding operation with the fuel powder.
Except for a BORAX-type accident, in the event of the possibility of a spray of water or water
hammer under the reactor building dome.
They have changed in line with safety reviews.

The reference accidents selected for French research reactors

163

For the MINERVE reactor, the reference accident selected is reactor criticality (startup) with an abnormally constituted assembly (too powerful), loaded erroneously into
the reactor core, with reactor scram failure. This leads to the insertion of 1,000 pcm inapproximately 1 second, without leading to fuel meltdown.

" MASURCA reactor
For the MASURCA reactor, the reference accident selected is reactor criticality with
an abnormally constituted assembly (too powerful), loaded erroneously in the largest
considered core for the reactor228, with reactor scram failure. Reactivity insertion is
4.9 $229 in 10 seconds. The facility operator had initially considered that this scenario
could be excluded given the successive failures it assumes, but IRSN maintained that
this was difficult to justify, given that its prevention is primarily based on provisionsof an organisational nature. This type of accident does not lead to fuel meltdown,but, given the temperatures reached, the solid sodium of rodlets or platelets melts230.
Given the large number of these rodlets or platelets in the reactor core, IRSN considered that it is not possible to exclude the presence of latent defects in some of theircladding. The ejection of liquid sodium from these strips would then lead to a sodium
fire in contact with the core cooling air. Ultimately, the radiological (and chemical)
consequences of the accident were assessed on the assumption of a fire involving
1% of the sodium present in the reactor core. The cladding of the fuel rodlets or platelets located close to the sodium strips on fire is assumed to be defective, leading to arelease of radioactivity (representing approximately 4 TBq) into the reactor building(including fission products). Assessment of the radiological consequences of this typeof accident in the environment led the French Nuclear Safety Authority (ASN) to
ask the facility operator to study various provisions intended to reduce them (management of the containment building ventilation, back-up ventilation, leakages grouping,etc.) and assess the toxic risks due to sodium aerosols, particularly for operators required to perform rounds in the installation before launch of the sodium fire extinction
system using argon.

" CABRI reactor
The reference accident selected for the CABRI reactor is an overpower accident during operation, resulting from the simultaneous failure of four helium 3 rod pressure-relief valves (two “quick” opening valves and two “slow” opening valves - see section 5.2),
with reactor scram failure, leading to an insertion of reactivity of 2,100 pcm in 20 ms.
The reactor power increases to a peak of around 25 GW, after which neutron feedback
results in a rapid decline in power. Study of the scenario by the operator shows that the

228.
229.

230.

It is possible to load different-sized cores into MASURCA.
For fast neutron reactors or the MASURCA mockup, which use plutonium, reference is often
made to the “dollar” ($), which corresponds to the proportion of delayed neutrons (seesection 7.1 which gives some values for different types of reactors and fuels). For reactivity
insertion, this is the reactivity threshold beyond which a chain reaction reaches criticality byprompt neutrons alone.
Sodium melts at a temperature of approximately 98 °C.

Elements of nuclear safety – Research reactors

164

temperature of the fuel rods increases but does not reach UO2 meltdown temperature231 and that the mechanical criteria selected for the risk of cladding failure are
not reached during the transient.

8.2. BORAX-type accident – main aspects
The BORAX-type accident has been selected in France as the reference accident forpool-type research reactors using uranium- and aluminium-based metal fuel in the formof plates (cores), contained between two thin aluminium sheets, which serve as cladding. For this type of fuel, meltdown begins with aluminium at 660 °C.
The 1961 accident in American reactor SL-1 (Stationary Low Power Reactor Number
One) and experiments conducted in the USA in the 1950s and 1960s demonstrated thatin the event of a sudden and significant input of reactivity, these types of reactors may
be subject to explosive phenomena resulting from the degradation or fast meltdown ofpart of the reactor core. Since then, this type of accident has been called a BORAX-type
accident, named after the (five) reactors of the same name at the ANL (Argonne
National Laboratory) in the state of Idaho (National Reactor Testing Station), whichwere used to conduct experiments into this type of accident.
The circumstances surrounding the accident on Reactor SL-1 are summarised briefly
below, with the lessons learned. The phenomena involved in this type of accident andthe way in which they are taken into account for the design of pool-type research reactors232 will then be explained.

8.2.1.

Accident at the SL-1 reactor

The SL-1 reactor was a US Army experimental reactor built at the theIdaho National Laboratory (INL) site, approximately 65 km west of Idaho Falls, as part ofa programme seeking to develop power reactors to supply electricity to remote sites, suchas surveillance radar stations. It was commissioned on 11 August 1958. The reactor’s maximum thermal power was 3 MW and it was capable of electricity output of 200 kW. The
reactor core consisted of approximately one hundred uranium- and aluminiumbased plates, with aluminium cladding, and grouped into fuel assemblies; the fuel was
manufactured at the Argonne National Laboratory. The uranium was enriched to 93% inisotope 235. The reactor had nine cadmium-based absorber rods. The water in the (closed)
reactor vessel served both as coolant and moderator.
In late December 1960, the decision was taken to perform maintenance on the absorber rods following various jamming incidents affecting these rods. The reactor was
shut down to carry out this maintenance; the rods were placed in the low positionand disconnected from their control mechanisms.
231.
232.

It will be seen in section 10.1.1 that slow ramps were in fact more damageable for the fuel that
pulses, that was not identiﬁed, but there will be no more slow ramps in CABRI.
For more detail, please consult the following document drawn up by IRSN in 2011: Considerationof BORAX-type reactivity accidents applied to research reactors, Reference documents series,
IRSN 2010/128, available at https://www.irsn.fr/EN/Pages/home.aspx.

The reference accidents selected for French research reactors

165

On the afternoon of 3 January 1961, after maintenance operations had been completed, a team reconnected the mechanisms to their respective rods in order to restart
the reactor.
At 9 pm, alarm signals from the reactor building sounded at three fire stations.
These alarms did not make it clear whether the problem was a fire or an abnormal radiation level. Upon their arrival on site, the emergency response teams could not detectany visible signs of damage or fire. However, very high dose rates were detected at theentrance to the reactor building, with values of around 1,000 rad/hour (10 Gy/h) in thereactor hall. Two people were found motionless near the reactor, while the third had
been projected and pinned to the ceiling of the building by one of the absorber rods.
Two of the three men were killed instantaneously, while the third died two hours after
the accident, while being transferred to hospital.
The inspections performed with the support of a robot concluded that only the central absorber rod had been ejected. The other absorber rods had remained inside thecore, which had suffered major radial deformation. A radiation shielding plug had beenejected onto the ceiling of the building. The state of the core can be seen in figure 8.1.
The vessel and the reactor building both withstood the accident.

Figure 8.1. View of the SL-1 reactor core after the reactivity accident in 1961, three of the rod
mechanisms are visible. @ INL.

The most widely-accepted theory to explain the accident is that an absorber rod got
stuck and one of the operators decided to free it manually, but withdrew it too far. The
rod was raised too high, exceeding the limit above which chain reaction runaway becomes
uncontrollable, thus leading to the reactor explosion. Mainly due to the presence of ashort-lived yttrium isotope found on the dead operators’ clothing, it has been estimatedElements of nuclear safety – Research reactors

166

that the reactor power may have surged to around 20,000 MW during the accident233.
Given the damage observed, it was estimated that the vessel pressure exceeded 30 bars.
It took over a year to decontaminate the SL-1 reactor building. All debris from thereactor was fully removed and the building was demolished in 1962.
The most exposed members of the rescue crew received an estimated dose of 30 rad(0.3 Gy). There were no significant radiological consequences outside the building,which contained almost all (99.99%) of the radioactivity (figure 8.2). Downwind of
the SL-1 reactor, the radiological impact on plants remained low and no groundwatercontamination was detected.

Figure 8.2. Measurement of ground contamination near Reactor SL-1. @ INL.

The data available regarding this accident shows that, in addition to ensuring radiological protection of crews, one of the main concerns of the people in charge of organising the emergency response was to avoid any risk of a second nuclear accident, by
ensuring that there were enough absorber rods in the reactor core and that there
was no danger of the ejected plug falling back down on top of the reactor.

8.2.2.

Key lessons learned from the SL-1 reactor accident

The accident that occurred in the SL-1 reactor, together with tests carried out in the
USA in 1954 in the BORAX-1 reactor and then in 1962 in the SPERT-1 reactor (seetable 8.1 at the end of this chapter) showed that in the event of a sudden and significant
input of reactivity, water-cooled research reactors that use uranium- and aluminiumbased fuel may be subject to the following two explosive mechanisms resulting from

233.

With a total of 1.5 x 1018 ﬁssion reactions.

The reference accidents selected for French research reactors

167

the degradation or fast meltdown of part of the reactor core (the two mechanisms could
potentially co-exist):– sudden water vaporisation (steam explosion),– sudden aluminium vaporisation.
These phenomena can result in the creation of shock waves and the expansion of
bubbles in the reactor coolant, and for pool-type reactors, in the pool. These bubbles
may contain non-condensable gases (e.g. hydrogen resulting from the oxidation ofaluminium or experimental devices), which could amplify the mechanical effects ofthe expansion of steam bubbles – leading to a mechanical “impulse234” on structures.
This type of accident may lead to:– signiﬁcant damage to the reactor block, reactor coolant system and reactor poolwalls;– damage to the lower part of the containment (bottom of the reactor pool), due tothe thermal effects of the molten materials accumulating there;– water transfer into the reactor building due to a steam explosion, which may
impact the reactor building ceiling (“water hammer” effect) before falling backinto the reactor pool. Part of this water transferred into the reactor building may
be projected in the form of a water spray;– an increase in atmospheric pressure and temperature in the reactor building,particularly due to thermal exchanges with the water spray, volatile ﬁssion
products and noble gases released into the building, and potentially any fuelfragments or particles released;– very high dose rates inside the reactor building and potentially outside;– radioactive discharge into the environment.

8.2.3.

Consideration of the BORAX-type accident in France

8.2.3.1

General considerations

In France, the possibility of a BORAX-type accident has systematically been taken
into account in containment design for water-cooled research reactors operated using
uranium- and aluminium-based fuel.
Consideration of this type of accident includes:– deﬁnition of the provisions intended to make it highly improbable, considering all
possible initiating events of an insertion of reactivity into the reactor core;– determination of an envelope accident to deﬁne the potential consequences
within the installation itself;

234.

Characterised by a pressure time proﬁle, with the peak value and duration.

168

Elements of nuclear safety – Research reactors

Figure 8.3. Top, diagram of the BORAX-1 reactor. © All rights reserved. Bottom, photograph taken
during the ﬁnal destructive testing of the BORAX-1 reactor. © Argonne National Laboratory (creative
commons).

– assessment of these consequences in order to check compliance with thenecessary functional requirements in such a situation for the different equipment
items that contribute to maintaining the core underwater (after the initial phaseduring which a spray of water may be produced) and containment (reactor
building, liners and pools, ventilation and ﬁltration systems, and post-accident
cooling systems, etc.).

The reference accidents selected for French research reactors

169

In order to ensure robust reactor containment in the event of a BORAX-type accident, the characteristics selected for this accident must be sufficiently conservative or
fall under an envelope approach.
Examples of the initiating events considered are the ejection of one or more absorbers elements and reactivity insertion associated with the inadvertent removal of anexperimental absorbing device.
Consideration of a BORAX-type accident in the design of pool-type research reactors operated using uranium- and aluminium-based fuel remains necessary when a reactivity accident is possible. In this respect, it should be noted that:– the reactors in question are installations whose purposes require them to offer avariety of uses so that they can be used to carry out experimental programmes,
produce radioisotopes, etc., often at the same time. Many operations can be
performed in the reactor core or nearby;– these reactors can undergo changes in their purposes or equipment over time.
The chosen experiments may require the installation of dedicated support
systems, which may create risks that were not explicitly considered during initial
reactor design (e.g. use of pressurised gas). Consideration of a BORAX-type
envelope accident at the initial design stage makes it easier to implement suchchanges at a later date;– these reactors may use speciﬁc equipment for which there is no reliable data orvery little operating feedback;– for some of these reactors, organisational and human factors can have particularimportance for the prevention of incidents and accidents. Although lessons werelearned from the Reactor SL-1 accident and major accidents affecting powerreactors (particularly Three Mile Island and Chernobyl), the possibility of humanerror remains and the chances of recovering from such errors are difﬁcult toassess. More generally, it is difﬁcult to determine the robustness of organisationallines of defence. Finally, as stated in section 7.2.3, the co-existence of two typesof personnel in the installation (facility operators and scientists), each with theirown objectives, creates a complex situation, particularly during experimental
phases where both types of personnel are in constant interaction.

8.2.3.2.

Key aspects and parameters

A certain number of aspects and parameters associated with a BORAX-type accident
are of prime importance in the design of a pool-type reactor operated using uraniumand aluminium-based fuel:– determination of the thermal energy “deposited” in the reactor core, which isintended to form an envelope for potential reactivity accidents in this reactor;– conditions for triggering a steam explosion by heat transfer between the molten
fuel and water;– assessment of the potential resulting pressure;

170

Elements of nuclear safety – Research reactors– assessment of thermomechanical loads (shock waves, water thrust associatedwith the expansion of bubbles, etc.) on structures contributing to containment(including the pool), and any potential resulting damage;– post-accident cooling of molten materials that may ﬂow to the bottom of thepool or into the lower parts of the reactor building through singularities (absorbermechanism penetrations, etc.);– the risks of a second reactivity accident (“recriticality” or “return to criticality”),
particularly by (molten or solid) fuel shufﬂing;– the corresponding radiological consequences following the transfer of radionuclides from the core into the building housing it, and then from said building into
the environment.
As for core meltdown accidents in pressurised water reactors, it is complex tocharacterise and quantify the various consequences of a BORAX-type accident due tothe large number of simultaneous equipment geometry phenomena (reactor core tankor vessel, reactor coolant system, reflector, experimental systems, pool liner, poolconcrete walls, etc.). Therefore, in order to determine the validity of the fundamental
assumptions adopted for the design of elements that contribute to the confinementof radioactive substances, during the design phase of a new reactor, one approach is
to use specific assessment tools – using sufficiently conservative assumptions – for eachof the effects of the accident, each considered separately (shock waves and expansionof bubbles on the side walls of the pool, “water hammer” and water spray on the top
part, radiological consequences in the environment, etc.), in order to estimate theseeffects with sufficient margins.
Some effects may not be taken into account, for example a spray of water or “water
hammer” under the ceiling of the reactor building, if based on representative experiments.
For this publication, only two important aspects of a BORAX-type accident will be
developed: the “deposition” of thermal energy in the reactor core and the steam
explosion, by stating the main points of concern for each aspect.

" The notion of energy deposition in the reactor core
The power transient resulting from the insertion of reactivity in a reactor core canbe characterised by various parameters: maximum power reached, transient duration
until return to initial conditions, or the total power integrated for this duration, whichcorresponds to what is generally referred to as the (thermal) energy deposited in thereactor core. This final parameter is especially important in design studies for a research
reactor where the possibility of a BORAX-type accident is considered, as it largely
determines the scale of the potential resulting steam explosion, and therefore theconsequences for the reactor and especially the elements contributing to its containment.
It should be noted that for the last research reactors built in France in the 20th
century, i.e. the RHF at Grenoble and then the ORPHEE reactor at Saclay, an “inclusive”
approach was adopted: an energy deposition of 135 MJ was selected, which corresponds

The reference accidents selected for French research reactors

171

to meltdown of the entire reactor core, which is assumed to reach a temperature ofaround 800 °C during the reactivity transient. At the time of the design of these reactors, these values were considered to offer reasonable envelope values, on the basis oflessons learned from the SL-1 reactor accident and tests carried out on the BORAX-1
and SPERT-1 reactors.
The thermal energy must be calculated on the basis of the reactor specifics, in particular the quantity of fuel in its core, especially considering that experimental data for
a BORAX-type accident, which is mainly taken from feedback from the Reactor SL-1
accident and tests conducted in the BORAX-1 and SPERT-1 reactors, does not demonstrate any phenomena that should limit energy deposition in the reactor core during theaccident at a generic value, independent of the reactor characteristics. Energy deposition is heavily dependent on the reactivity inserted, the kinetics by which it is inserted,
neutron feedback and the quantity of fuel in the reactor core. The energy value adopted
in the end must be an envelope value that offers sufficient margins to ensure therobustness of reactor containment under the various potential reactivity insertion scenarios, which of course must take in to account the provisions adopted for reactivity
control (substantiated by tests where necessary).
It should also be noted that the oxidation of aluminium in the reactor core during
the accident may lead to a very high increase in thermal energy in the pool water, which
could modify the scale of the steam explosion. This is also true for the potential
exothermic destruction of “heat sinks” and “heat sources”.

" Steam explosions
A steam explosion is assumed in reports on the destructive tests carried out in the
BORAX-1 and SPERT-1 reactors and the Reactor SL-1 accident.
A steam explosion can occur through contact between two liquids, between themolten fuel, which is extremely hot, and the coolant, which is cold and volatile. Thisis an interaction of a thermodynamic nature, with complex trigger conditions. It leads
to the fragmentation and solidification of the molten materials and the vaporisation of
the cold liquid.
The scale of a steam explosion depends on multiple parameters, in particular:– the total quantity of energy potentially mobilized: the thermal energy deposited,as mentioned above (fraction of molten core and its temperature), in addition to
the energy contributed by the oxidation of aluminium and any energy released
through the destruction of experimental systems, in particular “hot sources” and“cold sources”;– the duration of thermal exchanges between the molten materials and water.
Although the experimental observations demonstrate that an explosive thermodynamic interaction between molten fuel and the coolant does not occur systematically,
it remains necessary to consider the possibility of such an interaction when moltenmaterials come into contact with coolant in liquid state.

172

Elements of nuclear safety – Research reactors

The steam explosion may lead to the propagation of shock waves and the movement of masses of water by the surge of the steam bubble expanding. These phenomena may lead to:– deformation or failure of structures and equipment: metal casing surrounding thereactor core, the upper core plate and reactor coolant piping, experimental
systems located around the core, equipment in the pool, the reactor pool liner,
sluice gate (cofferdam) between the pool and a transfer channel, etc.;– the ejection of a mass of water in the reactor building, potentially with a “water
hammer” effect on the building dome.
Special attention must be paid to the potential mechanical effects of thermodynamic interactions between the molten materials and water for each reactor studied,depending on factors such as the hydrostatic pressure of the water in the reactor corepool (water level above the core), the volumes and inertia of masses of water liable tobe moved, the stiffness and inertia of internal metal structures and the pool liner, etc. In
this respect, the stiffness of the “environment” around the interaction zone may differ
depending on the direction. For example, water movement in an upwards direction
would be preferential.
The shock waves produced by the steam explosion cause pressure spikes on thepool walls, which can reach extremely high levels of several dozen bars, but for very
short durations (around 10 ms). The expansion of the steam bubble generates a longer-lasting pulse. These two types of mechanical loads need to be studied on a case-bycase basis, without excluding either of them, depending on the characteristics (inertia,
stiffness, etc.) of the elements comprising the pool of the reactor being considered(very thick concrete walls, thin metal liner, whether or not it is attached to the concrete walls, etc.).
Protection of the pool walls and bottom may be strengthened:– by leaving an empty space between the liner or reactor vessel and the pool walls
axially to the core. This provision enables mechanical energy to be absorbed bydeformation of the liner or vessel, which reduces stresses on the pool structure(provision adopted for the SILOE, ORPHEE and JHR reactors);– by installing deformation-based energy absorption mechanisms, e.g. metal plates
on “resilient bearing pads” at the bottom of the pool (as adopted for the SILOE
reactor). For the Jules Horowitz reactor, a metal plate is placed on the ceiling of
the absorber mechanisms vault; measures (“provisions”) have also been taken to
install shock absorbers (honeycomb structure type) in the reactor pool to protect
its side walls.

8.3. Demonstrative testing conducted in France
The quest for a robust research reactor design with regard to reference accidents
may lead to the use of various types of testing in addition to assessments carriedout using numerical simulations. This is especially true where inherent limitations in

The reference accidents selected for French research reactors

173

the simulation and tools used appear, for example, when it is impossible to correctlymodel structure singularities. But this generally raises delicate questions regarding
the similitude235 sought and the representativity of testing.
These kinds of tests were carried out for French research reactors, for various aspects related to reference accidents (see table 8.2 at the end of this chapter), focusingon:– for the high-ﬂux reactor in Grenoble, specifying the variation kinetics in the core
reactivity in the event of switching from light water to heavy water in the core:
tests were carried out on the reactor itself using heavy water mixed with lightwater at various concentrations;– for the Jules Horowitz reactor, determining, with a mockup, the speed at which anabsorber is raised in the event of accidental ejection due to failure of the control
mechanism;– for the ORPHEE reactor, ensuring, with the use of in-basin testing236, properpool resistance at the horizontal neutron channel penetrations (pool liner by
the channel penetrations, safety “windows” and valves on the thimbles – seesection 7.3.2) in order to ensure that the core would not be uncovered due to lossof neutron channel watertightness in the event of a BORAX-type accident. The
tests involved subjecting the abovementioned equipment (on models at a scale of
1/10 for liner resistance tests and 1/2 for channel watertightness mechanisms) toa water pressure wave (from an “air canon” or rapid expansion of a volume ofcompressed air), representative of a BORAX accident – expansion of a steam
bubble initially at 40 bars with a volume of 4 m3;– checking the overall behaviour of structures in the event of a BORAX-type
accident. For example, a test was conducted using an explosive (TNT) on a
1/3 scale model of the OSIRIS reactor (table 8.2).

235.
236.

Various similitudes are possible: structure deformation, structure displacement, etc.
Carried out by SODERA (Société pour le développement de la recherche appliquée) in its
laboratories.

174

Table 8.1. Some characteristics and observations concerning the SL-1 reactor accident and power excursion tests conducted in the SPERT and BORAX
reactors.
Description

Totalmass of
Al/U (kg)Reactivity
inserted
($)3

Power
spike (MW)

Thermalenergydeposited(MJ)

Chemicalenergy released(MJ)

Max. fueltemperature(°C)

Pressure
spike (bar)Damageobserved toreactor core

BORAX–I

Destructive
test

100/4.2

3.1< 19,000

135

Undetermined< 1,800

400 - 700

Extensive core
meltdown

SL–1

Accident

189/143.0~ 19,000

133 ± 1024 ± 10> 2,075700~ 20 % of coremelted~ 2 % of corevaporised

SPERT–I

2 ﬁnal nondestructive tests

51/3.8

2.6

1,130

11

−

585

0.5

2.7

1,270

19

−

680

0.5

~ 0,5 %of core melted~ 2 % of coremelted

3.55

2,250

31

3.5

1,360

< 300

Destructive
test~ 35 % of coremeltedElements of nuclear safety – Research reactors

Reactor

The reference accidents selected for French research reactors

175

Table 8.2. Simulation testing on models of a BORAX-type accident for French research reactors.
ReactorOperating
power

Structure
characteristics
Pool

Reactor building

Model
scale

Structures
studiedTRITON

6 MW

Prestressed
concrete

Concrete building
with glass windows

1/5

Pool and effect of
the spray of wateron the building

MELUSINE

8 MW

Prestressed
concrete, withsteel
liner in thecompartment
containing thecore

Concrete building
with observation ports

1/3

Pool and neutron
channels

SILOETTE

100 kW

Steel vessel
contained inordinary solid
concrete

Metal
containment

1/3

Pool and neutron
channels

OSIRIS

50 MW

Reinforced
concrete withsteel liner

Concrete building
with observation ports

1/3

Pool, core support
structure and effectof the spray of water on
the buildingChapter 9
Maintaining compliance with theapplicable requirements– Safety Reviews
9.1. Maintaining compliance with the applicablerequirements, managing obsolescence and ageing
Nuclear facility compliance with applicable requirements must be maintained overtime. A specific chapter of the General Operating Rules (GOR) is dedicated to periodic
inspection and testing which helps verify compliance. This periodic inspection andtesting (defined for safety-important elements 237 ) is supplemented in preventive
maintenance programmes, which help avoid the preventive replacement of certain
equipment.
Periodic inspection and testing targets two specific types of potential difficulty for
research reactors, due to their service life, which can be very long, to their conditions for
operation, which can be discontinuous, and to the high neutron fluxes in somestructures. These difficulties are:237.

Hereinafter EIP: as per French Order of 7 February 2012, as amended, setting the general rules
relative to basic nuclear installations, an EIP is an Element Important for Protection of theinterests mentioned in Article L. 593-1 of the French Environment Code. This element
contributes to the prevention of risks and drawbacks associated with public security, health andsafety or the protection of nature and the environment.

Elements of nuclear safety – Research reactors

178– equipment obsolescence: on this topic, research reactor instrumentation andcontrol systems dating from the 1970s - 1980s were fully renovated in the late
1990s, including the implementation of programmed software systems (“SIREX
racks”);– the ageing of structures and other equipment (cables, polymer materials, etc.); forexample, for “neutron beam outside” reactors, the heavy water vessel andneutron or irradiation channels are systematically inspected, given the level ofneutron ﬂuxes they are subject to.
Inspections at all stages in an installation’s life are the primary responsibility of the
facility operators. Nevertheless, it is worth noting that other stakeholders may occasionally intervene to ensure correct implementation (on-site or factories inspections
carried out by the French Nuclear Safety Authority (ASN), or by the Nuclear Pressure
Equipment Department (DEP)238, etc.) - for building structures, IRSN can propose thescheduling milestones and objectives of these inspections to the French Nuclear Safety
Authority, as was the case for the Jules Horowitz reactor.
Non-compliance identified by the facility operator during periodic inspection andtesting is subject to the same declaration and processing methods as for nuclear powerreactors.
However, safety reviews are the opportunity to conduct a detailed review into
compliance every ten years, and particularly on how efficiently the facility operator
has processed non-compliance identified over the previous ten years. More detailed
investigations can be conducted during these reviews.

9.2. Safety reviews
9.2.1.

History and approach

By nature, full safety of a basic nuclear installation can never be definitively
achieved. Improvement must be sought, particularly by drawing on feedback and new
knowledge.
Since 1978, “safety reviews” have been performed on French power reactors (GCR
system reactors, Chooz A pressurised water reactor). This practice was then extended todifferent series of pressurised water reactors (900 MWe, 1,300 MWe, 1,450 MWe), with
an approach that was gradually structured into (ten-year) safety reviews, as specified
below. Research reactors operated in France were also subject to safety reviews in
the early 1980s, which initially targeted specific subjects. However, from the late
1990s, the principle of systematic ten-year reviews was adopted, following the same
approach used for pressurised water reactors in nuclear power plants.

238.

For pressure vessels, only equipment that is nuclear class 1 (N1) as per the “ESPN” Order isinspected by ASN (DEP). Equipment that is nuclear class 2 or 3 is inspected by approved bodies.
Part of the reactor coolant system for the Jules Horowitz reactor is nuclear class 1 (N1).

Maintaining compliance with the applicable requirements – Safety Reviews

179" Regulations and approach
The obligation for basic nuclear installation operators to periodically review (in practice,every ten years) the safety of a basic nuclear installation dates back to the TSN Act in 2006.
The safety review process includes several steps with the following two components:– a facility “compliance assessment” component,– a facility safety “reassessment” component.
The compliance assessment consists of comparing the real state of the facility withapplicable requirements as per the various texts and documents in force: regulations,safety report, general operating rules, etc.
The purpose of the safety reassessment is to assess the safety of the facility withregard to the most recent French and international safety practices and targets, developments in knowledge and operating feedback from the facility or other nuclear installations in France or overseas.
For French research reactors, a safety review currently includes three steps:– three years before the safety review is due, the operator draws up and sends ASN
a “safety review preparation ﬁle”, specifying the scope and scale of the plannedcompliance assessment and safety reassessment, which may only focus on some
topics, providing appropriate justiﬁcations are supplied. In return, after assessment by IRSN, ASN sends a letter to the facility operator with comments on thereview preparation;– the facility operator then conducts a compliancy assessment, including, inparticular, inspections of structures, systems and components, and studies for thesafety reassessment of its installation;– after these inspections and studies, the operator sends ASN a review report,
specifying the conclusions of its review and the safety improvements it hasplanned to implement, with the corresponding schedule. After IRSN assessmentof this ﬁle, and potentially consultation with the standing groups of experts(primarily the standing group of experts for nuclear reactors [GPR], ASN issues anopinion239 on the conditions for continued facility operation, and can set
additional requirements, particularly concerning works that need to be carried out
within speciﬁed deadlines.
For a research reactor, works resulting from a safety review may take two or three
years to carry out, or more if large amounts of work are deemed necessary. Safety reviews are major steps in the life of a research reactor and can therefore lead to significant
work (earthquake reinforcement for concrete structures, improved fire risk protection[compartmentation], etc.) to continue its operation or integrate new technologies.
The following major topics are usually assessed during safety reviews for French
research reactors:
239.

ASN also sends its opinion to the French minister responsible for Nuclear Safety. There is no“approved” decision.

Elements of nuclear safety – Research reactors

180– obsolescence and ageing management,– suitability of containment (structures, ventilation and ﬁltration systems) in theevent of a severe accident affecting the reactor or in the event of an external
hazard (explosion, plane crash, etc.),– earthquake resistance, to take into account the most recent seismotectonic data,– control of ﬁre risks.
In particular, compliance assessments are the opportunity to use in-depth inspections(potentially drilling into concrete structures, etc.) to check that the reactor pool liner andconcrete have maintained sufficient characteristics – for reactors designed to resist a
potential BORAX-type accident, these characteristics are an essential source of data toensure conservation of a sufficient water inventory in the pool in such an event.
Similarly, platforms hanging over the reactor pool may need detailed checks on theirstability in the event of an earthquake in order to prevent them from falling onto thereactor; the seismic motions considered are generally part of the safety reassessment, inline with new knowledge in this field.

9.2.2.

Examples of signiﬁcant safety reviews

As stated above, safety reviews240 have regularly been conducted on research reactors since the 1990s. These safety reviews have often focused on a specific safety issue(taking into account operating feedback, significant change to the characteristics or useof the installation, earthquake behaviour reassessment, etc.) and have been an opportunity for in-depth examination of research reactor safety. They have led to the implementation of technical or organisational provisions to improve safety.
This was true for the PHEBUS reactor after the decision was made in the 1980s to
conduct experiments which could lead to test fuel meltdown under the Phébus-PF programme. This required continuous operation of the reactor over several weeks (whereas
the duration of reactor operation in previous tests had never exceeded a few days pertest). These new operating conditions required significant earthquake reinforcement
works to ensure that the reactor building could resist a safe shutdown earthquake (ithad been designed to resist the maximum historically probable earthquake): building
belting, processing of non-compliance discovered during evacuations with regard to
the embedding into the rock (– 5 m depth) of pillars from auxiliary buildings adjacentto the reactor building.
A leak was detected from the SILOE reactor pool and the decision was made in 1986
to make significant changes (installation of a liner – see section 10.1.2 on this subject)as part of a safety review for this installation.
In the early 1980s, a first review was carried out for the RHF at Grenoble, targeting
renovation works on the reactor block and the lifetime of safety-important reactor
240.

For the sake of simplicity, the expression “review” will be used in this section, although in somecases, it only corresponds to some of the two-component review content, as deﬁned in the early
1990s and speciﬁed above.

Maintaining compliance with the applicable requirements – Safety Reviews

181

components. Furthermore, following the discovery in 1983 of cracks in the top part ofthe (internal) concrete containment, at the level of the handling crane bracket, the containment received local external belting in 1989. This operation was especially complicated given the limited space between this containment and the metal containment
surrounding it (80 cm). The prestressing cables had to be inserted through a manhole
in the dome of the metal containment.
In the early 1990s, an unusual mark was discovered during a visual examination on
an internal RHF structure, the “anti-turbulence grid241” located under the core. A second safety review was then conducted for this reactor, with a greater focus on the stateof internal reactor structures. In-depth controls showed that there were cracks in one
part of this aluminium grid (in AG3NET), which had been directly subject to significant
irradiation from the core that had weakened it – this damage had probably been increased by a vibration phenomenon. Given the estimated two-year period required
to remove all internal reactor structures and repair or replace the grid, the Laue-Langevin Institute decided after one year to replace the entire reactor block, including thepiping sections located in the pool. The facility operator adopted a new design for
the “anti-turbulence grid”, known as the turned down grid (figure 9.1) that could be replaced more easily. This new grid was qualified by tests conducted in water. These significant works were completed in 1994. The new turned down grid has since only been
replaced once.
In 2002, a second safety review of the RHF was conducted, mainly focusing on:– updating facility safety documents (safety report, general operating rules andon-site emergency plan),– taking into account lessons learned from facility operation since the previous
safety review,– earthquake behaviour of the facility.
With regard to this last point, the RHF had initially been designed by applying PS 67
earthquake protection rules, considering an earthquake at level 8 on the Mercalli
intensity scale242, with maximum horizontal ground acceleration of 0.3 g at basemat level243. This seismic reassessment led to significant reinforcements and merits further
development.

241.

242.

243.

This grid was composed of two layered grids and served to restrict ﬂows entering the core, withwater arriving at a (high) speed of 17 m/s. The ﬂuence (integrated neutron ﬂow over time) towhich it had been subject since the start of reactor operation in 1971 was estimated at
3 x 1023 neutrons/cm2.
Representing between level VIII and IX on the international macroseismic intensity scale MSK.
These are qualitative scales. According to the MSK scale, which became more widely used,level VIII corresponds to “partial collapse of buildings” (conventional) and Level IX to “substantial
damage to buildings”. The maximum level XII has been deﬁned by “landscape generally
changed”.
Data from Report DSN 50 in 1974. As stated in footnote 198, an acceleration of 0.3 g
corresponds to an area with average earthquake activity. In very active areas (Japan, Turkey,etc.), accelerations can reach 0.4 to 0.6 g.

182

Elements of nuclear safety – Research reactors

Figure 9.1. Left, the cracked part of the initial “anti-turbulence grid” in the RHF, top-right, the newturned down grid, bottom-right, lowering of the new reactor block into the pool. © ILL.

This reassessment was conducted by applying fundamental safety rule (RFS)I.1.c,established in 1992, then, for reinforcement work not yet begun in 2004, the very latest
fundamental safety rule 2001-01, with initial assessment244 of the site effects (see thefocus in section 7.4.2). For the safe shutdown earthquake, application of RFS 2001-01
led to an increase (up to 20%) in accelerations for frequencies below 4.5 Hz – which isparticularly important for concrete structures – and a significant decrease in accelerations for the [4.5 Hz – 30 Hz] range. Maximum ground acceleration (or peak groundacceleration – PGA) remained close to 0.3 g.
The operator carried out simulation calculations for the linear behaviour of all
structures on the RHF (the calculation mesh is shown in figure 9.2) in order to quantify
the resistance deficits of these structures for the new earthquake spectra. The following
deficits were identified:244.

The Laue-Langevin Institute partnered with the CASHIMA project, led by the CEA for the part
relating to site effects.

Maintaining compliance with the applicable requirements – Safety Reviews

183

Figure 9.2. Top, reactor concrete structure grid used for earthquake reassessment of the high-ﬂux
reactor in Grenoble in the 2000s; bottom-right, view of the part removed from one of the neutron
guide halls; bottom-left, partial view of the “teeth” located between the Level D slab and concrete
containment. © ILL.

– 15% – 40% for the pool’s concrete walls,– 60% for the extremity of the transfer channel245.
These observations led the facility operator to conduct various works to reinforce
the reactor:
245.

Channel composed of three compartments: Channel 1, Channel 2 and Channel 3, which can beseparated using sluice gates (cofferdams).

184

Elements of nuclear safety – Research reactors– deconstruction of peripheral buildings located on the ﬂoor around the edge of thereactor pool (one of which represented a load of 1,500 tonnes);– creation of a vertical support wall for the transfer channel;– creation of 70 “teeth” (tangential stops or “comb” system) between the ﬂoor
around the edge of the reactor pool and the concrete containment wall, with a
1 mm gap between the teeth (ﬁgure 9.2);– reinforcement of Building ILL4 adjacent to the reactor (building housing thereactor control room) and removal of part of the extremity of this building
located closest to the reactor’s metal containment in order to create a 20 cm
space between Building ILL4 and the metal containment to prevent impacts
between these structures in the event of an earthquake;– cutting away at 45° the extremities of the neutron guide halls closest to themetal containment (ﬁgure 9.2).
Furthermore, this seismic reassessment of the RHF led to the installation of an
emergency core cooling system (CRU) for managing potential leaks from the reactor
pool in the event of an earthquake.
The MASURCA reactor was subject to a first safety review in 1988, during which thelessons learned from the first years of reactor operation were analysed. Similarly, the
ORPHEE and OSIRIS reactors were subject to safety reviews in 1997 and 1999 respectively. For the ORPHEE reactor, the review mainly focused on provisions for managing
accident situations or fire risks. For the OSIRIS reactor, the review conducted in 1999
mainly focused on the lessons learned from operation, fire risk protection and behaviourof the containment in the event of a BORAX-type accident.
The CABRI reactor was also subject to a seismic reassessment as part of an overall
safety review integrating plans to install a pressurised water loop. This reassessment led
to reinforcements, which were carried out from 2003, mainly consisting of the reinforcement of the walls, columns and beams of the reactor building and auxiliary buildings, and the belting of the reactor building superstructures using reinforced concretetie beams.

Chapter 10
Operating experience feedback
from French research reactors

Operating experience feedback is vital for maintaining and improving the safety of
all nuclear facilities. In the case of research reactors, this operating experience feedback
is based on:– the lessons learned from events246 that have occurred at nuclear facilities
internationally, whether research reactors, nuclear power reactors or other types
of facility;– the detailed analysis (up to identiﬁcation of the root cause) of events that haveoccurred at French research reactors, with the deﬁnition and implementation of
measures to prevent them occurring again;– information shared between the operators of research reactors and, more broadly,with other stakeholders, including on an international scale (notably under theaegis of the IAEA).
Regarding the lessons learned from events that have occurred at nuclear facilities
internationally, three elements may be highlighted:
246.

The expression used now in France is “event”, as the expression “incident” refers instead to theoperating conditions of the second category of the deterministic safety analysis. An ASN guide
published on October 21, 2005, draws a distinction between “interesting events” and “signiﬁcant
events”. “Interesting events” (i.e. those affecting safety, radiological protection or theenvironment) are events whose “immediate importance does not justify an individual analysis
but whose repetitive character may be indicative of a problem calling for a detailed analysis”.

Elements of nuclear safety – Research reactors

186– ﬁrstly, the need to take into account reactivity accidents – including the BORAXtype accident – in the design of French research reactors, given the past accidentsof this type that have occurred internationally (see chapters 4 and 8 of thisdocument);– the investigations following the Chernobyl accident, which occurred in 1986, into
the correct management of protection inhibitions and temporary connections(“shunts”). These investigations, prompted by IPSN, notably resulted in theremoval of the possibility of disabling some safety actions and the introduction of
measures to better protect access to mechanisms allowing the adjustment ofresearch reactor safety thresholds;– the investigations following the 2011 accident at the Fukushima Daiichi nuclear
power plant, which led to the “stress tests” (ECS) covered in section 10.2.
In the case of events linked to anomalies or deviations detected during the operation of French research reactors, experience is shared among operators and their facility
managers via ad hoc bodies, in addition to the event being identified, reported to ASN if
it is categorized as significant247 and managed according to the standard INB process.
For its part, IRSN performs, in addition to analyzing each event and the measures proposed by the operator concerned to prevent its recurrence, a “second-level” analysis,
which is broader and covers the various types of INB (research reactors, power reactors
and fuel cycle facilities).
Unlike in the case of power reactors, it is harder to immediately apply the lessons
learned from an event affecting one research reactor to other research reactors, given
their diversity in terms of design and technology. However, the analysis of certain
events, concerning lifting equipment, measurement systems, I&C racks, iodine filters
or even organizational systems, for example, may provide useful lessons for several
facilities. In this way, the discovery in 2012 of an incorrectly positioned air samplingtube248 in the ORPHÉE reactor stack led ASN to alert all INB operators regarding thematter. Several other concerns common to research reactors are covered by specific basic safety rules (including purification equipment on ventilation systems and protective
measures against fire risks – see section 6.2).
Operating experience feedback from research reactors can also be used to assess thechanges in the dose received by workers at the facilities over several years and draw up,
where necessary, actions to reduce the dose received by personnel, notably by applying
radiological protection principles.
At this point, it should be recalled (see section 4.1 of this document) that, alongside
the operators of French research reactors, IRSN, in its role as coordinator for France,
sends the IAEA annual reports on notable events that have occurred in these reactors
in cases where the lessons learned are worth sharing at an international level. These
reports are added to the IRSRR system database, used by the IAEA, which contains all

247.
248.

The criteria for reporting signiﬁcant events are speciﬁed in an ASN guide dated October 21,
2005.
Sampling for measuring tritium.

Operating experience feedback from French research reactors

187

the reports sent by the various countries. The IRSRR database is an information andknowledge resource available to operators249, who can take it into account, notably
during facility safety reviews.
Lastly, it should also be recalled, as indicated in section 6.1, that operators informthe public of any significant events that occur at their facilities, providing the analysis
that they have completed and the measures taken to avoid repeat events, in accordancewith the provisions of the TSN Act.

10.1.

Trends, some notable events and their
management

10.1.1.

TrendsAt end of June 2018, the event database maintained by IRSN since June 1972
contained 1,515 events that had affected French research reactors, together with theirclassification on the INES scale. This corresponds to three events per reactor per year on
average250. The events are listed in the ASN’s annual (public) reports.
Several major families of events and trends may be identified:– events that are not speciﬁc to research reactors:

249.
250.



the discovery of foreign bodies in fuel elements,the faulty operation of or damage to components (fuel elements, internal
structures, reactor coolant systems, absorbers mechanisms, safety valves,diesel generators, lifting equipment, etc.), up to fuel melt (SILOE, 1967),



leaks from pools or tanks (notably in the case of the SILOE reactor between
1965 and 1986), water inﬁltration into ﬁssile material storage rooms,

electrical insulation faults, loss of off-site electrical power,malfunctions in the ventilation systems and pressure loss in rooms, poor
efﬁciency of iodine ﬁlters,

incorrect safety threshold settings, non-compliance with operating rules oroperating procedures (for example regarding the limits set to prevent
criticality risks, access conditions for controlled areas or the frequency of
in-service inspections);

In all cases, it is the national coordinators who are responsible for sending incident reports fromthe IRSRR, IRS, etc. databases to the operators in their country.
The average for pressurized water reactors in the nuclear power ﬂeet, which are much more
complex facilities than research reactors, is around 13 (signiﬁcant) events per reactor per year
(events affecting safety and radiological protection). It may be useful here to highlight that the
number of events that occur at a nuclear facility does not, in itself, constitute an indicator of thelevel of safety of the facility. However, the in-depth analysis of each event is a vital learning
resource.

Elements of nuclear safety – Research reactors

188– events related to the speciﬁc design features of research reactors: objects falling
into pools, heavy water system leaks, tritium releases (via the stacks or into theground) from detritiation facilities, anomalies regarding natural convection
valves, etc.;– events linked to speciﬁc equipment, such as anomalies regarding the neutron
channel thimbles (ORPHÉE, RHF) or cold sources (ORPHÉE, HFR). One example
occurred at RHF, which experienced corrosion due to irradiation, detected from1972, on the inside of the aluminum alloy thimbles (in AG3NET), more
speciﬁcally on the “collimator plugs”. These plugs seized due to corrosion causedby the formation of nitric acid, in turn resulting from radiolysis of the air251
subjected to neutron ﬂux (which led to the air in the thimbles being replaced withhelium, and, as the thimbles were gradually replaced, new Zircaloy thimbles being
installed). Another example occurred in August 1988, when an error caused therupture disks protecting RHF’s vertical cold source against overpressure to crack
and release, at the facility stack (45 m high), approximately 9 m3 of deuterium
containing several tens of TBq of tritium;– events linked to experimental devices and their use: the triggering of safetysystems speciﬁc to these devices, chemical reactions with sodium or sodiumpotassium alloys, device explosions, etc.;– operator exposure or the contamination of pools, buildings, rooms or people.
Here it is relevant to mention the spillage of antimony 124 from a startup
neutron source into the RHF pool in 1974. In the end, after numerous events252,
this resulted in a combined release into the Isère River of 20 TBq of thisradioactive element (over 1974 and 1975);– the discovery of undocumented radioactive sources or objects;– outbreaks of ﬁre, notably a ﬁre in the electronics room of an experimentmeasurement facility (CABRI, 1979) and a deﬂagration in an electrical cabinet(RHF, 2000).
There have been several events linked to handling operations and lifting equipment:– a traveling motor-reducer unit falling from a crane (OSIRIS, 1975),– the rupture of a winch drive band (ULYSSE, 1975),– a transportation container falling due to the overhead crane hook becoming
detached from the block and tackle (ISIS, 1976),– assembly (MASURCA, 1977) and rodlets (same reactor, 1989) falling,– elements of an experimental loop falling into the pool (SILOE, 2004),– the rupture of a hoist cable and a hook falling onto the “edge platform” (RHF, 2012),– the rupture of a sling (RHF, 2013).
251.
252.

More speciﬁcally, radiolysis of traces of water in the air.
As reported in the press (for example Sciences & Avenir n 360, February 1977).

Operating experience feedback from French research reactors

189

The risks associated with handling operations therefore require special attention253.
An in-depth analysis should be performed on the various safety elements of these handling operations: the reliability of lifting equipment, handling sequences254, human andorganizational factors, measures to limit the consequences of an item falling, etc.
In addition, between 1991 and 2007, the ventilation systems at the MASURCA facility malfunctioned repeatedly, with the loss of negative pressure in various rooms. Thiswas due to fan failure or loss of electric power, which could be attributed to aged components. These elements were taken into account when these reactors were renovated.
Although the frequency of “human error” or “handling error” events tends to drop fromthe 2000s onward, cases of failure to comply with regulatory requirements or operating
rules have emerged, associated with the gradual strengthening of safety documentation
at research reactors (notably for their operation). The frequency of events concerning experiments and associated devices has fallen over the decades, indicating improved control.
It is interesting to note the appearance, from the 2000s, of events corresponding to
the identification of gaps or imperfections in the safety demonstration (study anomalies, errors in the operational application of requirements, etc.), such as:– “an error in the criticality safety evaluation, in the safety report, of a box
containing surplus nuclear materials” (MASURCA, 2003);– “the use of the equipment access hatch to the ring gallery in a way that is notcovered by the safety documentation” (OSIRIS, 2005);– “the incorrect formulation of the mass limit [in a] “hot laboratory” during therevision of the safety report in 2004” (MASURCA, 2012).
In the next section, some of the most notable safety events that have affected
French research reactors are covered in more detail, together with the corrective measures taken as a consequence. A certain number of these events have been analyzed aspart of safety reviews. These events, which generally occurred some years ago, havebeen selected for their educational interest, and more specifically due to the way inwhich they unfolded, the physical phenomena involved, the safety issues raised andthe measures introduced as a response.

10.1.2.

Some notable events and their management" Recurring leaks in the SILOE reactor pool (1965–1986)255
The design of the SILOE reactor pool was called into question by water leakage
from this pool into the groundwater, which occurred between 1965 and 1972, thenagain in 1986.
253.
254.
255.

This observation is also valid for nuclear power reactors.
The handling sequence refers to the sequence of movements in terms of horizontal and verticalmovements, movement speed, the area or objects passed over, etc.
Le Matin and Le Monde newspapers, dated April 16, 1987, and October 23, 1987, respectively,
reported on these events.

Elements of nuclear safety – Research reactors

190

The civil engineering structure of the SILOE reactor had two compartments:– a compartment known as the “main pool”, measuring 213 m3, which contained
the reactor core – this was the pool that leaked;– a compartment known as the “work pool”, measuring 322 m3, arranged in ahorseshoe layout around the main pool and generally used for storing andperforming operations on experimental devices.
The first water leak from the main pool was detected in 1965 from the records ofthe makeup water added to compensate for the evaporation of water from the pool.
The leak stopped in 1968 and reappeared in 1969. In 1970, a stream of bubbles wasobserved in the pool water, which made it possible to detect a crack between the ceramic tiles at the bottom of this pool (separated by araldite seals), near the foot of the“stool” supporting the reactor core. Leaktightness was restored by installing a stainlesssteel plate on the tiled floor, with a synthetic foam seal. However, the leak reappearedin 1971 due to the degradation of the seal caused by radiation. The leak was only sealed
durably in 1972, with the installation of a flat, natural rubber seal held against thebottom of the pool with lead.
The total volume of contaminated water that entered the groundwater between
1965 and 1972 was estimated to be around 1,500 m3. The total activity released in thisway, principally due to tritium, was estimated to be in the order of 2.7.1011 Bq. During
work to replace the “stool256” of the reactor core grid in 1977, the pool was resealed byinstalling a layer of epoxy resin and glass wool fabric 4 mm thick on the tiled floor and
up to a height of 75 cm on the vertical walls.
The ongoing leak in the pool notably led the nuclear safety department257 of the
CEA to evaluate the potential radioactive releases into the groundwater in the hypothetical case of a BORAX-type accident, taking into account the contamination of
the pool water (due to the accident) and the transfer of radionuclides through thegroundwater to the Isère River (calculated to take 55 days). In this way, it was demonstrated that, even without purifying the contaminated water from the reactor pool, theadded activity 258 concentration in the Isère River would be low (in the order of
140 Bq/L). The study did, however, lead to the examination of measures to limit theconsequences of such an accident with a leaky pool: purifying the pool water (startingthe “hot layer” [see section 7.3.3] and “pool floor” systems would reduce the added
activity concentration in the Isère River to 0.7 Bq/L), transferring the pool water to atank at the SILOETTE facility, pumping water under the foundation raft, into pits, etc.
However, in November 1986, an increase of approximately 1 m3 in the makeup
water added to the pool to compensate for evaporation was observed once again. Afterchecking the leaktightness of various reactor systems, the reactor was shut down at thestart of December 1986 for a detailed inspection of the main pool, suspected to be
the source of the water leak. This inspection required the fuel elements to be unloaded,

256.
257.
258.

This was replaced by a grid-stool-box assembly.
The forerunner of IPSN, which was created in 1976.
Due to all the ﬁssion products liberated by the core melt.

Operating experience feedback from French research reactors

191

the pool to be drained, the various reactor core structures to be dismantled and the tiling to be removed. The water was transferred from the pool to a tank designated forthis purpose at a deliberately slow rate, in order to take advantage of the gradual dropin level to decontaminate the pool walls and thereby prevent the resuspension ofradioactive particles in the air. Injecting inert gas259 under the foundation raft thenmade it possible to locate a hole approximately 5 mm in diameter in a corner at thebottom of the pool, as well as two small cracks. This event resulted in a release of
approximately 30 m3 of water chiefly contaminated with tritium into the groundwater;
the total activity was estimated at 2.3.1010 Bq.
This event threatened the future of SILOE260, given the high cost of the workneeded to return the reactor to good condition. However, the CEA decided to undertake this work so it could continue operating and performing experiments at thisreactor, and scheduled the permanent shutdown of the MELUSINE reactor, which
had been commissioned in 1958 and whose experiments could be transferred to
the SILOE facility. The corresponding modifications, authorized by the SCSIN in summer 1987, were considerable. A stainless steel liner was installed in the main pool,welded to backing strips also made from stainless steel and fastened to the poolwalls. A gap was left around the edge of the pool, equipped with a system to detectleaks and recover any leaks from the liner. Regarding the capacity of the pool to withstand a BORAX-type accident, while the leaktightness of the neutron channel penetrations seemed assured, the technical inspection highlighted the weakness of oneof the pool walls. This led the operator to install a tank – known as a BORAX tank
– able to deform and thereby absorb some of the energy that would be releasedin the event of such an accident261, in order to protect the liner and pool walls. With
the same aim in mind, a stainless steel plate 20 mm thick, positioned on shock absorbers known as “resilient pads”, was installed on the basemat, under the BORAX
tank, in order to guarantee the mechanical resistance of the pool basemat to thepressure that would result from a BORAX-type accident. Liners were also installedin the decay tanks, with leak detection and water recovery systems. These various
liners and tanks are shown in figure 10.1.
In addition, two more piezometers were installed in 1988 to improve groundwater
monitoring.
Later on, the leaks in the SILOE reactor pool had consequences for the dismantlingof this reactor, which are only mentioned briefly below.
The permanent shutdown and dismantling operations at the SILOE reactor were
subject to a public inquiry and the associated operating license was awarded in January
2005. The final state, as envisaged by the CEA, was full cleanup of the walls of the reactor rooms. In this respect, the CEA set the following quantitative targets262 in 2008:
259.
260.
261.
262.

The gas used was sulfur hexaﬂuoride, SF6, which is non-toxic, non-ﬂammable and practicallyinsoluble in water, and has high chemical and thermal stability.
See footnote 245.
The other part of this energy is dissipated by being expelled towards the top of the water.
In the information package related to the cleanup of structures (DIRAS), with a view todecommissioning.

192

Elements of nuclear safety – Research reactors

Figure 10.1. Pools and decay tanks at the SILOE reactor: tanks and liners installed in 1987-1988.
© Georges Goué/IRSN.

– a theoretical “acceptable modeled value for residual activity” (VARMA), below
which structures can be considered conventional, of 1 Bq/g of concrete forβγ emitters, excluding tritium, and of 100 Bq/g for tritium;– for βγ emitters excluding tritium, a end of cleanup decision criterion, on the basisof the measurements performed for some radionuclides, of 0.4 Bq/g, lower thanthe previous value and incorporating an additional margin to take into accountmeasurement uncertainties in particular.
At that point, the cleanup strategy for the reactor pool basemat and underlying
ground had not been determined, as the pool needed to be removed before the levelof contamination of these elements could be measured.
In 2010, the CEA suggested removing part of the foundation raft through its whole
thickness, and across a surface area covering the whole of the main pool. In addition,
given the uncertainties regarding the leak pathways through the thickness of theOperating experience feedback from French research reactors

193

basemat, it suggested examining the vertical walls, stripped at the point where they met
the thickness of the foundation raft, with a view to checking that there was no contamination at the various possible leak pathways in the concrete, along the length of therebars and the prestressing cable ducts, and in the bitumen felt elements ensuring
leaktightness.
In 2011, the CEA informed ASN of the presence of contamination in the thickness ofthe basemat around the prestressing cables and in part of the ground located under thebasemat (locally, the specific activity reached 25 Bq/g). This meant that the cleanup of
the SILOE foundation raft had not, at this stage, achieved the cleanliness targets initiallyset. For its part, ASN did not favor managing this situation through the implementationof a “public service easement263”. Furthermore, full cleanup required in-depth treatmentthat could affect the mechanical strength of the reactor building. This is why the CEA
ultimately decided to fully demolish the dome and cylindrical walls of the reactor building, as well as the auxiliary buildings, before completely removing the basemat and thecontaminated soil. The corresponding work is illustrated in figure 10.2.

Figure 10.2. Some of the dismantling stages of the SILOE reactor (2010s). © All rights reserved.
263.

A public service easement is an administrative easement appended to the land use plan inaccordance with article L. 126-1 of the French planning code. An impact study is also produced.

Elements of nuclear safety – Research reactors

194

The soil below the SILOE reactor basemat had to be excavated to a depth of 1.8 m.
The license governing the permanent shutdown and dismantling of the SILOE reactor was modified264 to take into account new cleanup work that would extend the duration of operations. The SILOE reactor was decommissioned265 by an ASN resolution
dated January 8, 2015, ratified by an order of the minister in charge of nuclear safety
dated February 12, 2015266.

" Melting of fuel plates in the SILOE reactor (1967)267
On November 7, 1967, six fuel plates in a control element268 partially melted in the
SILOE reactor during a power increase to 42.3 MW performed as part of preparatory
tests for taking nominal reactor operation up to 30 MW269. These tests, authorized
by the CSIA270, notably aimed to determine the power margins available in relation
to the “flow redistribution” phenomenon in fuel elements (described in detail below).
At 42.3 MW, a sudden drop in power was observed of approximately 7 MW in one second, followed by a slower drop until it stabilized, 20 seconds later, at 20 MW. The reactor was shut down manually 26 seconds later by dropping two safety absorbers. A rapid
increase in γ radiation dose rates was then observed (in an immersed measurement
chamber, up to 1,000 rad/h, and in another measurement chamber, located above
the pool water, up to a value of 220 rad/h), which led to the evacuation of the reactor
building and auxiliary buildings, as well as the use of the iodine filters on the emergency
ventilation system.
This event caused 187 g of uranium and aluminum alloy (enriched to 93%
uranium-235) to melt, corresponding to a mass of 36.8 g of uranium-235, 18 g of which
was released into the reactor coolant system. The remainder was found in the form ofmagma at the bottom of the control element (figure 10.3).
Approximately 74 TBq, chiefly noble gases, were released via the reactor stack in thetwo days following the event. Contamination of both the reactor building and the site
was negligible, due to the low burnup (4%) of the element concerned. The fuel dispersedin the reactor coolant system was recovered in the decay tanks on the occasion of tankinspections performed in 1970 and 1971.
The cause of melting was not clearly established. In this respect, the results of theinvestigations carried out by the operator following this event, which notably involved
measuring the temperature of the same type of control element cladding positioned in
the location where the melted fuel plates were found, at powers of between 0 and

264.
265.
266.
267.
268.
269.
270.

Decree 2013-677 of July 24, 2013.
Removed from the list of INBs.
Ofﬁcial Journal of the French Republic of February 20, 2015.
Contrôle review 128, April 1997, ASN.
Fuel element containing an absorber for power control.
Since commissioning in 1963, the reactor had operated at a nominal power of 15 MW.
“Commission de sûreté des installations atomiques” (nuclear facility safety commission), France.

Operating experience feedback from French research reactors

195

Figure 10.3. Two views of the melted plates in the control element at the SILOE reactor. © ILL.

39 MW, seem to rule out the flow redistribution hypothesis271; indeed, the extrapolation of these measurements to 42.3 MW gave, for the melted plates, a temperature
at the hot point of the cladding below that corresponding to local boiling (116°C as
opposed to 128°C). In addition, the hottest plate of the control element did not melt.
As flakes of dry paint, from the structures located over the pool, were discovered
several times on the core elements, the operator finally attributed the melting of theplates to the partial blockage of several cooling channels on the control element
concerned.
The following improvements were made after this event:– the painted sheet metal structures overhanging the core, used for routing thecables and hoses of experimental devices, were replaced with stainless steel
structures;– a second emergency exhaust system was installed at the facility to improve thereliability of this safety-related system;– systems were installed to allow the air above the pool and the water from thepool to be sampled from outside the reactor building;– controls for the pool water puriﬁcation system were installed in the control room.
Decontamination was not required following this event. Authorization to restart thereactor was granted a few days later.

271.

Phenomenon that can result in local overheating and boiling, resulting in a change in water ﬂow
between the plates. Various tests performed in the CABRI reactor had already shown that, ingeneral, ﬂow redistribution is accompanied by power oscillations due to local boiling and thecorresponding vacuum effect; such oscillations were not observed during the event reported
here.

196

Elements of nuclear safety – Research reactors" Explosion of the AQUILON experimental irradiation device in SILOE(1979)The explosion of the AQUILON experimental irradiation device occurred at the
SILOE reactor on April 10, 1979. This device – similar to the “boilers”272 used for tests
on light water reactor fuel – was positioned at the edge of the core and contained anirradiated uranium oxide fuel rod (UO2; uranium enriched to 4.7% isotope 235). The
explosion of the device caused uranium oxide and fission products to be released into
the reactor pool, and noble gases and iodine to be released into the reactor building andenvironment.
In the device (figure 10.4), the water was practically static273; its pressure wasadjusted depending on the heat released by the fuel rod in such a way as to achieve

Figure 10.4. Section view of AQUILON device © Georges Goué/IRSN.

272.
273.

The pressure inside the AQUILON device had reached 130 bars, as opposed to 78 bars in the“boiler devices”.
The device was not equipped with a water circulation pump, meaning that only naturalconvection was possible.

Operating experience feedback from French research reactors

197

nucleate boiling. The superheated steam produced was directed by the rod guide rings
to the cold wall of the device, where it condensed. The external wall of the device wascooled by circulating water from the pool. For this purpose, a cooling channel (2 mm“thick”) was created by positioning a cylindrical sleeve around the lower part of the device in line with the SILOE reactor core. This was connected to the reactor coolant system via a mobile “water box” (allowing the device to be moved closer to or further
away from the core). The sleeve, weighing approximately 10 kg, rested on the “waterbox”, but was not mechanically fastened to it.
Reactor shutdown could be triggered automatically by security devices linked to theloop (in the event of the tube breaking under high pressure, or in the event of low waterlevel in the pressurizer, or even high temperature in the lower part of the device).
On April 10, 1979, at 9:17 am, the device had been positioned away from the core foraround 17 hours (the security devices were disabled via “shunts”) and the reactor was inoperation. Three handling operators were removing the device using an overhead crane.
At 9:20 am, the order to evacuate the reactor hall was given from the control room,as the second dose rate threshold (set to 0.25 mGy/h) had been exceeded at a γ radiation measurement chamber located over the pool. Five minutes later, an explosion wasperceived in the control room and the two safety absorbers dropped. Almost simultaneously, the alarm and safety thresholds of numerous radiation measurement channels
were exceeded. Orders were given to evacuate the building (with the dose rate reaching
0.4 mGy/h in the control room) and these were followed once the operators had ordered the three control absorbers to be dropped, the reactor coolant pumps to be
stopped and the emergency air exhaust system to be started (for reactor hall ventilation
with iodine filters).
The following observations were made during the subsequent investigations:– the device sleeve showed signs of heating and had two holes;– the test fuel rod was partially melted;– the upper part of the external plate of a fuel element located near the device“water box” was deformed, without cladding failure.
Approximately 190 g of UO2 (7.5 g of uranium-235) was expelled from the device
into the pool.
The explosion of the device notably led to 18.5 TBq of fission products being released into the pool. The environmental releases were estimated at 2.6 TBq of noble
gases and approximately 7.108 Bq of iodine, 108 Bq of which was iodine 131. Due tothe rapid evacuation of the reactor hall by the three handling operators before theexplosion, the dose received by the most exposed worker was limited to 1.8 mGy.
The maximum activity concentration of gaseous releases via the reactor stack was
1.48.105 Bq/L (xenon). The measurements taken in the environment, downwind, did
not indicate any activity due to aerosols or iodine above the natural background noise.
The cause of the event was determined: the sleeve had shifted when the AQUILON
device was being removed, which had:Elements of nuclear safety – Research reactors

198– interrupted device cooling (uncoupling of the connection between the sleeve and“water box”);– stopped the cooling water guide function usually performed by the sleeve, until
the lower part of the device was completely outside the reactor core.
Moreover, it was not possible to confirm whether the pressurizer valve on the device
had worked correctly.
All the fuel elements in the SILOE reactor core were checked using a mobile cladding
failure detection device. The six elements closest to the AQUILON device were replaced.
Authorization to restart the reactor was granted by the SCSIN after a shutdown lastingten days, largely spent purifying the pool water. However, the use of “boiler”-type devices was suspended, notably to assess the status of these devices in relation to pressure equipment regulations.
The general measures taken by the CEA after the event – following the meeting of
the reactor safety commission on July 11, 1979 – notably included:– banning the use of “shunts” on safety systems associated with experimental
devices during their removal from or insertion into a core;– requiring sleeves to be fastened to “water chambers”;– ensuring that procedures for inserting or removing various devices into or from a
core, with the reactor in operation or shut down, were made more comprehensive
and detailed.

" Underestimation of the operating power of RHF (1971-1990)
An ongoing anomaly in which the real operating power of RHF (Grenoble) was
underestimated by around 10% was discovered in January 1990 after some reactor
operating parameters were checked. Following this observation, the operator reduced
this operating power in order to comply with the maximum value of 58.3 MWth set
out in the operating rules.
This anomaly was declared to the SCSIN on January 23, 1990. It arose due to anerror in the calculation of the heavy water flow rate in the main reactor system. The
formula used, established on the basis of measurements performed using light water,
had not been corrected to take into account the difference in density between lightwater and heavy water. In fact, the real flow rate was 10% higher than the flow rate
calculated. This error had also been made when the reactor protection system thresholds were determined, meaning that there was no automatic reactor alarm or reactor
scram.
On January 24, 1990, the SCSIN ordered the operator to keep the reactor shut
down274, with restarting subject to SCSIN authorization.

274.

The operator, which had initially lowered the reactor power, ultimately decided to shut down thereactor.

Operating experience feedback from French research reactors

199

It became clear that observations made previously by the operator could be explained by this underestimation of the operating power. Indeed, the operator had observed that fuel was consumed more rapidly than expected, resulting in shorter
operating cycles (the control rods reached their post-irradiation position after 42 days,
instead of 46 days as expected).
This anomaly led the operator to fully review the studies on the core physics of RHF(neutronics and thermohydraulics).

" Melting of fuel in driver core rods in the CABRI reactor (2004)275 276
As part of the safety review associated with the project to modify the CABRI facility
to allow tests in a pressurized water loop, examinations were performed on the hottest
fuel rods in the reactor core. During the first non-destructive examinations performedon three of these rods, folds were observed on their cladding. The amplitude of thesefolds measured several tens of micrometers and the pitches (the distance between
folds) were close to 10 mm – approximately corresponding to the height of a fuel pellet– on the lower part of the three rods. For two of the rods, a significant area of deformation of a few per cent was observed above the fold area.
After these observations were made, a radial cross-section was taken across the areaof maximum deformation of one of these rods. A macrograph of this cross-section
showed the presence of local melting at the center of the fuel and signs of pelletcladding interaction. These observations constituted deviations from the technicalrequirements for the CABRI reactor and were reported to the French Directorate for
Nuclear Safety (DSIN) on January 12, 2004.
As indicated in chapter 5, the CABRI reactor was designed for power excursions(“pulses” – see figure 10.5) from maximum steady-state operating conditions of
25 MW. With a view to preventing the fuel melting, and ensuring the leaktightnessof the cladding of rods in the driver core, the technical requirements for the facility
stated that, during these power excursions, the maximum fuel temperature should
not exceed 2,400°C277, all uncertainties combined, and the surfacic thermal power ofthe core rods278 should remain below 750 W/cm2 (criteria to be respected in estimates
via calculation, prior to experiments). In addition, these technical requirements
authorized reactor operation above 25 MW up to 42.5 MW for a maximum cumulative
duration of 23 minutes in order to perform slow power ramps; in these conditions, themaximum temperature of the fuel should not exceed 2,768°C, all uncertainties
combined (requirements indicated in the safety report, justified by calculations).
Since the CABRI reactor went critical in 1977, around 500 rapid power transients(“pulses”) and 16 slow power ramps above 25 MW had been performed with the driver

275.
276.
277.
278.

ASN website, incident reports.
Summary of the IRSN report on restarting the CABRI reactor, dated January 22, 2009, available
to the public.
The melting point of UO2 is around 2,840°C.
Value from tests (CAPRI) performed in a loop at the CEA in Grenoble.

Elements of nuclear safety – Research reactors

200

Figure 10.5. Example of a power-time proﬁle for a “pulse” of power in the CABRI reactor. © Georges
Goué/IRSN.

core for a cumulative duration of 19.8 minutes. The average burnup of the reactor core
was 88 MWd/tU (approximately 2.3 equivalent full power days [EFPD]).
The fuel in the reactor core is made up of UO2 at a low level of uranium-235 enrichment, in the form of pellets stacked in stainless steel cladding (grade 304L as per theAmerican AISI standard).
The following provisions were selected at design to limit the risk of fuel rod dryout
during rapid power transients:– the adoption of a high initial radial clearance between the fuel and the cladding tolimit pellet-cladding interaction;– the adoption of a cold internal helium pressure sufﬁcient to prevent cladding
creep at high temperature under the effect of external pressure;– the selection of a special type of pellet279 unlikely to fracture under the effects ofa radial thermal gradient (conservation of initial pellet geometry);– the choice of steel cladding with a high expansion coefﬁcient, which contributes
to limiting the closure of the pellet-cladding clearance during power transients.
The good condition of the fuel had been checked previously by examining some ofthe hottest rods in the reactor core, firstly in 1988 after around 200 rapid transients had
been performed, then in 1991 after nearly 10 minutes of cumulative operation above
25 MW in slow ramps (out of the 23 minutes authorized).
After investigation, the cladding deformation and core fuel melt were attributed toslow ramp transients, which cause fuel pellets to deform into a diabolo shape; this279.

Using a sintering process that differs from that used for fuel pellets destined for reactor rods to
be used in nuclear power reactors.

Operating experience feedback from French research reactors

201

means that in the event of pellet-cladding interaction during such transients, folds may
appear in the cladding (rapid power transients cause the pellets to deform into a barrel
shape). In addition, only slow ramps heat the fuel to a temperature close to its melting
point, leading to the conclusion that the deformations observed had probably appeared
after the tenth minute of operation above 25 MW.
The observations made raised a number of questions regarding safety, ultimately
concerning in fine the capacity of the CABRI reactor driver core to undergo the tests
planned for the future (10 rapid transients as part of the CIP program280):– What was the overall state of the reactor core?
– What measures were needed to return the core to compliance?
– What additional measures were needed for the in-service monitoring of the corefuel rods?
– Was the distribution of power released in the reactor core well known?
– Did the simulation tools used to check, before each new test, that the fuel andcladding criteria would be observed give reliable results?
– Should there be restrictions on using the reactor in future programs?
Given the involvement of IRSN in the research performed using the CABRI reactor,
the files drawn up by the operator, the CEA, had been examined, at the request of IRSN,
by the Belgian nuclear safety body, AVN (Association Vinçotte-Nucléaire).
In the light of the observations on the three rods mentioned above, an “extended
inspection” approach281 was taken. Non-destructive examinations were therefore also
performed on six additional rods taken from among the 1,488 rods in the CABRI reactor
core; only minor deformations in their cladding were observed.
The reactor was returned to compliance by replacing four rods (the one subjected todestructive expert assessment, and the other three rods producing power similar to that
produced by the assessed rod) with new rods. It was estimated that there was no risk ofdamage to the other reactor core rods, as they were not producing sufficient power.
In addition, a detailed analysis of the transients experienced by the reactor coremade it possible to attribute the fuel melt and associated deformations to a slow ramp
transient performed in 1995. The CEA then took the decision to perform no more slow
ramp-type tests in the CABRI reactor.
The analyses performed showed that important parameters had been poorly estimated by the various software tools used to simulate fuel rod behavior as part ofthe safety analyses performed prior to the scheduled transients. This explains why
the fuel melt had not been anticipated. A new simulation tool was then developedby the CEA (covered in more detail in chapter 11). In addition, based on the fact that

280.
281.

Cabri International Program. See "Current state of research on pressurized water reactor safety",
Sciences and Technology Series, IRSN/EDP Sciences, 2017.
Standard approach not speciﬁc to research reactors.

Elements of nuclear safety – Research reactors

202

the number of transients experienced by the reactor core had subjected the fuel rods togreater loads than would be possible in the future, without any detection of cladding
failure, the CEA suggested that, in the future, the demonstration of the absence of cladding failure during a transient could be based on ensuring compliance with two criteria
associated with circumferential deformation and cladding temperature. This was accepted, notably given the good ductility of the austenitic steel used for the claddingof fuel rods for the CABRI reactor, only slightly irradiated, as well as the low quantityof fission products accumulated in this fuel. In this respect, IRSN performed a study,
during the expert assessment of CEA files, to compare the energy that a reactor corerod should produce during a rapid transient to achieve the new criteria at the energy
level representative of a cladding failure limit determined on the basis of tests performed in the USA and Japan282; this study showed that these criteria were consistentfor the transients expected in the CABRI reactor (CIP program).
Lastly, the results of the calculations performed using the new simulation tool madeit possible to demonstrate that the cladding deformations and cladding and fuel temperatures should not result in cladding failure during CIP program tests.
In terms of in-service monitoring, the program selected by the CEA for the rods in
the CABRI reactor core includes:– establishing a “point zero” reference. This ﬁrst step has been performed andinvolved performing a reference proﬁlometry283 on the four rods substituted for
those that experienced local melting (located in two control and safety rod [BCS]
assemblies284);– performing a proﬁlometry at the end of the CIP program. This second step will
involve unloading one of the two BCS assemblies containing the hot rods andremoving one of them for proﬁlometry. If there is a signiﬁcant change (foldheight greater than 60 μm), the inspection will be extended to two other hot rodsin the BCS assembly. However, a slight change in the folding is to be expected, as
the substitute rods (already irradiated) were not, by deﬁnition, in the hot spot
position. The bounding “pulse” for future tests should therefore generate foldingin the cladding of the new hot rods of around 60 to 100 μm according to thepredictive thermomechanical calculations.

" Exposure of workers to radiation
Between 1973 and 2014, there were 18 events in which workers were exposed toradiation285 at French research reactors (less than one event of this type per reactor

282.

283.
284.
285.

SPERT-CDC tests in the USA and NSRR tests in Japan, performed in 1969 and the 1970s withdifferent cladding materials, including stainless steel as used for the driver core rods in the CABRI
reactor. These tests led to the selection of a limit value, for rapid transients, of 240 cal/g forpressurized water reactor fuel rods.
Diameter measurements performed for two azimuths 90°apart, based on a close axial pitch.
The driver core of the CABRI reactor has six assemblies, known as BCS assemblies or simply BCS,
each with 21 fuel rods and 25 tubes containing control rods.
Including some (rare) contamination events.

Operating experience feedback from French research reactors

203

per decade). These occurred at six reactors, chiefly the SILOE, ISIS and OSIRIS reactors,
as well as RHF. The change in the number of events over time is shown in figure 10.6
below.

Figure 10.6. Change in the number of worker exposure events over the 1970s, 1980s, 1990s, 2000s
and 2010s (2010-2014) in French research reactors. © Georges Goué/IRSN.

Over a period of 41 years (1973-2014), around 30 people were exposed to radiation,with maximum doses in the order of 40 mSv, with the exception of the event that occurred at the SILOE reactor on November 15, 1979: when a photographic film was being
placed on an activated dysprosium plate previously irradiated in the axis of a beam, anoperator received a dose estimated at 140 mSv (X-ray, β and γ radiation). Since 1990,
there have been no cases in which workers have received significant doses of radiation(figure 10.7).

Figure 10.7. Change in the maximum radiation dose received by operators at French research reactors,
in mSv (1978, 1979, 1980, 1985, 1990). © Georges Goué/IRSN.

Elements of nuclear safety – Research reactors

204

It is worth including here a description of one event that occurred at the SILOE reactor
in October 1985, as it provides a general illustration of the risks that can arise when multiple activities are being performed simultaneously at one facility. The development of
the film badge belonging to an external operator, who was working to restore the leaktightness of the reactor containment (metal structure), indicated that a dose of 47 mSv
had been received. The investigations carried out showed that this operator had beenworking on the reactor dome (metal containment), in line with a “hot cell” located in
the reactor hall. At the same time, a cobalt 60 source of almost 100,000 Curies (for medical use) was being maneuvered in this cell using lifting equipment located on the roof ofthe cell, with the cable from this equipment passing through the thickness of the concrete via a narrow hole. During the operation, a very thin beam of ionizing radiation
was directed towards the dome, affecting a small surface area of around 1 m2. The investigations also showed that this dose of 47 mSv could be attributed solely to the period(20 minutes) when the source was being removed from the cell. After this event, the procedure for removing a source from the “hot cell” was updated to include a requirement tocheck that no work was being undertaken on the SILOE reactor dome at the same time.
There have been several events associated with the use of neutron channels at the
ORPHÉE and RHF reactors. These have occurred more frequently at RHF due to the higher
number of physics experiments performed simultaneously at that reactor (40 at RHF
compared to 25 at ORPHÉE) and due to their duration, which is shorter on average at RHF.
Two events of this type, one in June 1989 at the ORPHÉE reactor – which could have
led to the accidental exposure of personnel – and the other in August 1990 at RHF –which led to the (low-level) exposure of two physicists and two operators (maximum
dose in the order of 20 mSv) – are worth describing here as they illustrate the difficulties, mentioned in section 7.2.3, that arise when different populations are working at
research reactors, namely operating personnel, on the one hand, and researchers, on
the other. These two events led the relevant operators and IPSN to carry out an indepth analysis into:– the technical measures for blocking the “neutron beams”,– human and organizational factors.
The technical measures for blocking the beams notably rely on the presence ofphysical shutters (a “head” shutter, positioned upstream of the neutron beam, and asecondary shutter286; these may use different technologies287), which make it possible
to interrupt the neutron beam and re-establish continuous biological shielding for thereactor. These shutters, which are safety-related elements, are checked regularly.
The two events in 1989 and 1990 highlighted shutter design anomalies (shutter off balance288 due to a minor compressed air leak in the case of the ORPHÉE reactor, resulting
286.
287.
288.

The neutron beam may, after a head shutter, be directed to several channels, each of themequipped with its own secondary shutter.
Flap, barrel, liquid plug, etc.
These were dual-action shutters in which the membrane was held in the closed position bypressurized air on each side. They have been replaced by spring and compressed-air shutters sothat, if the air pressure drops on one side of the membrane, it is held in the closed position by
the spring acting from the other side.

Operating experience feedback from French research reactors

205

in the untimely opening of the beam; shutter cut off [for operational reasons] from its
compressed air supply at RHF, making it impossible to interrupt the beam). Various
improvements have been made, notably to the compressed air systems controllingthe shutters.
Regarding human and organizational factors, the event that occurred at the RHF
reactor led IPSN, with the operator’s agreement, to perform its own analysis. This gave
rise to the following observations:– the research physicists at the Institut Laue-Langevin had been put in a difﬁcult
position, as they received numerous requests to perform applied researchexperiments;– three people in succession had persisted with an incorrect understanding of how
the shutters worked and the role of a key used for the secondary shutter control
rack, despite the visual and audio alarms, until a fourth person, the operator
responsible for “managing” the shutters, had made them aware of the hazardous
situation in which they were working. It therefore appeared that operator training
regarding the shutter systems, their operating conditions and the associatedmonitors and alarms (visual and audio) was insufﬁcient;– the role of the internal security committee (CIS) in relation to experimental
devices and experiments was limited at that time.
In the case of the ORPHÉE reactor, the coordination between the reactor operator
and the Laboratoire Léon Brillouin (LLB289), where the researchers were based, had room
for improvement; the facility manager was unable to properly exercise their safety
responsibilities in relation to the experimental devices.
As a result of these two events, the responsibilities of the two relevant facility managers for the safety of people and property were extended to cover experimental devices within their basic nuclear installation, and the training of operators in charge ofexperimental devices was improved.
For the ORPHÉE reactor, an agreement was signed in September 1989 by the facility
manager and the LLB, specifying the interfaces between the reactor facilities and theexperimental devices, and making provision for the designation of a facility manager
and safety engineer for experimental activities. This agreement also set out the respective responsibilities of this facility manager and safety engineer, and their relationshipto the ORPHÉE facility manager. The experimental activities facility manager was given
responsibility for the safety of people and property in the context of the general operating rules of the reactor, and charged with:– training the operators involved in experimental activities,– establishing the corresponding instructions and ensuring they are correctly
applied,– examining all signiﬁcant modiﬁcations to existing experimental equipment andthe implementation of new equipment,
289.

The LLB is a joint research unit (UMR) run by the CEA and the CNRS.

Elements of nuclear safety – Research reactors

206

with the use of experimental devices (or the implementation of significant modifications to previously authorized devices) dependent on, as for RHF, an examination by
the internal security committee (CIS).

10.2.

Measures to improve the safety of French
research reactors following the
Fukushima Daiichi accident

The accident that occurred at the Fukushima Daiichi nuclear power plant on
March 11, 2011, led the French Prime Minister to ask the Chairman of ASN, on
March 23, 2011, to perform a study on the safety of nuclear facilities, prioritizing nuclear power reactors, in the light of this incident. The study had to cover five points: therisk of flooding, earthquake, loss of electrical power supply and loss of cooling, as well as
the operational management of accident situations. The Prime Minister wanted thisstudy to consider, facility by facility, whether safety improvements were required, ina way that was consistent with the work carried out in a European context by ENSREG
and WENRA. He asked for the initial conclusions to be presented by the end of 2011.
At the same time, the European Council asked all the countries in the European
Union, at its meeting of March 24 and 25, 2011, to perform “stress tests” on their
nuclear power reactors, with regard to potential natural hazards (chiefly earthquakes
and flooding) on a scale exceeding the characteristics considered in the design of the
facilities (so-called “extreme” hazards).
In response to the Prime Minister’s request, ASN ordered nuclear facility operators
EDF, the CEA, AREVA and the Institut Laue-Langevin, through 12 resolutions taken on
May 5, 2011, to present:– “Provisions taken in the design basis of the facility and facility compliance to its
design requirements290;– the robustness of the facility beyond its design basis, by identifying, on the one
hand, a step change in the event sequence (cliff edge effect) and, on the other,measures for its avoidance;– proposals for modifications likely to improve safety of the facility and organizationin the event of an emergency.”
The studies performed in France by the operators constituted the “complementary
safety assessments” (CSA).
As explained in section 7.3.2, the design of French research reactors allows them, as a
general rule291, to reach, soon after shutdown, a state that requires no forced waterflow and limited electrical power supplies (for facility monitoring, any releases, etc.).
290.

291.

This involved a full assessment of these areas, incorporating the elements and justiﬁcations inthe safety reports (latest versions in force), any deviations or anomalies detected over time andtheir resolution, and past safety reviews.
Except in the case of the Jules Horowitz reactor.

Operating experience feedback from French research reactors

207

Furthermore, their radiological inventories are clearly significantly lower than those forpower reactors. On the other hand, it is important to take into account their specific risks(construction in notable seismic areas or downstream of dams, near urban areas, etc.).
This is why CSA have been performed for research reactors, according to the specifications drawn up by ASN, based on those proposed by WENRA for the European
power reactor stress tests, with an additional section on contractors providing services
to operators. Priorities were, however, identified according to the risks associated withthese reactors (taking a “proportionate” approach).
Regarding subcontractors, the Fukushima Daiichi accident showed that the capacityof an operator and, where relevant, its subcontractors to organize work in severe accident conditions is a key element of controlling such situations. This organizational
capacity is also a key element of preventing such accidents, maintaining facilities andensuring the quality of operations. As a result, the conditions of recourse to subcontractors are of special importance, and must allow the operator to retain full control overand full responsibility for the safety of its facility. It became clear that this aspect alsoneeded to be covered in the CSA (the subjects to be covered by French operators aredescribed in the focus section at the end of this chapter).
The complementary safety assessments involved assessing the behavior of research
reactors in response to extreme hazards, chiefly earthquakes and flooding, as well as in
the event of the loss of off-site electrical power or the off-site heat sink292, and in the
management of severe accidents, in a context in which all or part of the facilities at asite may be affected over the long term.
It should be noted that all the CSA performed in France, whether at power reactors
or research reactors (or other types of INBs), should be situated in the general context
of work to improve their safety, which is based on:– the integration of operating experience feedback,– the ten-yearly safety reviews, which include the reassessment of safety rules andrequirements based particularly on advances in knowledge.
In general, although they concluded that their facilities were well enough designed
to withstand plausible natural hazards, the operators of research reactors proposed
introducing a series of additional provisions, chiefly to increase the autonomy of themeasures planned at the corresponding sites to deal with ongoing situations that could
affect the long-term cooling of the reactor293 – which could arise from a loss of electrical power – or to strengthen the provisions for managing a large-scale emergency.
More specifically, the operators of French research reactors assessed the margins
available, beyond the reference seismic loads294, for essential safety-related equipment
items (sometimes referred to as “key SSCs”), such as reactor buildings and pools, naturalconvection valves, safety valves for neutron channels, etc. The behavior of equipment
292.
293.
294.

Water from outside the facility that can be used to remove the heat released by the reactor.
For example, without special cooling measures, the gradual evaporation of water from a reactor
pool would make it necessary to provide makeup water to avoid core uncovery.
Loads identiﬁed during the most recent seismic reviews.

Elements of nuclear safety – Research reactors

208

likely to jeopardize, in case of failure, these “key SSCs” has also been examined (overhead cranes in particular).
The expert assessment of the CSA sent to ASN by the operators of French research
reactors was performed by IRSN; ASN also sought the opinion of the standing group of
experts for nuclear reactors (GPR).
The margins estimated by the research reactor operators led ASN to rule that thefacilities could continue operating, but that improvements should be made to obtaina “hardened safety core” (see the focus section below) of particularly robust equipment
items, in order to withstand extreme hazards, such as an earthquake (hardened safety
core design-basis earthquake [SND]) and its effects. The operators of research reactors
were formally ordered to implement these “hardened safety cores” in 2013 throughASN resolutions. These “hardened safety cores” must aim to:– “prevent a severe accident or limit its spread,– mitigate large-scale releases,– enable the licensee to fulfill its emergency management duties,”
through appropriate measures to strengthen defense in depth.
Regarding the last point above, it became clear in particular that there was a generalneed to strengthen post-accident monitoring provisions at research reactors in terms ofanalyzing the state of these reactors in extreme situations, for instance in order to obtain information regarding the position of the natural convection valves or safety rods.
In its 2013 resolutions, the ASN issued requirements regarding the situations to betaken into account when designing “hardened safety cores”, specifically the “hardened
safety core design-basis earthquake”:– The situations (known as “hardened safety core situations”) to be taken into
account are:







the loss of electrical power supplies that do not form part of the “hardened
safety core”,
the loss of the heat sink (reactor cooling) that does not form part of the“hardened safety core”,
the external hazards identiﬁed for the “hardened safety core”,
situations arising from the state of the facility, the site and its environment
after one or more external hazards identiﬁed for the “hardened safety core”.

– The hardened safety core design-basis earthquake must:

encompass the seismic margin earthquake (SMS) for the site, augmented
by 50%,



encompass the spectra established using a probabilistic approach for a
20,000 year return period,take into account special site effects, notably soil type.

Operating experience feedback from French research reactors

209

The “hardened safety core” concept
Safety improvements to facilities such as nuclear reactors, in the light of lessons
learned from the accident that occurred at the Fukushima Daiichi nuclear power
plant in March 2011, aim to limit, as far as possible, short-, medium- and long-term
radioactive releases in the event of an extreme external hazard with the long-termloss of electrical power and the heat sink at a site. Indeed, in such situations it isdesirable that a nuclear facility avoid adding to the difficulties already facing the
emergency teams responsible for assisting the population. In the event of a natural
catastrophe of the kind that occurred in Japan in March 2011, the environment of
the affected site would be severely damaged, making it difficult to take action toprotect the site’s neighboring populations and, in the long term, manage the contaminated area.
The post-Fukushima “hardened safety core” therefore contains provisions toguarantee all the fundamental safety functions in the situations mentioned above(“hardened safety core situations”).
In addition, it has become clear that the “hardened safety core” should be defined by considering the loss of all the provisions already implemented as partof in depth defense, whose robustness to natural hazards significantly more extreme
than those identified during facility design cannot generally be established withgreat certainty.
This means that the “hardened safety core” includes provisions sufficiently robust to prevent, as far as possible, the fuel melting (in the core or storage pool)295 in
the situations mentioned previously; this involves stopping the nuclear chain reaction and maintaining fuel cooling, and implementing measures to limit releases insuch a way that reduces the radiological consequences in the event of the fuel melting, in terms of scale and duration. It must also be possible to guarantee that theoperator can perform the duties required of it in emergency situations. To do this,the “hardened safety core” provisions must ensure that emergency teams can accessthe information needed to assess the state of the facilities and prepare for on-site
operations. In the event of radioactive releases into the environment, the operator
must also be able to assess the consequences of these releases using not only thedata available from the facilities, but also measurements performed in the environment (meteorological, dose rate and radiological activity measurements). This
information must allow the operator and public authorities to make the decisions
for which they are respectively responsible in order to protect the personnel present
at the site and the general public. In this respect, it is therefore vital for the site tohave operational external communications systems in the situations under consideration.

295.

Principle applied in the various ASN resolutions issued to operators in 2013.

Elements of nuclear safety – Research reactors

210

In the definition of the “hardened safety core”, attention must also be paid to the“support systems”, which enable the operation of systems that directly perform
safety functions. These notably include electrical power generation and distribution
systems (generators or batteries, electrical switchboards), instrumentation and control systems, and ventilation systems (which perform the thermal conditioning
functions for rooms). For these systems, the aim is to ensure independence anddiversification in relation to existing systems.
For existing nuclear facilities, or facilities in an advanced state of design or construction (Flamanville 3 [EPR], the Jules Horowitz Reactor), it is not possible toensure that the “hardened safety core” contains only new equipment. It will ultimately consist of existing structures, systems and components, strengthened if necessary to ensure that they remain operational in the event of an external hazard, andnew structures, systems and components.
It is not easy to define the “levels” of extreme hazard to be considered when
designing the “hardened safety core”, especially in the case of seismic hazards.
The traditional approaches used to assess seismic hazards have been supplemented
with probabilistic methods, notably to target earthquakes associated with a 20,000year return period as requested by ASN in its requirements issued to operators.
....................................................................................................................................................................................................................

The reports on the complementary safety assessments carried out by French operators, drawn up according to the plan described in the focus section below and incorporating the additional provisions proposed (relating to the “hardened safety core” inparticular), have been made public296. It should be noted that, in some cases, these
CSA brought to light instances of noncompliance (related to equipement items, studies,etc.) in relation to the “key SSCs”, which therefore had to be resolved.
The RHF complementary safety assessment297 is covered in further detail below,
given the specific features of this facility in terms of earthquake and flood risks, andits proximity to urban areas. For example, this CSA resulted in the facility introducing(in stages from 2012 to 2016) various systems designed and sized for the hardened
safety core design-basis earthquake (see figures 10.8 and 10.9):– a seismic reactor shutdown system (ARS);– an emergency core ﬂooding system (CRU) linking the reactor block, which has alimited volume (15 m3), to the large-volume reactor pool (500 m3);
– a groundwater supply system (CEN) to mitigate potential reactor core uncovery,
with a ﬂow rate of 250 m3/h (for each of the two channels), compared to just
60 m3/h for the emergency cooling system (CES) implemented in 2006;– a new emergency ventilation system for the reactor building (seismic depressurization system [CDS]);
296.
297.

On the ASN website.
Rapport RHF n° 399 on the ASN website.

Operating experience feedback from French research reactors

211

Figure 10.8. Schematic diagram of additional measures installed at RHF after the Fukushima Daiichi
accident. © Georges Goué/IRSN.

– a new emergency control room (PCS298 3 building);– speciﬁc equipment (in PCS 3) to monitor some key parameters of the state of the
facility (the core neutron ﬂux, with two new neutron detectors attached to thereactor block in the light water pool; the conﬁguration of the natural convection
valves; the water levels in the reactor block and pool; and the pressure in thereactor hall and in the annulus between the two containment walls), with thevalues also being automatically sent to IRSN299 in the event of an accident.
These systems, the majority of which are redundant300 and automatic, are electrically powered by emergency generator sets in the new PCS 3 building, which was
designed to withstand not only the extreme hazards considered for the RHF site
(hardened safety core design-basis earthquake, equivalent to twice the seismic margin
earthquake at the relevant frequencies), but also the failure of the upstream dams
(PCS 3 is positioned six meters higher than the HFR site platform). They have been fully
operational since 2016.
Regarding the seismic reactor shutdown system, it is important to note that the
instrumentation and control for the reactor protection system had already beenadjusted to ensure that the safety rods301 drop automatically in the event of seismic
298.
299.
300.
301.

Poste de contrôle et secours [emergency control room].
To strengthen the analysis of the facility with the operator (in the context of implementing the
3D-3P approach mentioned in section 7.7).
There is only one PCS 3.
These are ﬁve control rods located in the reﬂector area, outside the fuel element that forms thereactor core in which the regulating rod slides.

212

Elements of nuclear safety – Research reactors

Figure 10.9. Three measures selected for the RHF at Grenoble after the Fukushima Daiichi accident, alldesigned and sized for extreme earthquakes and ﬂooding: on the top left, the pool inlet elbow of thegroundwater supply system. © IRSN; on the top right, the seismic depressurization system stackpositioned on the dome of the metal containment. © ILL; at the bottom, the PCS 3 emergency control
room. © Jean-Marie Huron/Signatures/IRSN.

loads, by setting the trigger threshold to 0.01 g302. It was then completely renovated tomake it independent from the other reactor protection systems, and it was qualified forthe “hardened safety core design-basis earthquake”. This provision ensures that thesafety rods drop ‒ even in the event of an earthquake without a weak movement phase(compressional waves known as P-waves) before the strong movement phase (shear
waves known as S-waves).
Still in the case of RHF, the operator studied two scenarios for failure of the dam(s)upstream on the Drac River, and their possible impact on the “key SSCs”. They were:
302.

The trigger threshold value for reactor scram is selected to be lower than the peak groundacceleration to allow sufﬁcient time to implement this reactor scram. A value of 0.01 g istypically reached when the primary seismic waves (P-waves) arrive; accelerations at the level ofpeak ground acceleration (several tens of g) are detected several seconds later, with the arrival of
the S-waves, which cause the most damage to equipment.

Operating experience feedback from French research reactors

213– failure of the Monteynard dam, which could lead to the failure of the NotreDame-de-Commiers dam downstream;– failure of all the dams on the Drac River, which would result in the highest
possible water level at Grenoble.
As a result of these studies, the operator considered a hypothetical water level of six
meters at the RHF platform. This was taken into account in the design of the new emergency control room building (PCS 3). The large openings in the reactor building (truck
entrances, etc.) were strengthened to ensure they could withstand a hardened safety
core design-basis earthquake and a water level of six meters at the site, while maintaining sufficient leaktightness to prevent large quantities of water entering the building.
In the definition of a “hardened safety core design-basis earthquake”, the issue ofsite effects is particularly relevant in the case of RHF, as the reactor is positioned in
an alluvial valley (the alluvium is around 700 m above the bedrock, and partially composed of clay). This is why the operator has been involved in research into the site effects since the 2000s (the CASHIMA project and, more recently, the SIGMA project303),and has had measurements (crosshole measurements304) and two-dimensional simulations performed with a view to better understanding these site effects. The multiplication factors applied to the spectra – which were previously established without taking
the site effects into consideration – are between 1.3 (for frequencies above 3 Hz) and 2(for frequencies below 0.3 Hz). The peak ground acceleration of the hardened safety
core design-basis earthquake at infinite frequency is 0.6 g, compared to the value close
to 0.3 g identified during the seismic review in the early 2000s. Ultimately, at therelevant frequencies for structures, systems and components, the hardened safety core
design-basis earthquake for RHF is twice as high as the seismic margin earthquake selected for the seismic reassessment in the early 2000s.
The capacity of the “key SSCs” (overhead cranes, neutron channel safety valves,etc.) to withstand a hardened safety core design-basis earthquake was checked, including by vibrating table tests. This led the operator to strengthen:– the overhead cranes for fuel casks,– the large equipment near the edge of the pool (vertical “cold source”, etc.),– the cask maintenance station (potential hazard to the reactor containment),– the large openings in the reactor building (truck entrances, etc.).
The operator of RHF decided to make some modifications to the “hardened safetycore” as initially planned. In particular, these modifications involved rerouting the emergency ventilation system, rerouting cables to ensure they were not swept away in theevent of extreme flooding (they are buried at a depth of 5 meters) and taking into account the chemical risks associated with the site environment. They also included
designing the PCS 3 emergency control room to be habitable and operational in the
303.

304.

See “Current state of research on pressurized water reactor safety”, Science and Technology
Series, IRSN/EDP Sciences, 2017. Numerous European partners, both industrial operators andresearch organizations, including universities, are involved in these two projects.
Measurement of the velocity of the shear waves at a depth of 30 m ‒ see the same publication.

Elements of nuclear safety – Research reactors

214

event of an accident involving phosgene release from the Pont de Chaix chemical platform (special ventilation/filtration system).
As mentioned previously, the “water block” principle was adopted for the design of
the CEA reactors, such as OSIRIS, ORPHÉE and the Jules Horowitz reactor; this is a favorable design option for reactor cooling, as it guarantees that there is a sufficient volume
of water in the reactor in the event of a leak in a section of core cooling system piping
outside the reactor block. However, it is impossible to fully rule out the possibility, in
extreme situations, of a loss of leaktightness in the rooms or bunkers in which these
sections of piping are located, even though margins are built into the design of theserooms and bunkers305.
For reactors in operation (ORPHÉE, CABRI, etc.), various supplementary provisions
have been proposed by the CEA: additional electric generator sets, makeup devices witha mobile water supply, additional measurement systems (water levels, etc.) and remote
shutdown stations to monitor the facilities after an extreme hazard. In addition,
strengthened provisions have been scheduled for 2015 to 2018 to allow effective emergency control even in extreme situations (setting up facility survey teams after an extreme hazard, strengthening or building rooms for equipment and systems that may be
used in extreme situations).
For the Jules Horowitz reactor, the complementary safety assessments306 was
performed by the CEA on the basis of the reactor design as of 2011. Various typesof provision were selected for the continuation of the project, such as:– the introduction of additional design margins for some items of equipment (newfuel storage rack anchors, rollers and tracks for the walkway over the reactor pool,etc.). In addition, measurement systems (natural convection valve position, waterlevels in pools and the reactor pool water temperature) were identiﬁed as“hardened safety core” equipment items;– the decision to make available, in addition to emergency generator sets and thepossibility of electrical power being supplied by a mobile set at the Cadarache
center, a permanent ultimate diesel generator (GUS), qualiﬁed as “hardened
safety core” (notably installed on a non-ﬂoodable platform);– the creation of two connections on the emergency secondary cooling system toallow the supply of cold water from external sources (tankers equipped with anautonomous pump);– the storage of a sufﬁcient volume of water in the pool drain tanks for emergency
water makeup to these pools, with this makeup system designed for the hardened
safety core design-basis earthquake;– the addition of a system for reactor scram in the event of an earthquake being
detected.
305.
306.

Designed for the seismic margin earthquake.
File published on the ASN website: Réacteur Jules Horowitz ‒ Évaluation complémentaire de lasûreté au regard de l’accident survenu à la centrale de Fukushima I [Jules Horowitz reactor –Stress test following the Fukushima I accident] (CEA/DEN/CAD/DIR/CSN DO 575 13/09/11).

Operating experience feedback from French research reactors

215

Subjects covered in the reports on the complementary
safety assessments performed by operators after the
Fukushima Daiichi nuclear power plant accident
The complementary safety assessments reports were drafted based on the following standard format:– site characteristics and current state,– identiﬁcation of cliff edge effect risks and essential structures andequipment:
The cliff edge effect is defined as a sudden change in the behavior of a facility
caused by a slight change in the envisaged scenario for an accident, the consequences of which are then much more severe307.
– earthquakes: events considered (during design studies, then during safety
reassessments), quantiﬁcation of margins,– external ﬂooding: events considered (during design studies, then duringsafety reassessments), quantiﬁcation of margins,– other extreme natural phenomena,– loss of electrical power and loss of cooling systems,– severe accident management,– conditions of recourse to subcontractors:
the scope of the activities in question, with supporting arguments,
the process by which subcontractors are chosen: requirements in termsof qualiﬁcations, training in nuclear safety and radiological protection,etc.),
 measures taken to allow for satisfactory working conditions for
subcontractors, the organization implemented to provide radiologicalprotection for workers,
 procedures for oversight of subcontracted activities, particularly the way
in which the operator continues to assume responsibility with regard tonuclear safety and radiological protection.
– summary, including any proposals for supplementary measures.
....................................................................................................................................................................................................................

307.

Ofﬁcial Journal of the French Republic No. 0125 of May 31, 2012.

Chapter 11
Overview of simulation software usedin design studies and safety analyses
for French research reactors
The design or modification of research reactors and their experimental devices (including the modification of cores), just like the associated safety demonstration – including during safety reviews – is based on studies, generally performed using simulation
software308, in various areas: neutronics or criticality (for cores and areas dedicated tofuel storage), thermohydraulics (for cores and cooling systems), structural mechanics(for metal structures and civil engineering works), etc. It is chiefly the operators (CEA,
Institut Laue-Langevin) that perform these studies, but IRSN may also perform themas part of its expert assessment of the files submitted by these operators to the ASN.
It is, of course, important to validate simulation software before it is used for studies. The ability of each simulation software tool to accurately or conservatively represent the physical phenomena in question must also be established as part of a safety
demonstration, or the expert assessment of such a demonstration.
In this respect, section 8.3 on the so-called “BORAX” reference accident presents
examples of general demonstration tests performed in reactors or on models to reinforce evaluations performed by calculation. Indeed, this type of verification can bedesirable, or even necessary, in cases where the evaluations performed by calculation
are subject to or result in too high a level of uncertainty (including due to simplificationof the modeling) or when the software has only been validated separately to its various
physical models.
308.

The expression “computer code” is also used.

Elements of nuclear safety – Research reactors

218

It is also important to recall here the special importance, in the case of a new reactor (or a reactor that has undergone substantial modification), of startup tests (or restart tests) performed by the operator on various items of equipment or systems toensure, as far as possible309, that they are able to perform the functions for which they
were designed, with the performance expected from the design studies largely based on
the use of simulation software.
Some of the software used310, in gradually improved versions over time, and their
key applications311 in French research reactors are described briefly below. This description is generally limited to the possibilities offered by these software tools, the context
and aims of the studies for which they are used, as well as some elements concerning
the modeling, and precautions to be taken to achieve a satisfactory level of confidence
in the results obtained – adjustments based on operating experience or the comparisonof different software.
A number of these software packages were initially developed for power reactors(for example FLICA, CATHARE and SIMMER). They have been adapted for use with research reactors (e.g. for reactors using uranium- and aluminum-based fuel in the formof plates, with heavy water as a coolant or moderator, etc.). In addition, neutronics andthermohydraulics software for cores and reactor systems can be combined312, forexample CRONOS-FLICA, CRONOS-CATHARE or even CRONOS-FLICA-CATHARE ‒ thislast combination forms the HEMERA (Highly Evolutionary Methods for Extensive Reactor Analysis) software chain.
Lastly, attention may be drawn to the fact that the complexity of research reactor
cores, which combine standard fuel elements, fuel elements that may partially containneutron absorbers, control absorbers (rods or plates) in or close to the core and highly diverse experimental devices in various locations in or close to the core (for example, loops
that may be cooled with coolants other than those used to cool the core in which they are
installed, such as liquid sodium), naturally requires the use of relatively sophisticated simulation software, especially in relation to neutronics. The 2004 discovery of melted rods inthe driver core of the CABRI reactor (section 10.1.2), which was caused by underestimating
the temperatures reached in the rods in question, confirms this complexity.

" Neutronics– APOLLO: this software313 for two-dimensional (2D) simulation in the ﬁeld of
neutronics, based on neutron transport theory (the Boltzmann equation) in a
309.
310.
311.
312.

313.

Indeed, it is not possible to envisage creating accident situations in order to check that theequipment designed to control these situations works correctly.
In particular, see “Neutronics”, a monograph by the Nuclear Energy Division of the CEA, Le
Moniteur, 2013.
The applications detailed in this chapter also form the subject of publications.
Although they were produced for pressurized water reactors, some of these coupled software
packages have been, or can be, used for certain research reactors, while others need to beadapted.
In the ﬁeld of neutronics, a distinction is drawn between the expressions “software” and“calculation scheme”: “calculation scheme” refers to the sequence of physical models linked to aclearly deﬁned “library” of cross sections.

Overview of simulation software used in design studies and safety analyses for French research reactors

219

stable state (stationary), but able to simulate fuel burnup314 (so-called“evolution” code) and take into account a large number of neutron energy
groups (300 for normal calculations), is principally used to determine the“libraries” of cross sections315 than can then be used with the CRONOS softwarepresented below. These are multi-parameter “libraries” of cross sections (theparameters may be temperature, water density, etc.) “condensed” into several
energy groups and homogenized in “cells” selected for the representation of thesystem being studied (an assembly, a rod or a plate, a pellet, etc.). In principle316,
APOLLO (2) can also be used to determine the core neutron balance (productionof neutrons via ﬁssion, absorption and leakage) with the relevant neutron
parameters (neutron balances such as the effective neutron multiplication factor
keff; kinetic parameters such as neutron life or delayed neutron production;neutron feedback; the efﬁciency of absorbers, etc.).
– CRONOS: This software for the three-dimensional simulation of reactor coreneutronics solves either the transport equation or the diffusion equation by using
the ﬁnite element method for several neutron energy groups (two groups are
sufﬁcient for the current calculations). It can be used to determine the distribution,in three dimensions, of the core power as well as the change in this power overtime during incident or accident transients, the efﬁciency of neutron absorbers, etc.
CRONOS can also simulate fuel burnup (so-called “evolution” code). The crosssections needed for the code come from calculations performed using the APOLLO
software and are entered as input data. CRONOS is a multi-reactor type code:
there is nothing in its organization or structure that makes an assumption about
the type of reactor for which the calculations are being performed. This means that
calculation schemas using CRONOS (2) have been assembled (notably in terms ofmeshing) for a large number of reactors, including research reactors (ﬁgure 11.1).
– MCNP: This software for three-dimensional geometrical simulation, developed by
the Los Alamos National Laboratory is historically the ﬁrst simulation software
based on the Monte Carlo method (Monte Carlo N-Particle transport code).
MCNP can be used for a variety of particles (neutrons, electrons, photons, etc.). It
is used in a range of ﬁelds, including, in addition to reactor physics, radiologicalprotection, dosimetry, criticality and medical physics.
For a reactor core, the principle behind the software involves following the history of each neutron in the system being studied, from birth (external source,from fission, etc.) to death (capture by a nucleus or leakage outside the system).
With the MCNP software, a continuous neutron energy spectrum is usually used,
but a discretized spectrum may also be used. Although the MCNP software cansimulate fuel burnup (so-called “evolution” code), it is not suitable (similarly tothe other Monte Carlo software described below, at the current stage of its development) for simulating transients in a reactor, as the neutron feedback is not correlated to temperature.
314.
315.
316.

Fuel consumption through irradiation.
Cross sections constitute indicators of the likelihood of interaction between neutrons and thematerial; this likelihood depends on the neutron energy.
Highly complex calculation with APOLLO version 2; it will be simpler with version 3.

Elements of nuclear safety – Research reactors

220

Figure 11.1. From the actual core geometry of the Jules Horowitz reactor (top left) to its subdivision
into hexagonal macro-elements (top right) and meshing in ﬁnite isoparametric elements (bottom),performed by the CEA in order to calculate, using the CRONOS (2) software, the core power
distribution (source: CEA monograph). © DR.

The history of each neutron depends on its interactions with the material. The distance traveled by the neutron between two collisions, the nuclei involved and theinteraction types are parameters that are randomly sampled by using experimentresults grouped into “libraries” of nuclear data. In this way, by increasing the monitoring of many neutrons, it is possible to simulate the natural behavior of the system and calculate numerical values close to certain core neutron parameters(balances such as keff and kinetics coefficients, but not temperature-dependent
feedback). As this type of calculation is based on probabilities, it is necessary to
perform extensive random sorting to reduce the statistical uncertainty317. Some
calculations can last several months, hence the importance of using powerfulcomputers. The geometric representation of the system studied is based on a precise, geometric description of the surface of objects, defined according to the
problem to be solved and which may vary a great deal in size (from a core area
to a fuel pellet, for example). This is known as “surface representation”. The MCNP
software package can therefore be used for precise neutronics calculations.
– TRIPOLI (TRIdimensionnel POLYcinétique): This three-dimensional simulation
software tool, under development by the CEA since the 1960s, uses the Monte
Carlo method to solve the transport equation for neutrons and photons, the latter
317.

The statistical uncertainty regarding the result of a calculation is given by the central limit
theorem: the standard deviation of the result is proportional to the inverse of the square root of
the number of neutrons monitored.

Overview of simulation software used in design studies and safety analyses for French research reactors

221

resulting from the nuclear reactions generated by the neutrons (ﬁssion or capture– the photons take the form of γ radiation). Similarly to the MCNP software, acontinuous neutron energy spectrum is usually used for TRIPOLI, but a discretized
spectrum may also be used. The TRIPOLI software can simulate fuel burnup (socalled “evolution” code), but, for the same reason as in the case of the MCNP
software, it cannot simulate transients in a reactor. With TRIPOLI, the systembeing studied can be processed by surface deﬁnition (as for MCNP) or using a
combinatorial volume method (in which the user speciﬁes the volume types andthe link between the volumes). It is mainly used for reactor core physics,
criticality and radiological protection. The TRIPOLI software is frequently used in
France for precise neutron calculations (so-called “reference” calculations).
Examples of use:
The CEA uses the TRIPOLI software for neutronics studies at its research reactors(CABRI, the Jules Horowitz reactor, etc.). It also used TRIPOLI (4) in parallel with
APOLLO (2)318 to examine the impact of UMo fuel on the cycle duration and performance of the Institut Laue-Langevin high flux reactor.
– MORET: This simulation software, under development by IRSN since the 1970s,
calculates neutron transport using the Monte Carlo method. It is generally usedwith a discretized neutron energy spectrum. The geometric representation is lessdetailed than that possible using the meshing tools associated with MCNP andTRIPOLI. The MORET software makes it possible, for complex three-dimensional
systems containing ﬁssile materials, to determine the following main values(excluding feedback correlated to temperature): the effective neutron multiplication factor (keff), the neutron ﬂux, the reaction rates (ﬁssion, absorption anddiffusion) in the different volumes, neutron leakage outside the system and the
kinetic parameters of the system (proportion of delayed neutrons and theirgeneration times, neutron life, etc.). The geometric model of the system being
studied is processed using the combinatorial volume method. More speciﬁcally,
the software is used to study the criticality risks in nuclear facilities (i.e. theappearance of an uncontrolled chain reaction outside the reactor cores inoperation), in its “environment” known as CRISTAL319, which offers different
datasets (and other software such as APOLLO (2) and TRIPOLI (4)).
Examples of use:


318.
319.

The MORET software is principally used by IRSN for its expert assessmentsof the criticality risks in fuel cycle facilities. However, for the past ten years
or so, IRSN has also been using it for reactors, as in the case for a study
designed to learn lessons from a fuel loading error that occurred inreactor 4 of the Dampierre nuclear power plant (Loiret department) in2001. At the start of the 2010s, IRSN also used MORET (5) to simulate tests

CEA publication cited in footnote 300.
The CRISTAL formula is being developed and qualiﬁed as part of a collaboration between IRSN,
the CEA, AREVA-NC (Orano) and AREVA-NP (Framatome). This ensemble includes “libraries” ofnuclear data, calculation procedures, simulation software and interface tools. Its purpose is toevaluate the criticality conditions of nuclear facilities and ﬁssile material transport packaging.

Elements of nuclear safety – Research reactors

222

performed in the American reactor SPERT in the 1960s, which aimed to
study the response of a reactor core to stepwise reactivity insertions. This
simulation was carried out as part of an exercise to benchmark simulation
software packages organized by the IAEA (on innovative methods forresearch reactors320), which aimed to evaluate the ability of different
simulation software tools (used in reactor design, safety demonstrations or
the expert assessment for these demonstrations) to reproduce somemeasurements performed directly on various research reactor cores, in theﬁelds of both neutronics and thermohydraulics. The MORET (5) simulation
software notably made it possible321 to reproduce the radial distribution of
power in SPERT-IV-D 12/25 core assemblies (see ﬁgure 11.2), which wasthen used for assembly heating calculations using the CESAR software fromthe ASTEC code (see below).


320.
321.

322.

In 2008, in the context of the review of the BORAX-type accident for the
ORPHÉE reactor, the CEA decided that the envelope reactivity insertions
considered likely for the reactor would not lead to an explosive interaction
between melted fuel and water (steam explosion). In order to evaluate thebasis for this conclusion, IRSN performed a study in 2010 using the MORET(5) software to independently determine the reactivity insertions for the
scenarios identiﬁed by the CEA, including the simultaneous rupture of thetwo “cold sources”, the “hot source” and the nine horizontal thimbles(ﬁgure 11.3). Physically, these items of equipment, most of which contain agas, create leakage spaces for neutrons, which do not therefore participate
in the chain reaction. If heavy water gets into these spaces, the effect ofneutron reﬂection by the heavy water is heightened, which increases core
reactivity. The reactor model used was reﬁned in order to re-establish someneutron parameters based on the calculations performed when the reactor
was designed (before 1980) – using the TRIPOLI and TRIDENT software – ormeasured, such as the multiplication factor keff, for various control absorberpositions, critical absorber position, efﬁciency in terms of reactivity, etc.
The IRSN study indicated a maximum reactivity insertion signiﬁcantly
higher than that derived from the CEA calculations, leading the CEA to
update its own studies by using a more recent version of the TRIPOLI
software, which conﬁrmed IRSN’s results. It was then important for IRSN to
make sure that the simultaneous failure of all horizontal thimbles, inparticular, could be ruled out, by ensuring that the thimble material(AG3NET alloy) was sufﬁciently ductile at the end of its service life. Due tohaving underestimated the ﬂuence322 received by these thimbles, theoperator reviewed its thimble replacement schedule. More speciﬁcally, theASN ordered (on the advice of the GPR) the operator to check the schedule

IAEA Coordinated Research Project 1496 (2008-2013): Innovative Methods in Research Reactor
Analysis.
See IRSN communication at the TOPSAFE 2012 conference: Interpretation of reactivity accident
transient on research reactors on example of SPERT-IV-D 12/25 Benchmark, Ivanov E., Maas L.,
Écrabet F.
Value used to establish the maximum service life for thimbles (see footnote 231).

Overview of simulation software used in design studies and safety analyses for French research reactors

223

Figure 11.2. On the left, general diagram of the SPERT-IV-D 12/25 core; on the right, a fuel element
and control element containing control plates. © Phillips Petroleum Company-Atomic Energy Division.

Figure 11.3. 3D model of the ORPHÉE reactor, notably showing the neutron channels, prior to use of
MORET simulation software. © IRSN.

for replacing the horizontal thimbles and “cold source” thimbles to ensurethat the reactivity “weight” of the devices with very low ductility was
limited (with the operator giving a precise deﬁnition of the ductility andreactivity “weight” criteria used).
323.

In 2011, a similar study323 was performed by IRSN using MORET (5)software to evaluate the envelope nature of the reactivity insertion

For this study and the previous, see the IRSN publication presented at an IAEA conference in
Rabat, Morocco, in 2011, entitled “Safety approach of BORAX type accidents in French research
reactors”, Chegrani Y., Gupta F., Tiberi V., Heulers L.

Elements of nuclear safety – Research reactors

224

identiﬁed by the CEA in its study on the BORAX-type accident for the Jules
Horowitz reactor. The reactivity insertion corresponds to the ejection of acontrol rod containing hafnium, which is the material that absorbs
neutrons. An envelope reactivity insertion value had been determined by
the CEA on the basis of calculations performed using the APOLLO (2),CRONOS (2) and TRIPOLI (4) software. The aim of the IRSN study was toverify this envelope nature, notably by calculations to establish sensitivity
to various parameters. The MORET (5) software can be used to determine
the reactivity insertion by taking the difference in two effective multiplication factors (keff) calculated for two core states: control rod inserted andcontrol rod ejected (leaving a “water hole”).
The modeling used with the MORET (5) software had already been veriﬁed324
for a core conﬁguration by comparing certain parameters, such as keff, tothose from the CEA calculations (APOLLO (2) and TRIPOLI (4)).
The parameters studied in the sensitivity calculations were core fuelburnup, the initial conﬁguration of the control rods and the reactivity ofexperimental devices (ﬁgure 11.4).
The results obtained using the MORET (5) software conﬁrmed the results of
the CEA study into the reactivity insertion in the event of control rod
ejection, notably: the higher reactivity “weight” of the control rods in theﬁrst core ring and the conservative nature of the new core in comparison toan irradiated core. They also demonstrated the weak inﬂuence ofexperimental device reactivity on the reactivity insertion in the event ofan accident.

" Thermohydraulics– CATHARE (Code Avancé de THermohydraulique pour l’Etude des accidents deRéacteurs à Eau): This two-phase thermohydraulics “system code325” has mainly
been developed and used for safety analyses on pressurized water reactors (astudy on the thermohydraulic behavior of reactors during incident or accident
transients, updates of the associated processes), and research and development
work. It has also been incorporated into IRSN’s SOFIA simulator326.
The CATHARE software has been under joint development by the CEA, EDF,
AREVA-NP and the IRSN since 1979. The core and systems selected for a study
324.
325.
326.

The match was found using the same library of cross sections as that used by the CEA.
A “system code” allows a system and its components (fuel, exchangers, pumps, structures, etc.)
to be modeled in their entirety.
SOFIA (Simulateur d’Observation du Fonctionnement Incidentel et Accidentel – simulator for
observing operation during incidents and accidents) is an information system used by IRSN for
studies and training. It can calculate and monitor changes in the physical parameters of a pressurizedwater reactor in real time. It can also be used to simulate equipment failure and operator actions. The
calculation can be stopped at a given moment to examine the state of the facility, and it is possible togo back to modify the scenario being studied. The reactors modeled in SOFIA are those in the French
nuclear power ﬂeet (900 MWe, 1,300 MWe, 1,450 MWe and EPR reactors).

Overview of simulation software used in design studies and safety analyses for French research reactors

225

Figure 11.4. One of the core conﬁgurations of the Jules Horowitz reactor studied by IRSN using the
MORET (5) software (with the inserted rods in red, the withdrawn rods in blue, and the experimental
devices in green). © IRSN.

can be modeled in one dimension (1D), with the core represented by a “standard”
channel or assembly, but the CATHARE software also has a 3D module that can
provide a three-dimensional representation of the vessel and core.
Example of use:
In the early 2010s, the CEA, in order to draw up the preliminary safety analysis for
the Jules Horowitz reactor, and IRSN, to perform the expert assessment of thisreport, used the CATHARE (2) software to study the “guillotine break of a particular element” (RGEP) accident for this reactor (the single core water supply
collector ‒ see figure 5.11). The aim was to ensure that this type of break could
not initiate core melt in the reactor. The criteria selected for this purpose were azero void fraction in the core (no boiling) and a maximum fuel plate cladding
temperature of 400°C (to avoid failure due to creep).
The two cases studied (figure 11.5) were a double-ended guillotine break in thepool and a guillotine break with limited displacement in a room (a bunker, where
the piping in this bunker has an anti-whip restraint). Several conditions were selected for the initial state of the reactor just before the break, namely those that
initially seemed the most conservative (maximum reactor power, minimum corecooling flow rate, minimum water pressure at the core outlet, minimum watertemperature at the core inlet and minimum water level in the reactor pool).
The simulations performed notably resulted in:the reactor scram being triggered almost immediately, due to the lowpressure threshold at the core outlet being exceeded;

Elements of nuclear safety – Research reactors

226




gravitational ﬂow in the emergency suction lines, from the pool,compensating for the outﬂow via the break and maintaining a satisfactorywater inventory in the reactor coolant system (ﬁgure 11.5);in the case of the break in the bunker, the outﬂow through the breakdecreasing as the bunker ﬁlled with water and the broken section of piping
was submerged.

The minimum margins in relation to the criteria selected were generally achieved
shortly after the reactor scram.
The study performed by IRSN notably assessed the sensitivity of the results obtained by the CEA – indicating compliance with the criteria given above – to somescenarios, including, for example, the behavior of the reactor coolant pumps (riskof cavitation) just after a break has occurred, or the time it takes for a break to
open. This study highlighted a risk of failing to comply with the criteria and, consequently, showed that the CEA needed to provide evidence to justify that there
would be a sufficient water flow rate through the pumps to cool the core, even if
the reactor coolant pumps were (temporarily) operating in degraded mode.
In addition, the CATHARE (2) software allowed the CEA to determine the forces
experienced, notably by the anti-whip restraint in the case of a break in the bunker; these forces had to be calculated for the mechanical design of this device.
The CEA calculation showed the full importance of this device, as a double-ended
break in the bunker could lead to core melt.

Figure 11.5. Diagram of Jules Horowitz reactor circuits and position of guillotine breaks (RGEP)
studied. © Georges Goué/IRSN.

Overview of simulation software used in design studies and safety analyses for French research reactors

227– FLICA, DULCINEE: These software tools are used to simulate the thermohydraulics in a reactor core and the thermal behavior of the fuel. They have beenused at French research reactors for several decades. The DULCINEE software has
a neutron model known as a “point kinetics” (or “0D”) model, which can perform
calculations combining simpliﬁed neutronics and thermohydraulics.
The FLICA (4) software can be used to create a three-dimensional representationof a reactor core and process the two phases of the cooling fluid (liquid andsteam). For thermal transfers in the fuel, the modeling is one-dimensional (1D).
Together with the CRONOS software, the FLICA software can be used to obtain amore detailed representation (3D) of the core for transient studies performed
using the CATHARE “system code”. Figure 11.6 shows how they can be combinedin the HEMERA software chain.
Example of use:
In order to determine the thermal energy deposited in the Jules Horowitz reactor
fuel in the event of the accident reactivity insertion selected for the BORAX-type
accident (control rod ejection) study, the CEA used327 the combined CRONOS (2)and FLICA (4) software (without modeling the expansion of the fuel plates, a phenomenon that reduces the thickness of the water channels between the plates,
thereby generating negative reactivity). The “point kinetics” DULCINEE code
was also used for sensitivity studies, as this software (“0D”) is suitable for smallcores such as that at the Jules Horowitz reactor.
– CFD (Computational Fluid Dynamics) codes: The use of this type of simulation
software is becoming more common, including at research reactors, to determine
ﬂuid ﬂow on a local scale by solving Navier-Stokes equations averaged over timeand space, in a domain discretized using meshes ranging from a millimeter to a
centimeter in size.
Examples of use:


327.
328.

329.

In 2010, the Institut Laue-Langevin performed, in collaboration with the
Argonne National Laboratory (ANL, Illinois, USA), studies328 on thefeasibility of “converting” RHF to UMo fuel with low uranium-235
enrichment. Two CFD-type software tools were used: the STAR-CD
software (used by the ANL) and the CFX software developed by ANSYS329(used by the ILL). The validity of the models was checked throughcomparison with in-reactor measurements and benchmarking against theresults of various models. These studies showed that changing the fuelwithout modifying the fuel plates would result in a signiﬁcant degradation

In particular, see the CEA presentation at the TOPSAFE 2008 conference: “The BORAX accident in
the JHR”, Maugard B., Elie J.-P., Trémodeux P., Iracane D., Lemoine P., Ratel G., Berthoud G. et al.
In particular, see the ANL–ILL–communication at the RERTR 2010 conference on reduced fuelenrichment for research and test reactors: “Thermal-hydraulic safety analyses for conversion of
the Laue Langevin Institute (ILL) High Flux Reactor (RHF) from HEU to LEU fuel”, Tentner A.,
Thomas F., Bergeron A., Stevens J. (https://www.rertr.anl.gov/RERTR32/pdf/S10-P4_Tentner.pdf).
ANSYS Inc. is an American company.

Elements of nuclear safety – Research reactors

228

Figure 11.6. The combined CRONOS (2), FLICA (4) and CATHARE (2) software packages in the
HEMERA chain: interface parameters between these three software packages. © IRSN.

in reactor performance, notably in terms of neutron ﬂux. Other designs
were then studied for the fuel element. One of these, which increased thequantity of fuel without changing the external dimensions of the plates,
would maintain good reactor performance while securing safety margins inrelation to the risk of boiling in the water channels between the plates.
“Converting” the RHF core, however, is still dependent on developing andqualifying a new type of fuel with higher density than UAl.


In 2010, the Institut Laue–Langevin also used a CFD code (CFX) to study
the behavior of RHF thimbles, to demonstrate that the core fuel element
would not melt in the event of a reactivity insertion resulting from therupture of one or several thimbles.

" Thermomechanics– SCANAIR: This software, which has been under development by IRSN since 1990,
can be used to simulate the thermomechanical behavior of fuel rods in pressurizedwater reactors during power transients, and evaluate the risks associated with aloss of leaktightness or cladding failure. It is notably used to deﬁne, prepare andinterpret tests to assess the capacity of fuel rods to withstand such transients,
such as those that have been, or will be, performed as part of the CIP program at
the CABRI reactor. The SCANAIR software can simulate rapid reactivity insertions(Reactivity Injection Accidents [RIA]) or slow power ramps such as those that could

Overview of simulation software used in design studies and safety analyses for French research reactors

229

result from the rupture of steam piping or even the uncontrolled withdrawal of arod cluster control assembly in the core of a pressurized water reactor. In
particular, the SCANAIR software models the thermomechanical interactions
between the fuel pellets (UO2, UPuO2) and rod cladding, the boiling of the coolant(water) and the various deformation mechanisms of the cladding material.
Example of use:
In its research to explain the melting of the fuel rods in the driver core of the
CABRI reactor, discovered in 2004 (section 10.1.2), the CEA, the operator of thisreactor, used several simulation software tools, including APOLLO (2), TRIPOLI(4), DULCINEE and SCANAIR. As indicated in section 10.1.2, the CEA concluded
that the effects of the transients at CABRI on the rods of the driver core wereinsufficiently estimated in the safety analyses performed before these transientswere carried out. The CEA then decided to develop a new calculation tool for thestudies to be performed before future tests in the pressurized water loop as partof the CIP program. This tool links the SCANAIR330 software to appropriate
datasets. As part of the expert assessment of the file sent by the CEA aiming
to demonstrate that the driver core could undergo future tests as part of the
CIP experimental program without any damage, IRSN, as the developer of the
SCANAIR software, had the expert assessment of the new CEA tool completed
by AVN (Belgium), which did not issue any contraindications regarding the useof this tool. In addition IRSN used the SCANAIR software for a study331 aiming
to assess the validity of new strength criteria for the cladding of fuel rods in
the CABRI core, which were proposed by the CEA. The aim of this IRSN study
was to assess whether these new criteria were consistent with the results of tests
performed in the SPERT and NSRR reactors in the USA and Japan respectively.
These tests had made it possible to determine a failure threshold for stainlesssteel cladding expressed in terms of the energy deposited in the fuel (approximately 240 cal/g). In order to perform this study, it was vital to strictly use
the same version of the SCANAIR software and datasets as those developed by
the CEA for its own calculations of the impact of the future CIP tests on the drivercore. The CEA made these elements available to IRSN. The IRSN study showedthat the new criteria, expressed332 in terms of maximum cladding temperature(1,300°C) and maximum equivalent cladding deformation (3.65%), were consistent with a failure threshold of 240 cal/g.

" Core melt accidents– SIMMER: This software, which combines neutronics and ﬂuid mechanics, cansimulate a core melt accident in a fast neutron reactor. It was initially developed
330.

331.

332.

The CEA had initially envisaged linking the CATHARE and SCANAIR simulation software, but inthe end it decided to use just the SCANAIR software and undertake major work to calibrate andvalidate the thermohydraulic module to adapt it to the conﬁguration of the CABRI driver core.
See the communication by IRSN at the IGORR 12 conference in 2009: “Analysis of CABRI drivercore new safety demonstration for fuel rods integrity during fast power transients”, Écrabet F.,
Pelissou C., Moal A.
Excluding the absence of fuel melt (the melting point of UO2 is around 2,840°C).

Elements of nuclear safety – Research reactors

230

at Los Alamos, from 1974 onwards. PNC (Power reactor and Nuclear fueldevelopment Corporation, Japan), FzK (Forschungszentrum Karlsruhe, Germany,
later the Karlsruher Instituts für Technologie [KIT]) and the CEA have continued its
development for studies on fourth-generation fast neutron reactors. In France, it
was used in the 1980s and 1990s to study theoretical core melt accidents in fast
reactors (chieﬂy SUPERPHENIX).
Example of use:
In the 2000s, IRSN, together with FzK, adapted the SIMMER III software for theJules Horowitz reactor, for exploratory studies into a BORAX-type accident.
Numerous adaptations were necessary, notably to be able to correctly simulate
the neutronic behavior of the core and the fuel used in this type of reactor, in theform of curved plates333. These studies have notably shown that the energy
deposited in a core like that of the Jules Horowitz reactor could potentially exceed the inclusive value of 135 MJ and that the sequences involved (the simultaneous ejection of several control rods, for example) should be highly unlikely(through robust design, manufacture and in-service monitoring measures).
– MC3D: MC3D is a multi-phase thermohydraulics software developed by the CEAthen IRSN. It can be used to simulate the steam explosion that would result froma thermodynamic interaction between the fuel (notably when it is in a liquidstate) and the coolant in a reactor; such a phenomenon could occur during areactor core melt accident. In particular, this software can be used to determine
the dynamic pressures on structures (such as the walls of the reactor pool, forexample). To begin with, it simulates the ﬁrst phase of the thermodynamic
interaction, called premixing, which is the rough mixing of the two ﬂuids
accompanied by varying degrees of vaporization. In some conditions, premixing
can be destabilized, which may lead to a violent explosion similar to a detonation(second phase).
Example of use:
The CEA used the MC3D software to study the interactions between melted fueland water during a BORAX-type accident for the Jules Horowitz reactor334, notably to determine the loads that could be experienced by, firstly, the reactor block
vessel and piping connections and, secondly, the reactor pool walls and floor;
these loads would be created by the shock waves and their multiple reflections,as well as the expansion of the steam bubble.

333.

334.

IRSN communications: International Conference on the Physics of Reactors, PHYSOR 2008:
Upgrading of the coupled neutronics-ﬂuid dynamics code SIMMER to simulate the research
reactors core disruptive RIA, Biaut G. et al.; TOPSAFE 2008 conference, “Reevaluation of BDBA
consequences of research reactors”, Biaut G. et al. See also the joint IRSN-CEA communication at
the 18th International conference on Nuclear Engineering [ICONE]) in 2010: “Validation of
SIMMER III neutronics module for the simulation of reactivity injection accident in material testing
reactors”, Chegrani Y., Ivanov E., Di Salvo J., d’Aletto C.
CEA communication quoted in footnote 317.

Overview of simulation software used in design studies and safety analyses for French research reactors

231– ASTEC: The ASTEC (Accident Source Term Evaluation Code) simulation softwaresystem aims to simulate all the phenomena that would occur during a core melt
accident in a water reactor, from the initiating event to any releases ofradioactive products outside the reactor containment, with the exception of thesteam explosion, which can be processed using the MC3D software, and the loads
on structures, which can be processed using a software package like Cast3M (seebelow). The ASTEC software system (see ﬁgure 11.7) was developed jointly over anumber of years by IPSN then IRSN, together with its German equivalent GRS;
since then it has been developed further by IRSN alone. The applications of the
ASTEC system chieﬂy concern the safety analysis of pressurized water reactors,
with the evaluation of the radioactive releases that could result from core melt insuch a reactor, and the examination of the procedures to implement in the eventof such an accident. The ASTEC software system is also used by IRSN in its level-2
probabilistic safety analyses for nuclear power reactors. Lastly, it has also beenused in the preparation and interpretation of experimental programs, in particular
the Phebus FP global test program and in the tests carried out as part of the ISTP
(International Source Term Program).
Examples of use:

335.
336.



The CEA used the IODE software from the ASTEC system to study iodinetransfer in the reactor building of the Jules Horowitz reactor during a
BORAX-type accident – it used the CERES and GAZAXI software to evaluate
the contribution made by the principal radionuclides to the (effective)
doses during their migration into the environment335.



As part of the previously mentioned exercise to benchmark simulation
software organized by the IAEA (the coordinated research project on“Innovative Methods in Research Reactor Analysis” ‒ 2008−2013), IRSN
performed calculations using the CESAR thermohydraulics software in the
ASTEC system to interpret the reactivity insertion tests performed in the
SPERT reactor. The CESAR software had to be adapted for fuel in the formof plates. This software made it possible to ﬁnd the same plate cladding
temperatures as those measured in the SPERT-IV-D 12/25 core assemblies(see above for the neutronics simulation using the MORET (5) software).



IRSN also used the CPA software from the ASTEC system, which isdedicated to reactor containment thermohydraulics, to assess the effectiveness of a new conﬁnement management system (dynamic rather thanstatic) proposed by the operator of the RHF for accident situations336. The
objective was to evaluate the conclusions drawn from the operator
calculations that aimed to demonstrate the possibility of maintaining thereactor building at negative pressure (in relation to the annulus between
the two containment walls) in such situations, taking into account the

CEA communication quoted in footnote 317.
See the communication by IRSN at the RRFM 2010 conference: “Development of a numerical
tool for safety assessment and emergency management of experimental reactors”, Maas L.,
Beuter A., Seropian C.

Elements of nuclear safety – Research reactors

232

Figure 11.7. The various phenomena involved in a core melt accident (pressurized water reactor) andthe modules that simulate them in the ASTEC software system. © IRSN.

increase in air temperature (due to the ﬁssion products released in thereactor building and the heating of the pool water in the event of coremelt), the possibility of direct air leaks into the environment and the“swelling” operation of the annulus between the two containments (theinternal concrete containment and the external metal containment). Three
accident scenarios were studied: a BORAX-type accident, the fuel melting
under water and the fuel melting in air.

" Mechanics– Cast3M, ASTER, ANSYS software: Cast3M is a ﬁnite element simulation
software developed by the CEA for structural and ﬂuid mechanics. ASTER(Analyses des Structures et Thermomécanique pour des Etudes et des Recherches[simulation code for thermomechanical and structural analysis for research]) is asimilar software developed by EDF. ANSYS Inc. is an American company thatcreates and distributes various structural mechanics software packages (including
for loads leading to major deformation).
Examples of use:

337.

Cast3M is generally used by the designers and operators of French nuclear
facilities for applications relating to metal structures or civil engineering
works (reactor pools and buildings, etc.), notably at research reactors. It is
widely used by IRSN, which also occasionally collaborates with the CEA for
special development work. For example, in the ﬁeld of civil engineering,developments337 include improving the laws simulating the delayed or

These developments are produced as part of theses, linking IRSN and other partners, including
the CEA.

Overview of simulation software used in design studies and safety analyses for French research reactors

233

dynamic behavior of concrete works in the event of loading during an
accident (such as an earthquake, for example). These developments are thenintegrated into Cast3M, thereby being made available to all Cast3M users.


The Institut Laue-Langevin used the ASTER software for the design studies
for the PCS 3 building at RHF (which forms part of the post-Fukushima“hardened safety core”).

– EUROPLEXUS, LS-DYNA, RADIOSS: EUROPLEXUS is a ﬁnite element simulation
software for fast dynamics phenomena taking into account structures and ﬂuids,
originally developed by the CEA (PLEXUS code) and the Joint Research Centre(CCR) in Ispra in Italy (PLEXUS-3C), then reworked by a user group including EDF
and ONERA. LS-DYNA is a computer code of the same type, developed in the USA
by the Livermore Software Technology Corporation (LSTC), as is RADIOSS,
developed by Altair Engineering. These software can be used to study the
behavior of structures subjected to shocks, for example.
Example of use:
For the Jules Horowitz reactor, the CEA used338 the EUROPLEXUS and RADIOSS
software to study the behavior of the reactor pool structures in the event of a
BORAX-type accident. It did this by modeling a steam bubble with characteristics
such that it leads to the cases of overpressure determined previously using the
MC3D software.

" Evaluations in emergency situations
During emergency situations339 or emergency exercises, the operators of French research reactors and IRSN would base, or do base, their assessments on evaluations performed using simulation software simplified to a greater or lesser degree. Morespecifically, IRSN has a simulation software used for facilities other than pressurizedwater reactors in the nuclear power fleet, which can be used to determine the transferof radioactive products within a facility and the releases into the environment (quantityand kinetics of releases for each radionuclide). This software models, in a simplified way,
radionuclide leakage between rooms, transfers via ventilation systems and releases outside the facility. The deposition rate (for aerosols) and the efficiency of filtration devices
are entered in the software as data. The software is used to produce and update “standard accidents” sheets (see section 7.7). In addition, it is used by IRSN experts to define
the scenarios used in emergency exercises, and may also be used in the expert assessments performed by IRSN. This type of simplified software lends itself well to pre-calibration with the relevant data for the various research reactors, which makes it possible
to create models available for rapid use in emergency situations or during exercises.

338.
339.

CEA communication cited in footnote 317.
In practice, as soon as an on-site emergency plan is triggered.

Science and Technology Series

Elements of nuclear safety
Research reactors
Jean Couturier, Hassan Abou Yéhia et Emmanuel Grolleau
This publication gives a global overview of the diversity and complementarityof research reactors, some of which have been or are still being used to conduct
experiments that are essential for the development and operation of nuclear
power reactors, including in relation to safety issues. This work highlights themany uses of these reactors, which have very different designs, use highly varied
quantities of radioactive substances with varying levels of risk for safety andradiation protection, and which — in many cases because they are old or have been
shut down — require appropriate measures to control the ageing or obsolescenceof some of their equipment, as well as, on an organisational and human level,
to ensure that they continue to be operated safely. For some research reactors,
safety and radiation protection aspects must be considered, taking into accountthat two types of operators are present at the same time within these reactors:
reactor operating personnel and operators in charge of experimental devices using
neutrons from the reactor for fundamental or applied research purposes. There
are two specific chapters on the safety standards established under the aegis of
the IAEA for research reactors and on serious accidents, notably those involving
criticality and reactivity, in research reactors. The second part of the work focuseson French research reactors, including the regulations and official documents
applicable to these reactors, on lessons learned in France from significant events andaccidents — as well as abroad, such as the Fukushima Daiichi nuclear power plant
accident in 2011 — on the consideration of reactivity accidents in the design ofFrench research reactors, and on the ten-yearly safety reviews carried out in France.
The Institute for Radiological Protection and Nuclear Safety (IRSN) is a public bodyundertaking research and consultancy activities in the field of nuclear safety andradiation protection. It provides public authorities with technical support. It also
carries out various public service missions entrusted to it under national regulations.
In particular, these include radiological monitoring of the environment and workers
in France, managing emergency situations, and keeping the public informed. IRSN
makes its expertise available to partners and customers both in France and worldwide.
Head office31, avenue de la Division Leclerc
92260 Fontenay-aux-Roses
RCS Nanterre B 440 546 018
Telephone +33 (0)1 58 35 88 88
Postal Address
B.P. 17 - 92262 Fontenay-aux-Roses Cedex
FranceWebsite www.irsn.fr

ISBN : 978-2-7598-2356-7

9 782759 823567