Hinkley Point C new nuclear plant still has 415 key safety issues unresolved

On Christmas Eve last year I received a detailed response to a Freedom of Information request I had made to the UK Office for Nuclear Regulation [ONR] ( I am a member of the chief nuclear inspector's independent advisory panel) on the 415 unresolved nucleaer safety issues outstanding for the nuclear licence for the Hinkley Point C nuclear power plant the north Somerset coast, 18 miles from the Welsh capial city, Cardiff, across the Britol channel. It contains an alarming number of extremely important unresolved matters. Should this £25 billion plant really have been given the regulatory green light with so many safety issues unfinished? It is nonetheless reassuring that the ONR has been so thorough in flagging up key matters that need safety resolution Here is the covering letter, and my selection of the long list of most important unresolved safety issues: Unique ref: 2020/299949 Freedom of Information Request Reference No: FOI202011054 Thank you for your request for information received by us on 26 November 2020. Your enquiry is being dealt with under the terms of the Freedom of Information Act 2000 (FOIA). You requested: On page 22 of the Chief Nuclear Inspector’s Annual Report 2020, under the heading Resolution of GDA assessment findings, it states at paragraph 1.5 “We consider that NNB GenCo (HPC) continues to make good progress towards resolution of GDA assessment findings. At the end of GDA approximately 700 GDA assessment findings were raised (nuclear safety and security). As of March 2020, NNB GenCo (HPC) has closed 284 GDA assessment findings. The licensee continues to focus on closing out the remaining findings, which will be achieved as the site specific design continues develop.” Could you send me under Freedom of Information Act 2000 the headlines for each of the as yet circa 415 unresolved GDA assessment findings for Hinkley Point C, with an indication of the current best estimate respectively when each is expected to be closed out?? Our response: I confirm that under Section 1 of the FOIA,1 we hold the information related to your request. We have also provided some explanatory background to your requests below which we hope you may find helpful. 1) Headlines for each of the as yet circa 415 unresolved GDA assessment findings for Hinkley Point C The timely resolution of GDA Assessment Findings (AFs) remains an important strategic priority for ONR. The current status of outstanding GDA AFs for Hinkley Point C (HPC) is that as of 15 December 2020, 383 of the circa 700 nuclear safety and security findings remain open. The remaining open GDA AFs are listed in the table in Annex A along with the milestone by which they are required to have been addressed; a small number of these milestones have changed since they were published at the end of GDA following requests from the licensee and agreement by ONR. This was because the original milestones were initial estimates defined by ONR before the project started. As the project has since developed and evolved, we have responded and refined these milestones accordingly. The information on GDA AFs for HPC in Annex A, including definitions, have been compiled from many reports available on our website. These can be found on our page: Assessment of Reactors - UK European Pressurised Reactor™ (UK EPR). If you have any problems locating the definitions or specific acronyms, as we recognise there are many, please do come back to us. 2) Indication of the current best estimate respectively when each is expected to be closed out As set out in the table in Annex A, each assessment finding is measured against a milestone descriptor or event rather than a calendar date. Our focus is ensuring that the work described in the AF is complete in advance of the descriptive milestone. For example, the “fuel load” milestone means we expect those relevant AFs for that milestone to be closed at the latest before fuel can start to be loaded into the core. Regarding the open GDA AFs, care must be taken regarding how the absolute number of open findings is interpreted and the number of open findings should not be taken as a reliable indicator of design maturity. Furthermore, comparison of numbers of GDA AFs between different reactor designs should be avoided as assessment findings are not equal in terms of their significance. The significance of the assessment findings vary, with a number being normal business activities that must be completed during the construction or commissioning of any nuclear power plant; that is whether a GDA AF had been raised or not. We regularly discuss progress towards closure of GDA AFs with the licensee. We have also carried out detailed reviews of GDA AFs to inform our decisions whether to agree to certain activities starting, for example the start of construction of the nuclear island (see this report)2. Even where assessment findings remain open, significant progress has been made by the licensee towards their closure. However, in a significant number of cases the final evidence to support closure cannot be produced until later in the project, for example after certain commissioning activities are completed, making the resolution of GDA AFs a continuous process throughout the progress of HPC to commercial operations. On this basis, we consider that the licensee has prioritised resolution of the more significant GDA AFs, adequately addressed those findings where resolution was needed by early project milestones and it continues to make good progress towards resolution of outstanding GDA AFs in line with the agreed milestones. 2 http://www.onr.org.uk/pars/2018/hinkley-point-c-18-006.pdf Katie Day Director of Policy and Communications >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> AF-UKEPR-CC-14 A future licensee shall provide evidence to substantiate the grace times claimed in the EDF and AREVA report PEPS-F DC 133 dated November 2012 for a UK EPR™ following prolonged loss of power and / or cooling events for all operating states. AF-UKEPR-CC-18 A future UK EPR™ Licensee shall demonstrate how the long-term control of reactivity will be ensured following the total loss of AC power. AF-UKEPR-CE-038 The Licensee shall develop the test criteria and related monitoring and alert arrangements for the initial and decennial pressure tests on the containment. AF-UKEPR-CE-054 The Licensee shall provide justification of the seismic class of all items of structures systems and components in the MCR. AF-UKEPR-CE-068 The Licensee shall undertake analysis of the containment structure to reflect the actual concrete properties used in the construction. AF-UKEPR-CE-70 The Licensee shall confirm through appropriate simulation that the reliability of the containment structure against overpressure satisfies the safety case requirements. This shall take into account the design process undertaken, and the variation in strengths achieved in the construction of the containment. In addition, a full range of failure scenarios shall be considered. AF-UKEPR-CI-011 The Licensee shall produce a safety demonstration for the selection and use of Programmable Complex Electronic Components in the Teleperm XS platform, which form part of the Class 1 UKEPR Protection System, using appropriate standards and guidance. AF-UKEPR-CI-012 The Licensee shall produce a comprehensive safety demonstration addressing the adequacy of the SPPA-T2000 platform for Class 2 use covering hardware design, qualification and software design processes. AF-UKEPR-CI-014 The Licensee shall ensure that the software re-use argument presented addresses all Class 2 components of the SPPA-T2000 that contain dedicated devices with embedded software, or if no such software exists a positive statement saying so should be made. AF-UKEPR-CI-015 The Licensee shall produce adequate justification that the issue raised by ASN concerning the adequacy of the quality system test records for the original development of the SPPA-T2000 platform does not compromise the claims made for this platform in the UKEPR design. AF-UKEPR-CI-018 The Licensee shall ensure there is an adequate safety case for in-core instrumentation sensors and other sensors used in SIS. AF-UKEPR-CI-021 The Licensee shall demonstrate that the use of a different complier with the SIVAT tool compared to that used to generate the object code which will run on the PS does not compromise the integrity of the PS application software development lifecycle. AF-UKEPR-CI-024 The Licensee shall produce evidence to demonstrate the adequacy of the design and implementation of the PS calculated trip functions. AF-UKEPR-CI-025 The Licensee shall demonstrate that the differences of functional coverage across the PS trains do not give rise to any safety concerns (such as an inability to meet the reliability requirements or the single failure functional criterion requirements) when failures occur within a train, or any train is taken out of service for maintenance. AF-UKEPR-CI-031 Definition and assignment of functions to C&I SIS - The Licensee shall ensure that for the UKEPR there is a rigorous definition of the overall system architecture, the assignment of functions to SIS, interfaces and independence requirements AF-UKEPR-CI-035 The Licensee shall address the open points on the PCSR summarised below by updating the PCSR to: · include the justification of the adequacy of programmable complex electronic components; · include the UNICORN platform and NCSS justifications; and · address the inconsistencies in the status of the PICS and the interfaces between the Class 1 PS and other systems. AF-UKEPR-CI-038 The Licensee shall complete the demonstrations of reliability and independence for inclusion in the safety case, in particular to: · Undertake the modifications to the PS and / or its periodic test arrangements to allow the reliability targets (e.g. for trip on low DNBR by increasing the frequency of periodic tests) to be met. AF-UKEPR-CI-041 The Licensee shall: · Confirm that the SAS functional and safety interlocks referred to in TQ-EPR-1532 response inhibit spurious commands from the PICS, and produce a justification of the adequacy of the interlocks. · Produce a comprehensive justification that Class 2 systems cannot be adversely affected by lower class systems. This justification to include the RCSL and systems based on SPPA-T2000 platform version S7 technology. · Produce an analysis for the final UK EPR™ SAS design that demonstrates that a “spurious but valid command sent to the SAS from the PICS” will affect at the very worst only one division and the consequences can be managed AF-UKEPR-CI-043 The Licensee shall complete the demonstration of the adequacy of the UK EPR™ end-to-end response times for those functions important to safety which use the Class 3 Terminal Bus and / or Plant Bus using SPPA-T2000 platform version S7 information. The Licensee to: · Perform a design analysis of the end-to-end response times using SPPA-T2000 platform S7 version information (i.e. updating the SPPA-T2000 platform S5 version analyses provided during GDA). · Undertake a programme of performance / response time tests on fully representative UK EPR™ equipment (including SPPA-T2000 platform version S7 components) that include consideration of avalanche conditions both generated by the plant and internal to the SPPA-T2000 platform S7 version equipment). AF-UKEPR-CI-045 The Licensee shall confirm the adequacy of the allocation of conditioning modules and sensors (i.e. one group to the PS and other to the SAS / NCSS) by completing sufficient detailed calculations AF-UKEPR-CI-048 The Licensee shall: · Update document PEPS-F DC 90 so that it clearly defines the requirements for design in respect of common cause failure during maintenance. · When C&I categorisation and classification is complete, update the documentation (e.g. ECEF091489) to record the final categorisations of functions and classifications of systems, identifying any categorisation shortfalls and providing full justification, as necessary. AF-UKEPR-CI-050 The Licensee shall: · Document and justify the adequacy of the final NCSS design in the safety case (e.g. the approach to testing, fail safe capability and selection of single or dual chain architecture for manual functions, etc.). · Confirm the adequacy of the final NCSS design, in relation to reduction of plant risk, by including NCSS design details into the PSA. · Define how, once triggered, the action of an NCSS automatic function will be reset and confirm this meets the requirements of SAP ESS.14. · Assess the effect of power loss within the NCSS system on plant safety (e.g. power loss leading to a failure to actuate when required or send alarms to operators). AF-UKEPR-CI-051 The Licensee shall: · Complete the trial qualification of the Class 1 smart device, assess the effectiveness of the qualification, and update the smart device qualification documentation and processes where improvements are identified. · Address the omissions in the Class 2 smart device trial qualification, assess the effectiveness of the qualification, and update the qualification documentation and processes where improvements are identified. · Confirm that a change in the Emphasis version will not adversely affect the qualification of smart devices. · Ensure that all smart device features (e.g. such as clock synchronisation and removable data logging memory), that have the potential to adversely affect the operation of safety functions are identified and, as appropriate, included within the qualification. AF-UKEPR-CSA-001 The licensee shall provide the ventilation strategy supporting the concept of inaccessible/accessible areas during normal operations and accident conditions for situations where one or more of the foils and dampers have failed. AF-UKEPR-CSA-006 The licensee shall justify that the isolation systems and containment penetrations meet the site specific loading requirements (pressure, temperature, moisture and leakage) in accident conditions. AF-UKEPR-CSA-007 The licensee shall demonstrate that the design of insulation and the strainer structures associated with the safety injection system is such that the risk of sump blockage has been reduced to the lowest level reasonably practicable. In particular, the licensee should produce an analysis of the options and justify the choice of insulating technology. AF-UKEPR-CSA-008 The licensee shall justify the measurement systems indicating core conditions used to initiate the accident management procedures, such as, core outlet temperature measurements and the reliability of instrumentation routed via the RPV head; the justification should give consideration to common cause failure. AF-UKEPR-CSA-010 The licensee shall provide a robust justification of the operational requirements of the PDS during fault conditions. The justification is expected to fully consider the PDS implementation and Operating Strategies for Severe Accident (OSSA) for the UK EPR AF-UKEPR-CSA-014 The licensee shall provide additional justification to: · demonstrate that the weld beads and outer frame meet the loading requirement, and · support a testing programme to capture unacceptable defects in the weld beads. AF-UKEPR-CSA-015 The licensee shall justify that potential presence of chunks of concrete above the melt plug at the time of bottom head failure has no significant consequences on the melt plug opening. AF-UKEPR-CSA-021 The licensee shall provide the measure(s) and arrangement(s) for inspection in order to ensure that the reactor pit is kept sufficiently dry. AF-UKEPR-CSA-025 The licensee shall provide the available measures to limit the containment pressure, in the event of a severe accident leading to the failure of the CHRS, to prevent uncontrolled radiological releases from the primary containment. AF-UKEPR-FD-003 The licensee shall demonstrate that the procedures proposed for loading the reactor core with fuel will ensure that an uncontrolled criticality is incredible or that all reasonably practical measures have been taken to prevent this. AF-UKEPR-FD-008 The licensee shall review the derived criteria for cladding failure in RIA faults in the context of the results of the relevant experiments in the current CABRI programme if they become available. AF-UKEPR-FS-005 The future licensee shall assess the radiological consequences (and demonstrate compliance with Target 4 of the SAPs) of multiple consequential steam generator tube ruptures occurring following a steamline break assuming the single failure of the Main Steamline Isolation Valve failing to close on the steamline associated with the fault. AF-UKEPR-FS-013 The future licensee shall perform a sensitivity study to the loss of off-site power ATWT case with failure of the RCCAs to insert in which Interim insertion of RCCAs is assumed. This is to demonstrate that the power distribution is not distorted such that fuel enters DNB. AF-UKEPR-FS-017 The future licensee shall provide transient analysis to demonstrate that adequate protection is provided for a CVCS malfunction resulting in boron dilution while at power with failure of the reactor protection system to trip the reactor. AF-UKEPR-FS-018 The future licensee shall demonstrate that a fuel loading error involving the two most onerous fuel assemblies will not result in fuel entering DNB upon return to power. AF-UKEPR-FS-020 The future licensee shall perform SBLOCA with ATWT sensitivity studies to investigate the margins provided by the adopted Interim cooldown rate to avoid recriticality while ensuring adequate cooling of fuel. AF-UKEPR-FS-022 The future licensee shall ensure spurious C&I signals as initiating events are covered in the UK EPR safety case. AF-UKEPR-FS-104 The future licensee shall determine the consequences of failure for the control rod drive mechanisms and the ex-core flux instrumentation of the containment cooling ventilation system. AF-UKEPR-FS-112 The future licensee shall perform UK EPR™ specific transient analysis studies for the SBO sequence with failure of the SSSS. The analysis will need to confirm that adequate grace time is available for operator action to start the UDGs and restore adequate cooling and whether the CHRS is sized sufficiently such that one CHRS train is functionally capable of providing adequate cooling to the IRWST or demonstrate that the current design of the CHRS is ALARP. AF-UKEPR-FS-115 The future licensee shall perform thermal analysis to determine the timescales for which consequential loss of C&I and electrical equipment would occur as a result of the total loss of all the HVAC systems during the station blackout sequence prior to restoration of the UDGs. Adequate validation evidence will need to be presented to support the thermal analysis possibly including representative destructive testing. AF-UKEPR-FS-116 The future licensee shall perform thermal analysis to confirm that the C&I and electrical equipment needed to operate the severe accident mitigation measures will remain available despite the complete loss of all HVAC systems following the severe accident sequence associated with station blackout occurring together with subsequent failure of the UDGs to start. Adequate validation evidence will need to be presented to support the thermal analysis possibly including representative testing. AF-UKEPR-FS-30 The future licensee shall provide a revised PSA for external heterogeneous boron dilution faults. AF-UKEPR-FS-32 The future licensee shall demonstrate the functional capability of the CVCS letdown line to purge an unborated slug from a loop on the primary circuit. Ideally, the demonstration should take the form of a test performed upon either a full scaled test rig or an EPRTM reactor plant during commissioning. AF-UKEPR-FS-36 The future licensee shall perform PIRT and scaling analyses for the Juliette test rig to confirm its applicability for providing validation evidence of the important thermal hydraulic phenomena associated with heterogeneous boron dilution faults and to confirm safety margins. AF-UKEPR-FS-42 The future licensee shall demonstrate that the in-core Self-Powered Neutron Detectors (SPND) are functionally capable of protecting against Rod Cluster Control Assembly (RCCA) misalignment faults including one or more dropped RCCAs and against uncontrolled single RCCA withdrawal faults assuming the loss of the most onerous SPND finger due to a single failure such that DNB is avoided using conservative PCC analysis rules and conservative methods and assumptions. AF-UKEPR-FS-43 The future licensee shall explore the feasibility of using the axial offset signal on the ex-core detectors as a diverse means of ensuring the reactor is sufficiently well trimmed so as to avoid entering DNB following RCCA misplacement faults including the dropping of more than one RCCA together with common mode failure of the SPNDs. AF-UKEPR-FS-44 The future licensee shall determine which of the options identified within Change Management Form (CMF) #59 is to be developed into fully worked up proposal to provide diverse protection against homogeneous boron dilution faults occurring during shutdown conditions. AF-UKEPR-FS-46 The future licenses shall provide a fully integrated safety case for the station blackout sequence. AF-UKEPR-FS-48 The future licensee shall perform an ALARP assessment on the feasibility of providing a diverse means of isolating one pair of steam lines from the other pair following a break on the secondary side. AF-UKEPR-FS-53 The future licensee shall update the PCSR to reflect the definition of controlled state for fuel pool faults, the functioning of the RCSL anti-dilution safety function, the change in protection claimed for excessive increase in secondary steam flow faults with failure of PS and the inclusion of support system functions in the fault and protection schedule. AF-UKEPR-FS-63 The future licensee shall provide transient analysis studies to demonstrate that there is adequate diverse protection against the loss of one RCP. AF-UKEPR-FS-64 The future licensee shall provide transient analysis studies to demonstrate that there is adequate diverse protection against the uncontrolled single RCCA withdrawal fault. AF-UKEPR-FS-65 The future licensee shall review the allocation of conditioning modules for the in-core and ex-core detectors to reduce the risk to ALARP of both systems being unavailable following common failure of a single design of conditioning module. AF-UKEPR-FS-69 The future licensee shall review all valve and motor actuations to ensure that the design logic is such that common mode failure of a PACS module cannot result in the failure of two diverse systems both contributing to the same safety function. Consideration also needs to be given to common mode failure of the PS resulting in a spurious signal that overrides a correct signal from the SAS/NCSS. AF-UKEPR-FS-86 Complete the development work on the optimisation of operator actions claimed to prevent SG dry-out post SGTR faults. The revised proposal is required to fully consider the expectations of Emergency Operating Procedures (EOP) for the UK EPR™. AF-UKEPR-FS-88 Provide a robust justification that the position of the steam line activity sensors is optimised to maximise their sensitivity for detecting the activity released from SGTR faults or to minimise potential radiological discharge to atmosphere. AF-UKEPR-FS-89 Review and update the definition of the “controlled state” for SGTR faults. AF-UKEPR-HF-002 The licensee shall explicitly highlight the human error probabilities associated with Type A HFEs as part of the Level 1 HRA revision. AF-UKEPR-HF-005 The licensee shall undertake a systematic analysis to demonstrate that all credible HFEs are included in the revised Level 2 HRA. AF-UKEPR-HF-010 The licensee shall justify the quantitative modelling of error recovery as part of the HRA revision. AF-UKEPR-HF-011 The licensee shall justify the approach for the HRA modelling of diagnostic errors when revising the HRA. AF-UKEPR-HF-015 The licensee shall calculate the HEPs for initiating human errors based on an analytical process that includes consideration of dependency within the initiator and with other initiating HFEs. AF-UKEPR-HF-016 The licensee shall provide evidence to support the claims that maintenance and test procedures will minimise the potential for human error dependence. AF-UKEPR-HF-031 The licensee shall provide justification and evidence of the suitability of the workspaces and working positions in the UKEPR (not limited to the MCR) for the UK working population. AF-UKEPR-HF-032 The licensee shall provide further information on and justification relating to the emergency lighting design and relevant plant wide minimum lighting levels. AF-UKEPR-HF-039 The licensee shall provide a justification and evidence of the visibility of the detailed POP displays proposed for the UKEPR. AF-UKEPR-HF-044 The licensee shall demonstrate that a consistent approach to alarm prioritisation and configuration is taken throughout the UKEPR. AF-UKEPR-HF-049 The licensee shall substantiate that the SOA procedures ensure that claimed safety actions are reliably completed within the timescales required by the safety case. AF-UKEPR-HF-58 The Licensee shall determine if internal floods generate additional alarms that are likely to mask or delay response to key alarms or indications prompting operators to undertake claimed leak response actions. The licensee shall provide an appropriate justification that any claimed operator actions required to support the Internal Hazards flooding case are reliably achievable within the required timescales. AF-UKEPR-IH-003 The Licensee shall provide evidence to demonstrate that the design of the doors required to open in the event of increased pressure (due to a steam release) will do so at the requisite pressure and thus allow the steam release path to be realised in accordance with the requirements of the safety case. AF-UKEPR-IH-005 The Licensee shall provide evidence to demonstrate that the design of the doors required to remain intact in the event of increased pressure (due to a steam release) will withstand requisite pressure and ensure that the engineered discharge routes for the steam release to be realised in accordance with the requirements of the safety case. AF-UKEPR-IH-006 The Licensee shall provide evidence to demonstrate that the potential for a hydrogen explosion within the Battery Rooms during the most onerous operating conditions has been considered within the UKEPR design. AF-UKEPR-IH-15 The Licensee shall review the potential flooding scenarios that require automatic isolation following detection of a leak or break and provide substantiation of the classification and categorisation of those systems. AF-UKEPR-ME-008 The licensee shall generate evidence to demonstrate that the CRDMs meet their seismic design intent. AF-UKEPR-ME-014 The licensee shall ensure the design of all rigging equipment associated with lifts of nuclear safety significance is completed, and in doing so shall systematically review these rigging arrangements to identify faults, and review and implement reasonably practicable improvements to either eliminate such faults by design, or limit their frequency by the provision of engineered protection systems. AF-UKEPR-ME-022 The licensee shall ensure that fume cupboards within the UKEPR are not used for the containment of radioactive substances. AF-UKEPR-ME-031 The licensee shall make and implements adequate EMIT instructions to control the hazard of inadvertent use of an incorrect filter cartridge in a mechanical process filter. AF-UKEPR-PSA-002 The licensee shall ensure that the scope of the PSA is expanded to include hazards, such as fire and flooding during non power operating states. AF-UKEPR-PSA-017 The licensee shall ensure that substantiation for the HRA in the form of task analysis, procedures and training is provided to underpin the numerical HFE values used in the PSA. The substantiation should include further consideration of pre-initiating HFEs and the potential for HFE dependencies (pre & post fault). AF-UKEPR-PSA-018 The licensee shall ensure that Level 2 PSA sensitivities to individual and collective HEPs are used to provide insights into the development of the EPR severe accident guidance (OSSA). AF-UKEPR-PSA-028 The licensee shall ensure that the dependency between a LOOP and extreme weather events is taken into account and if necessary the PSA amended. AF-UKEPR-PSA-031 The licensee shall ensure that hazards such as internal explosion, turbine missiles and animal infestation are considered and if necessary included in the PSA model. AF-UKEPR-PSA-033 The licensee shall consolidate the assumptions made in the existing PCSR internal fire analysis in one location, and provide appropriate justification, reference, discussion of the effect of each assumption on the analysis and consider them as potential input to the full scope fire PSA to be carried out post GDA. AF-UKEPR-PSA-035 The licensee shall consolidate the assumptions made in the existing PCSR internal flooding analysis in one location, and provide appropriate justification, reference, discussion of the effect of each assumption on the analysis and consider them as potential input to the full scope flooding PSA to be carried out post GDA. AF-UKEPR-PSA-036 The licensee shall develop a full scope internal flooding PSA as the detailed design evolves. AF-UKEPR-PSA-037 The licensee shall provide a seismic PSA for the site. The seismic analysis should take account of consequential hazards that might be caused by a seismic event, such as fire or flooding, and if appropriate include them in the PSA. AF-UKEPR-PSA-038 The licensee shall ensure that the impact of seismic faults during shutdown is addressed in a consistent manner with other contributions to the risk during shutdown. AF-UKEPR-PSA-040 The licensee shall ensure that full consideration of parametric uncertainty is included the PSA. AF-UKEPR-PSA-041 The licensee shall ensure that long term faults should be properly incorporated into the overall PSA as the detailed design evolves so that the importance of long term recovery measures, (such as repair of Diesel Generators and supporting the emergency feed water system with fire fighting water) are captured and taken into account in future procedures and decision making. AF-UKEPR-PSA-042 The licensee should ensure that a UK-EPR specific containment structural analysis is performed which addresses all potential modes of containment failure, including penetration and leakage failures AF-UKEPR-PSA-043 The licensee shall update the Level 2 PSA model to ensure consistency with the current Safety Injection Severe Accident Management Strategy. AF-UKEPR-PSA-044 The licensee should ensure that the Level 3 PSA is developed to modern standards, in particular by placing less reliance on design basis dose assessments and by fully incorporating probabilistic factors such as weather. For each new plant the Site-specific Level 3 PSA will need to incorporate site specific source term and release frequency analyses together with site specific dispersion and consequence modelling parameters (such as weather data and distribution of population and agriculture) for all releases. AF-UKEPR-RC-001 The Licensee shall specify the normal operating chemistry regimes for the primary, secondary and auxiliary circuits of UKEPR. The specifications should be comprehensive and incorporate evidence for all modes of operation. The regimes should be consistent with the plant safety case, particularly the limits and conditions required by AF-UKEPR-RC-02 AF-UKEPR-RC-004 The Licensee shall generate a detailed risk analysis, fully justifying the boron strategy to be applied. This should include commissioning, the fuel management and chemistry requirements, necessary control actions and effects from evaporation on radioactivity and impurity accumulation. AF-UKEPR-RC-011 The licensee shall define a surveillance programme for control rods and secondary neutron sources. The programme shall prevent the release of materials such as tritium or silver before there is significant contamination of vessels or pipework. AF-UKEPR-RC-013 The Licensee shall conduct sensitivity analysis for fuel crud formation in UKEPR. This should be used to demonstrate that levels of crud can be controlled and reduced So Far As Is Reasonably Practicable (SFAIRP) in UKEPR and should be based upon the detailed operating chemistry and core design for the UKEPR reactor. These calculations should provide balanced predictions of activity levels that allow the assessment of control measures including boiling patterns and StelliteTM replacements, as well as the management of significant chemicals and radionuclides. The licensee shall conduct analyses of sensitivity to factors such as pH, zinc, boiling and dissolved corrosion products on crud build-up. The analysis should be used to justify related limits, conditions and criteria. AF-UKEPR-RC-015 The Licensee shall generate evidence for the optimum band for hydrogen concentration in a reactor with Inconel 690 steam generators. Such reactors normally operate within a narrower band of about 30 to 40 cc kg-1 and there appears to be little data to justify concentrations below around 25 cc kg-1. The analysis should include a fuller analysis of the effects of hydrogen levels on Inconel 690 and stainless steels in UKEPR specifically. AF-UKEPR-RC-021 The Licensee shall specify suitable procedures for Hot Functional Testing (HFT), building upon the evidence presented for GDA and including further knowledge and experience particularly from other EPR units commissioned prior to any UK new build. The documentation should justify the controls during HFT of UKEPR, particularly related to hold points, chemistry measurements and target levels, together with their justification. AF-UKEPR-RC-027 The Licensee shall conduct a design review, justification and analysis for the secondary circuit considering the operating regime, material choices, corrosion threats and plant design amongst others. This will input into the secondary chemistry optimisation. This should consider all of the major secondary circuit systems, including many of those not included within the GDA scope. AF-UKEPR-RC-033 The Licensee shall generate evidence that the monitoring and surveillance programme for flow accelerated corrosion around the secondary circuit will be adequate. AF-UKEPR-RC-037 The Licensee shall generate a justification for limits and conditions associated with activity in the Gaseous Waste Processing System (GWPS). This should consider all forms of activity and associated maintenance and testing of the GWPS. AF-UKEPR-RC-038 The Licensee shall generate further details and evidence to support the operation of the Liquid Waste Processing System (LWPS) evaporator, including consideration of chemical effects in operation, such as boron crystallisation, activity accumulation or precipitate generation, as noted in this assessment report. AF-UKEPR-RC-040 The Licensee shall update the safety analysis for Steam Generator Tube Rupture (SGTR) events presented in the safety case to be a clear and consistent safety justification for such events, based upon a single set of underlying assumptions. The chemistry aspects of the safety analysis should be consistent with current experimental data and knowledge on iodine chemistry. The assumptions used should be clearly linked to the supporting transient analysis and the behaviour of the plant systems and where bounding assumptions are used these should be demonstrably so. AF-UKEPR-RC-042 The Licensee shall undertake UKEPR specific analysis to support the Combustible Gas Control System design for UKEPR. This analysis should adequately cover all phenomena that may occur during such accident sequences. This analysis should cover the effects of B4C control rods in the UKEPR design and include demonstration of the long-term plant behaviour post accident. AF-UKEPR-RC-044 The Licensee shall demonstrate that the experimental testing of the PARs matches the boundary conditions used in the safety analysis, including under representative severe accident conditions. AF-UKEPR-RC-046 The Licensee shall demonstrate that the release fractions for plutonium and strontium in a severe accident, and their longer-term consequences are appropriate for the UKEPR. AF-UKEPR-RC-047 The Licensee shall quantify the proportions of gaseous elements contributing to the public consequences in the acute and longer timescales of an accident, so that evidence for the proportion of organic iodine can be generated if significant. An alternative analysis may be agreed with the regulator. AF-UKEPR-RC-049 The Licensee shall ensure that equilibrium levels of airborne fission-products within the containment are calculated and verified both for prolonged transients and events over longer timescales. AF-UKEPR-RC-050 The Licensee shall estimate the quantities of all possible chemical species that could degrade the performance of the IRWST and analyse their downstream effects on cooling and radioactive release. Possible sources from different events include; acidic fumes from radiolysis or pyrolysis, working materials introduced during shutdowns and leaching from solid materials trapped in the strainers. Each of these could reduce the quality of the water in the IRWST and impair heat transfer or iodine retention. AF-UKEPR-RC-055 The Licensee shall compare the results from equivalent analyses generated by the MAAP and COSACO computer codes to confirm the bounding results have been used to examine the consequences of severe accident, over the period where their scope overlaps. AF-UKEPR-RC-56 The licensee shall complete and document, as part of the site specific analysis, a: Ÿ Verification and validation of the codes used to support the safety case for combustible gas control, including a comparison of the analysis to relevant good practice guidelines for CFD use. Ÿ Review of inter-code comparisons where the analysis procedure calculates the same data in different codes AF-UKEPR-RC-58 The licensee shall include a demonstration of the impacts of allowing unreacted combustible gases to exit the PARs as part of the site specific analysis. AF-UKEPR-RC-62 The licensee shall provide additional evidence to support the claims made on the avoidance of detrimental flame acceleration as part of the site specific analysis. AF-UKEPR-RC-63 The licensee shall justify the scenario selection for the ex-vessel phases of a severe accident, including consideration of combustion risks at the local scale, as part of the site specific analysis AF-UKEPR-RC-65 The licensee shall quantify the temperatures loads from ex-vessel hydrogen combustion as part of the site specific analysis. This should demonstrate the effects of combustion in standing flames on thermal loads. AF-UKEPR-RC-66 The licensee shall demonstrate the impact of operation of the containment spray system on the combustible gas risks as part of the site specific analysis. AF-UKEPR-RC-68 The licensee shall provide site specific analysis for the radiological consequence of accidents involving core melting, including IRWST evaporation and uncertainties in the reactions of iodine. AF-UKEPR-RC-69 The licensee shall continue to refine the estimated performance of UK EPR™, in terms of the production, transport and accumulation of radioactivity in the primary circuit and connected systems, during the site specific phase. This should include taking account of operating experience feedback from other EPR™ plants, the aim being to move towards quantitative estimates so far as is reasonably practicable. AF-UKEPR-RP-006 PRMS: The licensee shall provide a report to demonstrate that the planned location of the installed radiation monitoring equipment of the KRC and KRT systems of the PRMS are appropriate and take account of the final radiological zoning classification scheme with regard to ensuring that radiation exposures received by workers whilst taking measurements or maintaining or testing such equipment are ALARP. AF-UKEPR-RP-007 Decontamination: The licensee shall provide a report to demonstrate its site-specific strategies, systems and techniques for decontamination during operations and maintenance, and during POCO and decommissioning, whilst taking account of the contamination zoning of the NPP. AF-UKEPR-RP-010 Optimisation for work activities: The licensee shall provide an ALARP justification (regarding radiological protection) to demonstrate worker dose optimisation for SG ultrasonic testing of secondary system compartment welds if more than one SG is inspected during an outage, and for SG eddy current tube inspections if they are carried out during ROOs. AF-UKEPR-RP-011 Optimisation for work activities: The licensee shall provide an ALARP justification for the use (or not) of robotics in SG maintenance and testing based on optimisation studies that identify specific tasks that should be carried out by specific robots. These tasks and robots shall be identified following a review of robots’ capabilities for undertaking tasks that yield quantifiable benefits in terms of dose reductions for workers. AF-UKEPR-RP-012 Optimisation for work activities: The licensee shall provide an ALARP justification for fitting and removing insulation in cramped areas, and in particular, for fitting insulation in the safety injection system rooms (known as banana rooms) and at the bottom of the pressuriser. Any additional cramped areas where fitting insulation is challenging shall be identified following a review of cramped areas and their insulation requirements, and in cases where fitting insulation is challenging, those areas shall also be included in the safety case. AF-UKEPR-RP-013 Optimisation for work activities: The licensee shall provide an ALARP justification for fitting and removing insulation where Interim insulation removal is required for inspection and maintenance. The locations where Interim insulation removal is required shall be identified following a review of work activities where complete removal of insulation would not be necessary for those work activities to take place, and of pieces of equipment where the insulation would be most often removed and replaced. AF-UKEPR-RP-015 Persons on site during accident conditions: The licensee shall provide a safety case that demonstrates that the on site specific radiological consequences analyses for accidents (including hazards) are ALARP and have taken due cognisance of usual UK methodology assumptions and have explicitly compared the results of those analyses against NT.1 Target 5 in ND’s SAPs regarding the risk impact to individuals from all the facilities on the site, and against NT.1 Target 6 in ND’s SAPs regarding the predicted single accident frequency versus dose to individuals on the site. AF-UKEPR-RP-016 Persons on site during accident conditions: The licensee shall provide an ALARP justification for occupancy of the main control room immediately post accident if the ventilation system has failed. AF-UKEPR-RP-017 Persons on site during accident conditions: The licensee shall provide a safety case to identify access requirements to specific components / pieces of equipment that will require maintenance / repair during the post-accident phase, and to identify potential doses to workers carrying out those maintenance / repair activities and to demonstrate that they are ALARP. AF-UKEPR-RP-019 Criticality control: The licensee shall establish systems to monitor the borated stainless steel in the fuel pond storage racks over the lifetime of the plant so as to identify and quantify any degradation. AF-UKEPR-RW-004 The licensee shall optimise the operation of the chemical volume control system and the liquid, gaseous and solid waste management processes to ensure that the risks associated with their operation and the management of the resulting wastes are as low as reasonably practicable. AF-UKEPR-RW-010 The licensee shall produce a safety report for the long-term storage of spent fuel. The report will contain information at least equivalent to that of a Preliminary Safety Case as defined in Guidance on the Purpose, Scope and Content of Nuclear Safety Cases, AF-UKEPR-SEC-006 The long term back up power supplies for the security infrastructure are not detailed in the CSA AF-UKEPR-SEC-009 Doors will need to meet the appropriate protection levels, and if necessary the locking system will need to meet the appropriate class, as detailed in the TRD. AF-UKEPR-SEC-011 Security screening at the specific areas of the plant is required. AF-UKEPR-SEC-012 Security arrangements for access to the containment under all plant conditions will need to be developed by the Licensee. AF-UKEPR-SI-001 The Licensee shall undertake fracture assessments on a wider range of weld locations on the High Integrity Components (HIC) in order to demonstrate that the limiting locations have been assessed. The Licensee shall also undertake fracture assessments on the vulnerable areas of the parent forgings in order to demonstrate that the limiting locations have been assessed. AF-UKEPR-SI-002 The Licensee shall undertake fatigue crack growth assessments at the limiting locations on the highest reliability components post GDA as part of the demonstration of avoidance of fracture. AF-UKEPR-SI-003 The Licensee shall undertake scoping fatigue crack growth assessments in advance of the manufacturing inspections in order to show that fatigue crack growth will not affect existing assumptions with regard to qualified defect sizes. AF-UKEPR-SI-005 The Licensee shall provide a robust justification for the use of a 0 MPa residual stress for the inner surface of the carbon manganese steam lines if this value is to be adopted in the post GDA fracture assessments for the main steam line welds AF-UKEPR-SI-007 The Licensee shall provide evidence that the capability of the NDT procedures applied during manufacture of safety-related components (but not subject to inspection qualification) is adequate for the purpose. AF-UKEPR-SI-008 The Licensee shall ensure that procedures exist to take appropriate action if any planar defects are detected in forgings for the HICs since this may indicative of manufacturing problems. AF-UKEPR-SI-012 The Licensee shall ensure that an adequate level of repeat inspection is proposed to assure the quality of all qualified manual ultrasonic inspections on the HICs. AF-UKEPR-SI-015 The Licensee shall ensure that details of the qualification procedure such as the number and types of defects in test pieces is defined on the basis of a good understanding of the likely weaknesses in the techniques derived from a draft Technical Justification. AF-UKEPR-SI-016 The Licensee shall produce a comprehensive material data set for use during the design and assessment process, and also to support through life operation. This will need to cover all relevant data including the basic design data and the confirmatory batch and weld specific test data from the complementary fracture toughness testing programme (Section 4.2.5.3). It will need to be clearly presented such that the pedigree of the data can be traced following the literature trail with comparison to other international data sets where possible and will need to be updated through life following developments in the field and in the light of through life testing of materials subject degradation mechanisms. AF-UKEPR-SI-017 The Licensee shall ensure that the fracture testing undertaken to support tearing resistance values assumed for the main steam line welds is representative of both the main steam line thicknesses and the direction of crack propagation. AF-UKEPR-SI-019 The Licensee shall extend the testing which is proposed at 330oC to a lower temperature of say 50oC to confirm the upper shelf toughness at the lower end of the temperature range on those RPV forgings which will be subject to irradiation damage. This shall also apply to the welds in these regions AF-UKEPR-SI-020 The Licensee shall provide evidence that results from a previous test of a thermally aged specimen of pipework weld is representative of the narrow gap TIG welds used on the pipe to pipe welds and the narrow gap GTAW welds used between the pipework and reactor coolant pump bowl. If this is not the case, tests will need to be carried out on representative welds. In addition evidence shall be provided that thermal ageing is not a concern for the dissimilar metal weld on the main coolant loop otherwise it may be necessary to test thermally aged specimens of the weld. AF-UKEPR-SI-021 The Licensee’s detailed proposals on the fracture toughness testing needed to underpin the toughness values assumed in the fracture assessments shall address the potential for batch to batch variability in the weld consumables affecting the toughness properties. Either a justification will be needed based on an understanding of the batch to batch variability of the properties supported by the testing of representative weld mock ups or testing on each batch of weld consumables. AF-UKEPR-SI-022 Where the safety case relies on stable tearing, the Licensee shall perform testing to support both the initiation value and tearing resistance values AF-UKEPR-SI-023 The Licensee shall check the competence of steelmaker(s) to comply with the RCC-M M140 qualification requirements for specific components before placing contracts for forgings. AF-UKEPR-SI-024 The Licensee shall ensure that, since the RCC-M Part Procurement Specifications for the main vessel forgings do not provide an adequate control on the composition for all elements, additional limits on composition are specified and justified AF-UKEPR-SI-025 The licensee shall ensure that the maximum value of nickel content in beltline welds is restricted, either by setting an upper limit not exceeding 0.85% Ni or by setting a target value with a rigorous process for reviewing the acceptability of the Ni value should the actual value be above 0.85%. This shall be completed before the generic milestone of RPV installation, although in practice it will need to be completed earlier to suit the programme for manufacture of the vessels. AF-UKEPR-SI-026 The Licensee shall ensure that sample ultrasonic inspections for underclad cracking are performed during manufacture of the RPV, SGs and PZR. This shall be completed before the generic milestone of RPV installation, although in practice it will need to be completed earlier to suit the programme for manufacture of the vessels. AF-UKEPR-SI-028 The Licensee shall ensure that sample ultrasonic inspections for underclad cracking are performed during manufacture on all 20MND5 components which are clad. The sample should take account of the relative lack of evidence on avoidance of underclad cracking with this material. This shall be completed before the generic milestone of RPV installation, although in practice it will need to be completed earlier to suit the programme for manufacture of the vessels. AF-UKEPR-SI-032 The Licensee shall ensure that more detailed guidance on the use of the RCC-M procedure is provided to support earthquake design of pipework AF-UKEPR-SI-033 The Licensee shall ensure that if a welding procedure qualification is performed against the requirements of earlier versions of the code a competent welding engineer reviews whether this is adequate and documents the review. AF-UKEPR-SI-034 The Licensee shall carry out additional tests during weld procedure qualification of the dissimilar metal welds to evaluate the degree of sensitisation and embrittlement occurring in the safe end material during the final PWHT. AF-UKEPR-SI-035 The Licensee shall undertake a fatigue design evaluation for locations in austenitic stainless steel and ferritic components that are in contact with the wetted environment to ensure that the effects of environment have been properly accounted for in the fatigue design analysis. AF-UKEPR-SI-037 The Licensee shall ensure that the site specific “Stress reports” confirm the adequacy of the design. AF-UKEPR-SI-038 The Licensee shall ensure that the safety cases for component internals include an analysis of the consequences of all the potential modes of failure. Alternatively the components should be added to the list of Highest Integrity Components and a case be developed accordingly. AF-UKEPR-SI-039 The Licensee shall provide more explicit evidence to demonstrate that failure of the core barrel during normal or upset conditions would not lead to unacceptable fuel damage as a result of flow diversion which was not recognised and caused the reactor control system to increase power as a response. AF-UKEPR-SI-041 The Licensee shall demonstrate that the manufacturing arrangements for the penetration welds in the RPV head are such that the welds will be of consistently high quality and will not require repair. AF-UKEPR-SI-43 The Licensee shall undertake validation studies to confirm that the methodology used to calculate the limiting defect size for the RPV outlet nozzle dissimilar metal weld is appropriate. AF-UKEPR-SI-44 The Licensee shall establish the limiting defect size for all High Integrity Components, including situations where cracked body finite element analyses are used to determine the limiting defect size. AF-UKEPR-SI-46 The Licensee shall explicitly identify the full thermal ageing shift in the HAZ material of the low alloy steel welds and any enhanced start of life properties required of the HAZ material in the materials data handbook used to support the UK EPR™. Any enhanced start of life properties for the HAZ should be demonstrated in the complementary fracture toughness testing. AF-UKEPR-SI-49 Should the Licensee adopt the RSE-M Appendix 5.4 fracture assessment procedure, the Licensee shall ensure that there is a capability to undertake assessment to RSE-M Appendix 5.4independently of the company supplying the reactor design in order to support the ongoing operation of the reactor. The availability of technical support organisations to allow the UK Nuclear Regulator (ONR) to commission such assessment work independently should also be considered. AF-UKEPR-SI-50 Should the Licensee adopt the RSE-M Appendix 5.4 fracture assessment procedure, the Licensee shall ensure that the UK methodology for undertaking the fracture assessments based on RSE-M Appendix 5.4is suitable and sufficient to define the methodology in relation to RSE-M, and to explain and justify departures from RSE-M. AF-UKEPR-SI-51 The Licensee shall review the upper shelf fracture toughness values used for areas affected by irradiation damage to ensure that they are consistent with the worldwide experience on the effect of irradiation damage on upper-shelf toughness and ensure that the surveillance scheme is adequate to confirm the assumptions made at the design stage. AF-UKEPR-SI-52 The Licensee shall confirm through appropriate analyses and assessment that the detailed redesign of the MCL pipework to increase counterbore lengths and to lower the cross-over leg does not have any unacceptable safety detriments. AF-UKEPR-SI-53 The Licensee shall demonstrate that the materials properties of the MCL forgings are adequately specified and controlled. This demonstration should include evidence that the M140 and shop qualifications for the MCL pipework remain valid for the modified design, and that the grain size is such that a reliable ultrasonic inspection of the parent material and associated welds can be achieved both during manufacture and in-service. AF-UKEPR-SI-54 The Licensee shall ensure that the surface profile of the MCL pipework is adequately specified and controlled for all those surfaces on which ultrasonic transducers are scanned or from which ultrasonic beams may be reflected. This should include the effects of any local features such as overlay welding to compensate for welding distortions or profile variations caused by the counterbore cutting machine. AF-UKEPR-SI-55 The Licensee shall ensure that during the design, manufacture and installation of all MSL components there are explicit checks on the detailed geometry near welds and other regions which require qualified NDT. These checks should ensure that the local component geometry (e.g. any component thickness changes or tapers) and the resultant surface profiles (both inside and outside the component) are such that an adequate inspection capability is achievable. AF-UKEPR-SI-56 The Licensee shall ensure that the qualified volumetric inspections of welded repairs on the RCP bowl have the capability to reliably detect defects of the target size (i.e. defects smaller than the calculated limiting defect size by a margin of typically 2). The scope of these qualified inspections should include all repairs down to a size comparable with the target defect size and significantly smaller (typically by a margin of 2) than the limiting defect size. AF-UKEPR-SI-57 The Licensee shall ensure that the inspection qualification of the radiographic and ultrasonic procedures for the RCP bowl and potential repairs takes account of the wide variation in the characteristics of potential defects and the need to demonstrate reliable detection and characterisation AF-UKEPR-SI-59 The Licensee shall demonstrate that the assessments of capability of the manufacturing NDT procedures for the flywheel (PT and UT) take account of the HIC nature of the component and the full range of defect types which might occur and that the inspections will provide adequate capability to detect these defects AF-UKEPR-SI-61 The Licensee shall demonstrate that the parameters of the austenitic cladding applied to each HIC component, especially near welds, are adequately controlled and understood so that any potential adverse effects on the inspection capability are tolerable. AF-UKEPR-SI-63 The Licensee shall review the fracture toughness values assumed for the fracture analysis of the MSIV pressure boundary to ensure that they are conservative and are likely to be achieved in practice. AF-UKEPR-SI-64 The Licensee shall ensure that the castings used in the fracture toughness test programme for the MSIV body/bonnet and weld repairs will be suitable for establishing data that is fully applicable to the valve bodies and bonnets installed on a UK EPR™. AF-UKEPR-SI-65 The Licensee shall undertake an MSIV specific fracture mechanics analysis to determine the limiting defect size for the MSIV. The analysis should cover the valve body, bonnet, weld repairs and the connection between the valve body and bonnet. It should postulate defects in all limiting locations taking into account all significant loadings applied to the MSIV including thermal shock and mechanical loads including those from the adjoining pipework. AF-UKEPR-SI-66 The Licensee shall ensure that the volumetric NDT techniques selected for the MSIV body, bonnet and any potential repairs have the capability to reliably detect flaws of the target defect size (i.e. defects smaller than the calculated limiting defect size by a margin of typically 2). The scope of the inspections should cover the full volume of the component and include all repairs down to a size comparable with the target defect size. The Licensee shall also justify the level of qualification to be applied to the technique(s) selected for this high integrity component. AF-UKEPR-SI-67 The Licensee shall ensure that the requirements for all non-destructive inspections of the MSIV body and bonnet (and any potential repairs) are fully specified and taken into account at the design stage. For example, it might be necessary for some inspections to be performed before final machining and weld repairs should be designed so that inspection requirements are satisfied.