ASSESSMENT OF EVENTS IN FRANCE Presented by Didier WATTRELOS

1. ASSESSMENT OF EVENTS IN FRANCEPresented by Didier WATTRELOS INTERNATIONAL CONFERENCE ON OPERATIONNAL EXPERIENCE FEEDBACK COLOGNE 29-31/05/2006

2. REGULATORY REQUIREMENTS • In France, detection of events by the nuclear operator, their assessment and their collection in a data base is deemed to be the basis of the feedback of experience related to safety. • The French regulator then considered it necessary to be informed of the anomalies occurring in the nuclear power plants. • To meet that aim, after discussion with the operator, DGSNR established different sets of criteria characterizing the anomalies to be reported to the safety organisations like DGSNR, DSNR, IRSN. Two levels of anomalies have been defined: Safety Significant Events (SSE)and Events of Interest for Safety (EIS)

3. DEFINITIONS SSE : a SSE is a safety significant event for which an early information is required within 2 days and a report within 2 months. EIS : Theselow level events may affect safety but not in a serious manner. Therefore they need not be the subject of specific report from the operator but they must be collected into the national database, managed by EDF and accessible for both regulatory bodies and IRSN. The Safety Authority issued a guideline defining criteria and mode of reporting SSE. Criteria characterizing EIS have been defined by the operator

4. EXAMPLE OF CRITERIA Criteria triggering the reporting of a safety significant event in a NPP • EMERGENCY SHUTDOWN, except in the context of a deliberate scheduled action or defects affecting the turbine. • ACTUATION OF AN ENGINEERED SAFEGUARD SYSTEM, except in the context of a deliberate scheduled action. • NON COMPLIANCE WITH THE OTS OR ANY INCIDENT THAT COULD HAVE LED TO A NON COMPLIANCE OF THE OTS, HAD THE PLANT BEEN IN A DIFFERENT STATE : • long-term unavailability or multiple inoperabilities • overshooting certain thresholds or authorized values • Actual or potential common mode failure( fire, onsite flooding, system interaction, design or construction error liable to concern several sets of equipment or several plants units…) 4.EXTERNAL HAZARD :earthquake or plane crash, for example. 5.REAL OR ASSUMED MALEVOLENT ACT 6.FALLBACK OF THE UNIT ACCORDING TO THE OTS OR ACCIDENTAL PROCEDURESfollowing an unforeseen behaviour of the plant . • EVENT RESULTING OR POSSIBLY RESULTING IN MULTIPLE FAILURES or affecting redundant trains • EVENT OR ANOMALY AFFECTING MAIN PRIMARY OR SECONDARY CIRCUIT 9.DESIGN, MANUFACTURING, ON-SITE ASSEMBLY ANOMALIES RELATED TO NOT ABOVE MENTIONNED EQUIPMENT that could lead to operation conditions not taken into account nor by design nor by operating procedures 10.ANY OTHER EVENTdeemed sufficiently important by the operating or safety authority (1/3 of incidents).

5. STATE OF THE SITUATION IN 2005 SSE • 792 SSEwere reported in 2005 for 58 units, in which the radiation protection, environment and transport incidents account for 212 incidents. • The average number of SSE remains more or less constant :9-10 per year and per unit. • Most of them occur during unit outages. EIS • Around 15 000 EIS have been reported in 2005.

6. POINTS TOBE DEVELOPPED IN A SSE REPORT • SCENARIO • Initial state • Sequence of events • CAUSE ANALYSIS • Root causes • In-depth causes • DEFENSE IN-DEPTH LINES • Not respected • Respected • Not used but available in case of incident evolution • CONSEQUENCES ASSESSMENT • Effective consequences • For reactivity control • For core cooling control • For containment control • Potential consequences • CORRECTIVE ACTIONS • Required to preclude faulted conditions and inappropriate actions

7. PROCESSING OF FRENCH SSE BY IRSN • Actions taken by IRSN within a week, after the receipt of an early informationby fax • Checking the content of the fax report (is the given information complete and correct) by an engineer in charge of the site safety assessment. • Updating the IRSN database dedicated to SSE (SAPIDE). • Direct exchanges with the operator as soon as the fax is received. • A first meeting is held to select SSE that could be precursor of core damage. If necessary, a PSA is initiated.

8. Actions taken by IRSN following the receipt of the detailed report (~ 2 months) • Complete the updating of the IRSN’s SAPIDE database. • The engineer in charge of the site safety assessment carries out the « first level » analysis of the incident. • Every week, all the SSEof which reportswere received, are reviewed during meetings in the presence of all the engineers in charge of site safety assessment. During these meetings, are selected: • SSEfor in-depth analysis, mainly : • SSEnot foreseen at the design stage. • Complex events involving safety-related system failure and errors, whether due to random faults, common mode failures or system interaction. • Incidents giving rise to errors resulting from failure to understand plant behavior or safety requirements. • Incidents involved with the corresponding design basis incidents. • Potential generic SSE • SSEto be declared to the IRS

9. Guideline to analyse an SSEreport • CONSEQUENCES ASSESSMENT • What were the consequences, together with the knowledge of any similar incidents which may have occurred in the past? • Would the incident have had far more severe consequences in other conditions of the reactor? • SCENARIOand CAUSES • How did the incident take place? • Which safety functions were involved? • How did operators and equipment behave? • DEFENSE IN-DEPTH LINES • How did they operate? • CORRECTIVE ACTIONS • Are they appropriate? • LESSONS LEARNT

10. PROCESSING OF FRENCH EIS BY IRSN • In France, power plants are divided into two major types: • 3 loop plants • 4 loop plants • During two weekly meetings, engineers in charge of site assessment of each NPP series inform other engineers of the events of major interest. Every engineer can give his opinion according to his own speciality. Following the discussion, the engineers in charge of site assessment may have exchanges with the operator to obtain more details. • All the events gathered in the database are also used to perform in-depth analyses. They sometimes reveal that different minor events, occurring simultaneously, might have serious consequences. • Further, potential incidents are selected

11. CONCLUSION In France, only one organisation operates a large number of identical or similar reactors: this gives an accumulated experience • - 790 reactor-years for 3 loop plants • - 345 reactor-years for 4 loop plants • It results in a very large number of data, which is a huge advantage for power plant operations • Nevertheless, the risk is to find an equipment or common mode failure leading to deficiencies in several plants. In this case, the operator and the regulator are bound to react promptly and in an efficient manner. IRSN reports to the EdF and the RB, every three months, on both EIS and SSE which are potentially generic. It makes it possible to check the points outlined by IRSN and operator OE assessment. IRSN assesses in a detailed analysis,every three years, the efficiency of the corrective actions proposed by licensee related to the most important incidents. These analyses are presented to the French Advisory Committee of Experts for Reactors.