Containing a severe accident: the radiological safety goals of the EPR

The design of the EPR takes account of postulated severe reactor core damage sequences to ensure that the probability of occurrence of such accidents, as well as the potential consequences to the plant and the environment, are dramatically reduced in comparison to previous power reactor designs.

In order to control the evolution of a severe accident and to minimise its potential consequences, the design must satisfy the following conditions:

• The occurrence of high-pressure states are avoided.

• A molten core, if it occurs, will be stabilised within the containment.

• The containment, even under the above two conditions, will remain technically leaktight: release rates will remain below 1% by volume per day; all leakages will be collected in a secondary containment which encloses the primary containment.

• The secondary containment (ie the annulus) will be vented via filters and a stack.

• The containment filters should be able to retain at least 99% of all aerosols and radioactive iodine in elemental form.

• The pressure inside the secondary containment will be maintained below atmospheric pressure, during normal operation as well as in the event of an accident.

SELECTION OF SAFETY GOALS

The designers of the EPR set the following safety goals in response to the extreme postulated accident – a core melt:

• No need for stringent countermeasures (except for administration of iodine tablets) beyond the plant perimeter.

• No need for evacuation beyond about 2 km from the plant.

• No need for relocation beyond about 2 km from the plant.

• No long-term restriction of commercial use of foodstuffs produced from a second harvest.

In order to demonstrate compliance with these essentially qualitative safety goals it is necessary to define quantitative criteria for each goal. Numerical criteria have been proposed for so-called “de facto situations” by the International Commission on Radiological Protection (ICRP) in Publication 631. They are intended to be used in an actual emergency situation in which the decision has to be made as to whether a specific emergency action shall be performed or if such an action would cause more harm than the radiation exposure resulting if said action is not taken.

It is evident that a criterion to be applied in a real situation is not automatically appropriate for a situation which is postulated for design purposes but quite unlikely to occur in reality. In a real (ie de facto) situation both the harm of the counteraction and the potential harm of the radiation exposure are not “probabilistic”, but almost certain to occur depending on the decision taken.

In the postulated situation, the benefit (avoiding a potential dose by a specific design effort) is “probabilistic” and quite unlikely to materialise in reality, but the detriment – ie the cost of the design effort – is “real”.

It is therefore mandatory that emergency actions are not included in the list of those to be avoided by provisions in the design which are easily performed in a de facto situation and which are recommended even if the benefit (averting harm by averting dose) is rather small. An example of this is the distribution of iodine tablets which, in a real situation, constitutes a rather inexpensive measure with relatively few negative aspects. It is therefore recommended in a de facto situation, even if the benefit gained is rather limited.

The list of safety goals is therefore restricted to either stringent or long-term countermeasures. Both these categories of countermeasures should not become necessary even if the design-basis case – unlikely as it is, but applied for design purposes – would indeed occur in reality.

NUMERICAL CRITERIA FOR SAFETY GOALS

There exists a well-founded view that numerical limits should be adopted above which – in a real case – the countermeasure is “almost always required”. Below this limit lies a “range of optimisation” where, in a real situation, even a stringent countermeasure may be so easily implemented that it may make sense to do it although providing lower levels of averted dose and thus lower levels of benefit. The low end of this range is a value below which the counteraction is almost never justified.

The EPR design team has deliberately chosen this low end of an “optimised countermeasure” range as the limiting criterion – this means that should the postulated accident occur in reality, the countermeasure in question would not be recommended, even under the most favourable circumstances, for implementation.

This leads to the following numerical criteria:

• The effective dose due to external radiation exposure and inhalation shall be unlikely to exceed 50 mSv for any individual assumed to remain during the entire postulated release at the most unfavourable location beyond approximately 2 km from the plant. An evacuation of persons at this distance would generally cause more harm than benefit should the postulated accident actually occur.

• The effective dose from contaminated ground shall be below 5 mSv per month at the most unfavourable location beyond 2 km from the plant: relocation of even a limited number of persons can thus be excluded should the postulated accident occur.

• The limits which have been provisionally established in the European Union for de facto situations2 shall be met for any harvest except one occurring within a few months after the accident. Again, this criterion shall be met even at the most unfavourable location outside the exclusion area. This criterion serves to ensure that long-term restriction of commercial use of foodstuffs can be ruled out.

POSTULATED EVENT

In order to demonstrate compliance with these safety goals, the EPR designers have postulated a core melt accident leading to extreme concentrations of airborne radioactive substances in the containment. These postulated conditions are based on the following deterministic assumptions:

• 100% of the total core inventory of noble gases, iodine and caesium, 25% of tellurium and selenium and 3% of the strontium become airborne.

• Iodine is considered to be mainly in the form of aerosols. 2.5% are elemental and 0.2% in organic form.

• The amount of airborne aerosols and of elemental iodine decreases due to deposition in the containment. Conservative time functions are used for this process. Fig 1 shows the assumed time behaviour of the aerosols. An absolute value corresponding to a “natural outdoors aerosol concentration” is also given for comparison. Fig 2 shows which fraction of the core inventory of iodine is assumed to be released in form of more volatile compounds and their assumed behaviour over time.

• A leakage of 1% per day from the primary (concrete) containment to the annulus is assumed; the effect of countermeasures which reduce containment pressure are not taken into account.

• The efficiencies of the filters in the exhaust system of the annulus are 99% for aerosols and elemental iodine. Organic iodine is assumed to pass through these filters.

These assumptions lead to a release pattern via the stack as shown in Fig 3.

POSTULATED ENVIRONMENTAL CONDITIONS

With respect to environmental conditions, EPR design engineers have made the following assumptions:

• Time of the accident: The accident is postulated to occur in the growing season (spring to autumn).

• Weather conditions during the accident: Although it is generally agreed that best estimate methods could be applied in demonstrating compliance with requirements for such extreme cases, we chose a more conservative approach. As required for the investigation of so-called “design basis accidents”, we assumed that the safety goals stated above are met if the defined values are not exceeded in 95% of the possible atmospheric dispersion sequences.

• Ecological conditions: Design engineers assumed the same ecological conditions (eg washout and deposition rates from the atmosphere, transfer rates of radionuclides from soil to plants, etc) as those stipulated for use in Germany for the evaluation of design basis accidents3.

• Exposure of individuals: It was assumed that an individual may be exposed during the entire accident at any location outside the plant boundary, including the most unfavourable location. Averaging processes used in other procedures in which the dose is averaged over a given circle around the plant were not applied.

• Biological data for exposed individuals: The same biological data (eg breathing rates) as those prescribed for the evaluation of design basis accidents3 were applied.

METHODOLOGY

Two types of countermeasures were distinguished:

• Countermeasures to be implemented before the accident is under control. And,

• Countermeasures to be implemented after release of radioactive substances to the environment has terminated.

In the first case, countermeasures will generally be implemented in a circular ring with radius r surrounding the power plant as it is difficult to predict changes in wind direction with sufficient reliability. To evaluate these types of countermeasures the computer program PRODOS is used which determines the avertable dose D95(r) to not be exceeded with a probability of 95% at any location beyond the distance r from the plant. Evaluation is performed for different values of r. D95 is then plotted as a function of r. An example of such an evaluation is given in Fig 4. This figure shows how a countermeasure (eg evacuation up to a certain radius) reduces the maximum dose which may be received by a person outside this radius. In case of stack releases the countermeasure will only reduce the maximum dose if it is performed beyond a minimum distance.

The second type of intervention will only be implemented in those areas in which measurements show that an intervention level D is exceeded. D may be a dose, a dose rate or a contamination level for foodstuff (eg Bq/kg). In specific cases (eg the one shown in Fig 5) this may lead to an area of size F(D) (in km2) where intervention could be justified. In a provisional analysis, however, one can only predict the probability distribution for F(D) and certainly not the location of F(D). Our computer program PRODOS determines this probability distribution and identifies a value F95(D) which is the size of the area (where doses may exceed the value D) not exceeded with 95% probability. Again, the evaluation was performed for different values of D and F95(D) could then be plotted as a function of D.

In order to have the criterion (ie the dose or contamination not to be exceeded) on the ordinate (as was the case in the first type of curve) it was decided to plot the inverse function, namely D as a function of F95(D). An example for such an evaluation is given in Fig 6.

The accuracy in determining the size of an area contaminated above a certain level depends on the distances between the points for which values are calculated. These values at points are then converted to areas by the method shown in Fig 7.

The release rate changes (generally decreasing) over time. The release is considered to become negligible only after a rather long period of time. In general, the releases over a period of approximately one week are taken into account.

The release sequence was then assumed to occur during a dispersion sequence which started at the beginning of a long period of time, typically one year. Hourly dispersion data (wind direction, wind speed, rain intensity and dispersion category) must be available for the entire period. The consequences of the release sequence assumed to occur during this dispersion sequence are then calculated.

In the next step it is assumed that the release sequence starts one hour later and is then correlated to a slightly different dispersion sequence. Again, the consequences are calculated. The release interval is shifted by 1 hour in each case until the end of the interval reaches the end of the total time period. Release is thus correlated to each of the potential weather sequences in the given total period.

Because there are no limits in PRODOS to the total time period length but computing time, this time period could be increased. It is also possible to investigate different time periods (eg different years). It was found that a time period on the order of 4000 hours yielded practically the same results with respect to the 95% values than evaluations of much longer periods. Therefore, evaluation of this shorter time period could be used as representative for the majority of computations in order to restrict computing time.

The statistics produced in this manner are still much better than those obtained by other programs which evaluate only slightly more than one hundred sequences with additional restrictions on the changes in atmospheric conditions during the release sequence. One must keep in mind that prolonged but very small releases which may be expected from an intact containment with low leak rates may be affected, at different levels of release rate, by many different atmospheric conditions (including changes in wind direction and those expected to occur between day and night conditions). It is questionable whether three different weather and release rate conditions, as used by other programs, are sufficient to describe this variety of possibilities.

DOSE CALCULATIONS

Fig 8 shows the doses resulting from inhalation and from exposure to the passing cloud. As described before, the doses are expected to be lower in 95% of the cases. The doses are compared to those values at which, in the event of a de facto situation, an evacuation may be justified. As mentioned above, ICRP Publication 63 identifies a level beyond which the countermeasure will practically always be justified. In addition, it gives a range in which the countermeasures may still be justified under specific more favourable circumstances. Below the lowest of these values the action will generally not be justified under any circumstances.

At any location outside the plant boundary the dose calculated for the extreme case postulated for the EPR is always below these “optimised” values.

Also calculated were the thyroid doses which would result if no tablets of stable iodine were administered. Administration of stable iodine is not a “stringent countermeasure” and may be justified even if only low thyroid doses are to be averted by this action. Fig 9 shows that even these low values are not reached outside the plant boundaries. The administration of iodine tablets would not be justified.

Because relocation is a long term measure which would, in a real-case scenario, be based on measurements taken in the plant environs, the sizes of areas in which the ground and plants could be contaminated above a specified level were calculated. Again, the values are calculated which are not exceeded with a probability of 95%. Fig 10 shows the results: even in very small areas the contamination is only a small fraction of those values at which a relocation might be justified.

The contamination of foodstuff depends on the time elapsed between the release and the harvest. Fig 11 shows the results given an elapsed time of 50 days. In the event of a severe nuclear accident, even the foodstuffs contaminated to the highest levels could be sold without any restrictions according to the limits which have been provisionally set by the European Commission.

If harvesting should become necessary in the vicinity of a plant immediately subsequent to a postulated accident, the food from very small areas only might not meet these limits and would have to be controlled. The areas given in the table would be even lower, with a probability of 95%.

The values which have been calculated for meat are those which would result if an equilibrium model – as conservatively applied for design basis accidents – were correct. This model assumes instant transfer from animal feed to the meat. A realistic, dynamic model must take into account the time needed for buildup of concentration in the meat as well as the decrease in contamination of leafy plants due to plant growth and physical decay. Such a model leads to values so low that one can safely say that meat would not have to be controlled, even meat from animals pasturing during and after the accident in the immediate vicinity of the plant.

The only foodstuff which might require control would be fresh salad and milk produced during and shortly after the accident in the immediate vicinity up to a few kilometres from the plant. The areas involved would be less than 2 km2. Here again, one has to take into account that the values to be expected are lower with a probability of 95% and that control of foodstuffs in limited areas and for a limited time is not considered a “stringent countermeasure” within the context of the extreme situation postulated here.

MEETING SAFETY GOALS

The programme described has ensured that the ambitious safety goals set for the EPR are all met with significant safety margins even if the very conservative assumptions which must be applied in the analyses of design basis accidents are also used for the analysis of severe and extremely unlikely accidents.