Safety Analysese for NPPs in Romania

5/21/2018 Safety Analysese for NPPs in Romania

1/42

NATIONAL COMMISSION FOR

NUCLEAR ACTIVITIES CONTROL

Regional Workshop on Application of Best Estimate Plus Uncertainty (BEPU)Analyses, 10-14 March 2008, Budapest, Hungary

CENTER OF TECHNOLOGY AND

ENGINEERING FOR NUCLEAR PROJECTS

ROMANIA 1

Safety Analyses Performed for Nuclear Power Plants

in Romania

Elena DINCA, National Commission for Nuclear Activities Control

Daniel BOGDAN - (CNCAN), Bucharest, Romania

Virgil IONESCU Center of Engineering and Technology for Nuclear

Projects (CITON), Bucharest-Magurele, Romania


2/42

Regional Workshop on Application of Best Estimate Plus Uncertainty (BEPU) Analyses,

10-14 March 2008, Budapest, HungaryROMANIA 2

Content

1. Introduction

2. Conservative and Best Estimate Safety Analysis

Methods for CANDU-6 Design NPPs

3. CNCAN policy for NPPs licensing

4. Nuclear safety analyses performed for Cernavoda

NPPs

5. Specific safety issues to CANDU NPPs

6. Conclusions


3/42

Regional Workshop on Application of Best Estimate Plus Uncertainty (BEPU) Analyses,10-14 March 2008, Budapest, Hungary

ROMANIA 3

Romaniainterested in CANDU 6 project (700 MWe)

CANDUCANadian Deuterium Uranium Cernavoda NPPs: Unit 1 in operation (since 1996) Cernavoda NPP Unit 2 at 100%FP (September 2007) Cernavoda NPP Units 3, 4, 5 under preservation (feasibility study)

Nuclear Safety Analyses, performed for: NPPs licensing NPPs ageing assessment Support for a continuous nuclear safety improvement, by:

Plant modifications

New design Support for plant lifetime extension, etc. Analysis methodology models and input data

Are in a continuous improving process. The conservative approach isgoing to be replaced by a more realistic best estimate plusuncertainty analysis.

1. Introduction


4/42


ROMANIA 4

Deterministic safety analyses may be performed: at the limit of operating envelope (LOE)or

a best estimate and uncertainty (BEAU)methodology may be used.

As a rule, uncertainties are not included in the LOE analysis

CANDU reactors were licensed using deterministic conservative

safety analysis, which evaluates consequences from postulatedinitiating events and sequences of events (LOE method).

The essential elements of the LOE analysis are as follows:

Analysis input parameters:key and nonkey operating/design parameters

Modeling parameters

Plant operating state

Deterministic assumptions

Computer models

2. Conservative and Best Estimate Safety Analysis

Methods for CANDU-6 Design NPPs


5/42


ROMANIA 5

The CANDU design featureshistorically have influenced formation ofthe Canadian regulatory philosophy, as well as of the safety analysismethods and acceptance criteria.

According to RD-310 Canadian regulatory document: The safetyanalysis shall build in a degree of conservatism to off-set anyuncertainties associated with both NPP initial and boundary conditionsand modeling of nuclear power plant performance in the analyzedevent. This conservatism shall depend on event class, and shall becommensurate with the analysis objectives.

Historically, the reasons for excluding random modeling uncertaintieswere as follows:

large originally predicted margins

belief that conservatism achieved by assuming the limiting values of

operational parameters and imposing of certain deterministic assumptionsmore than adequately covers modeling uncertainties

lack of well defined modeling uncertainties

The impact of modeling uncertainties is usually investigated byperforming sensitivity studies.

CANDU-6 Safety Philosophy


6/42


ROMANIA

Deterministic Nuclear Safety Analysis

SIMPLIFIED DIAGRAM

Deterministic

Safety Analysis

Support AnalysisDesign Analysis Licensing AnalysisPerformance Analysis Uncertainty Analysis

Normal

Operation

Abnormal

Operation

Accident

Condition

Radiological

Analysis

Containment

Analysis

Thermal-Hydraulic

Analysis

Fuel and Fuel

Channel Analysis

Neutron

Analysis

Structural Analysis

Common Cause Event Analysis

Nuclear Safety

Assessment

LOCA events NON-LOCA events


7/42


ROMANIA 7

From a safety analysis perspective, the CANDU reactor has some

distinctive features and characteristics:

The natural uranium fuel resides in a matrix of individual horizontal

fuel channels within short fuel bundles and is irradiated to relatively

low burnup

The primary circuit is relatively complicated, with heavy water at

high pressure and high temperature (100 bar, 312C)

The moderator system is separated from the coolant, contains a

significant amount of heavy water (~260 Mg)at low pressure and

low temperature (1.02 bar, 65 C) with a cooling capacity of about

5% FP

Re-fuelling is performed at power

The reactor has a positive core void

reactivity coefficient.

CANDU 6 - Main Characteristics


8/42


ROMANIA 8

CANDU-6 NPP scheme


9/42


ROMANIA 9

The operating power reactors in Canada have been licensed according

to requirements as those presented in the C-6 regulatory guideRequirements for the Safety Analysis of CANDU Nuclear Power Plants(C-6, 1980, issued by AECB).

According to C-6 and RD-310 regulatory documents of CNSC, theevents in CANDU NPPs could be classified as: Anticipated Operational Occurrences (AOOs) include all events with

frequencies of occurrence equal to or greater than 10-2 per reactor year; Design Basis Accidents (DBAs) include events with frequencies of

occurrence equal to or greater than 10-5 per reactor year but less than 10-2per reactor year; and

Beyond Design Basis Accidents (BDBAs) include events with frequencies ofoccurrence less than 10-5 per reactor year.

Accidents are also categorized into 5 classes which reflect the frequencyof the accident. For example:

Class 1 category: highest frequency; high number of occurrences perreactor year (1 per 100 years < 1/ f < 1 per year)

Class 5 category: lowest frequency; low number of occurrences per reactoryear (1 per 100000 years > 1/f)

CANDU 6Events Classification (1)


10/42


ROMANIA 10

The evaluation methodology and acceptance criteria are

different for different event categories. Briefly, the evaluationmethods are as follow:

Category Aevents are deterministically analyzed. Conservativeassumptions are used for initial plant conditions and mitigatingsystems availability, which impose the most stringent conditions onsafety system design. The category A events are called Design

Basis Events; their analysis is the subject of Chapter 15 of a NPPPreliminary/Final Safety Report.

Category B events are analyzed probabilistically. Realisticassumptions are used to provide information to operators on themost probable plant response in case of the analyzed event.

Category C and Devents are qualitatively assessed. Category Ccomprises external hazard events and Category D comprisesevents with a very small occurrence frequency (e. g. steamgenerator support or shell failure).

CANDU 6Events Classification (2)


11/42

Regional Workshop on Application of Best Estimate Plus Uncertainty (BEPU) Analyses,10-14 March 2008, Budapest, HungaryROMANIA 11

According to C-6 Canadian consultative document, the analysisfor AOOs and DBAs shall demonstrate that:

Radiological doses to members of the public do not exceed theestablished limits (acceptance criteria level 0); and

The derived acceptance criteria, established for accidents are met

Safety analysis for AOOs and DBAs shall demonstrate thecorrect application of safety principles.

Analysis for BDBAs shall be performed as part of the safetyassessment to demonstrate that:

The nuclear power plant as designed can meet the established

objectives of safe operating envelope; and The accident management program and design provisions put in

place to handle the accident management needs, are effective.

CANDU 6 Safety Analysis Methodology


12/42


According to C-6 consultative document:

Mathematical models and calculational methods(including inputdata) recommended for CANDU NPPs represent a conservativeprediction for each of the safety analysis requirements;

Allow for bias in calculational methods at high confidence limits (95percent). In higher event classes, assess sensitivity analysis,degraded mitigating system functional capability, a second diversemitigating system actuation parameter, and worse plant states assurrogates for calculational tolerances of higher confidence.

All physical phenomena should be accounted for, and simplificationsshould be appropriate.

When choosing conservative assumptions and error tolerances,

identify and account for the presence of each effect separate(thresholds, timing, competing effects, different failure mechanism,different reactions, different transport processes, structural integrity).

CANDU 6 Safety Analysis Methodology (2)


13/42


CANDU 6 Conservative Assumptions for

Deterministic Safety Analysis

The deterministic approach uses several generic assumptionswhich are applied in assessing the consequences resulting fromthe postulated accidents. These include the following:

Reactor trip occurs at the second trip signal on the less effectiveshutdown system;

Intervention by the operator is not credited during the first 15

minutes following the the clear and unambiguous indication thatan initiating event has occurred and that operator action isrequired initiating event;

Mitigating action by process system response is not credited;

Each special safety system is assumed to be in its minimum

allowable performances configuration.

Computer codes and models are in a continuous improvingprocess and allow a better simulation of CANDU specificphenomena

D t i i ti f t l i d i


14/42


- local moderatorbehaviour

ContainmentPRESCON2

GOTHIC

Thermal hydraulics

CATHENA

Reactor Physics

RFSP

Fuel Channel

CATHENA

Fuel

ELESTRES

ELOCA

Atmospheric

DispersionADDAM

- header boundary

conditions

- power transients

- power transient

- thermal hydraulic boundary

conditions

- fuel/sheath temperatures

- metal/water reaction- fission product inventory

distribution

- fuel failure

- fission product release

- pressure tube strain

- post-contact pressure tube/

calandria tube behaviour

- high building pressure trip

- ECC conditioning signal

- activity release

- weather scenario

- release height/location

- power transient

Public

Dose PEAR

Moderator

MODTURC_CLAS

- coolant characteristics

Deterministic safety analysis process used inpresent for CANDU-6 NPPs


15/42


CATHENA Computer Code Characteristics (1)

CATHENA- The main computer code used in present for

deterministic thermalhydraulic safety analysis CATHENA- CanadianAlgorithm for THErmalhydraulic NetworkAnalysis

One-dimensional, two-fluid system thermalhydraulics code

Developed by AECL primarily for analysis of postulated LOCAevents in CANDU reactors and then developed

Non-equilibrium model (2-velocities, 2-temperatures, 2-pressuresplus noncondensables)

CATHENA interfaces to other codes:

Fuel Behaviour: CATHENA / ELOCA

Reactor Physics: CATHENA / RFSP Containment Thermalhydraulic Behavior:

CATHENA/PRESCON2


16/42


CATHENAs heat transfer model:

Multiple surfaces perthermalhydraulic node

Radial and circumferentialconduction modeled

Models heat transfer within

bundles subjected to stratifiedflow

Radiation heat transfer calculated

Built-in temperature dependentmaterial property tables

Models deformed geometry andpressure/ calandria tube contact

CATHENA Computer Code Characteristics (2)


17/42


CATHENA Validation

CATHENA has been validated, in a formal process, for safety and

licensing analysis of CANDU Reactors, including by the experimentalloop simulation RD-14

Validation has proceeded on a phenomenon-by-phenomenon basis

Standardized and documented models of facilities used where they exist

Default code settings used throughout unless otherwise specified and

justified

Data selected in validation process includes numerical tests, separateeffects, component and integral tests, as well as transients in CANDUplants

Sensitivity analysis conducted to identify impact on simulations of

experimental errors used as boundary conditions (e.g., power) andnodalization

Uncertainty analysis conducted to identify impact on code results (e.g.,uncertainty in heat transfer correlations)


18/42


Development of Best Estimate Analysis Methods for

CANDU Project (1)

It has been recognized, by both the industry and the Canadianregulator, that BE+UA methods have reached sufficient maturity

to allow more accurate and realistic modeling of accident

transients, thus presenting an opportunity to better quantify

safety margins.

It is expected that in many cases a BE+UA analysis will be ableto show larger margins than it was possible to demonstrate using

the conservative approach.

If a BEAU-type of analysis methodology is used, the acceptance

criteria should be met at a certain level of probability andconfidence limit commensurate with the risk posed by the

postulated event.

D l f B E i A l i M h d f


19/42


The industry has started several projects aimed at thedevelopment and application of BE+UA methods

Results of the BE+UA analysis are expected to play animportant role in decisions related to:

avoid of economic penalties,

relaxation of overly restrictive operational practices,

dealing with plant ageing effects,

resolution of outstanding safety analysis issues

The industry has requested the Canadian regulatory body toevaluate the admissibility of such methods for licensingpurposes

There is confidence that the best estimate methods will find wideuse in the licensing process in Canada in the next future and inthe other countries which operate CANDU NPPs, includingRomania.

Development of Best Estimate Analysis Methods for

CANDU Project (2)


20/42


3. CNCAN Policy for NPPs Licensing

General licensing conditions of a Romanian NPP are provided in Law

No. 111/1996 on Safe Deployment of Nuclear Activities withsubsequent modifications and completions

Specific requirements for Romanian NPPs licensing related to safety

analyses are provided in CNCAN Norms. CNCAN elaborated specific

regulations for special safety systems, Periodic Safety Review, and

Probabilistic Safety Assessment reports content. CNCAN uses the following international standards in the process of

nuclear regulation in Romania: IAEASafety Standards and Guides;

AECL (Atomic Energy Canada Limited) Standards and

Guides

Regulatory documents developed by Canadian Nuclear

Safety Commission (CNSC) and US NRC;

Applicable Standards and Codes (CSA, ANSI, ASME, IEC,

IEEE, etc.);

Doc ments containing req irements sed b


21/42


Documents containing requirements used by

CNCAN in the licensing process

Law

Regulations, Standards and

Codes

Regulatory letters

+licensees documents previously approved by CNCAN

(such as Safety Analysis Reports, Management Manuals,

etc.)

(

CNCAN dispositions and actions stated in the inspection reports

+licensees procedures previously approved by CNCAN (such as reference

documents, station instructions, etc.)

Regulatory requirements,

criteria and conditions

Regulations,

Standards and Codes

Law

Regulatory letters+

licensees documents

previously approved by CNCAN

CNCAN dispositions and actions

stated in the inspection reports +

licensees procedures previously approved

by CNCAN


22/42


CNCAN Approach for Safety Analysis Methods (1)

Romanian regulatory systeminfluenced by the Canadian

regulatory philosophy but much more prescriptive. The current Canadian regulatory regime is based on the principle that

the licensee has primary responsibility for safety and that detailedregulatory prescription is unnecessary and detrimental to the licenseecarrying out that responsibility.

It is a firmly established principle in the Romanian regulatory practice torequire that adequate safety margins be maintained and demonstratedby the safety analysis.

The analysis must show that the facility meets all specified criteria withsufficient margins to cover any uncertainties in the methods of analysis.

In Romania, as in Canada, two types of acceptance criteria are used in

safety analyses:

radiological dose limits

derived acceptance criteria.


23/42


Deterministic safety analyses for Design Basis Accidents are

provided in Chapter 15 of FSAR for NPP licensing The requirements for the Design Basis Accidents for Cernavoda

NPP Unit 1 &2 were reviewed before the commissioning of theplant started, and during the commissioning phases. The reviewwas based on:

the feedback from other projects, updated the systematic review using PSA level 1 analyses in parallel with

the licensing process

the use of external independent expertise for those topics forwhich independent review of the evaluations was needed.

It was reviewed the trip coverageas defined in the FSAR,which was of concern mainly for partial and low power states.

current status of the research was considered, like theexperiments on molten fuel -moderator interaction, review of theanalyses for flow blockage etc..

CNCAN Approach for Safety Analysis Methods (2)


24/42


Aplication of CANDU Defense in Depth concept

Operating

Limit

Trip imit

Safety imit

Operating Margin

Safety Margin

Operating

Domain

Design Center

Normal Operation

Design Basis Accidents

Severe Accidents


25/42

Regional Workshop on Application of Best Estimate Plus Uncertainty (BEPU) Analyses,10-14 March 2008, Budapest, HungaryROMANIA

Accident Analysis Acceptance Criteria

Acceptance criteria level 0Releases limiting individual doses

REQUIREMENT EVENT CLASS

1 2 3 4 5

(i) Effective dose mSv

(ii) Eye mSv

(iii) Skin (average on 1 cm2)mSv

(iv) Liquid effluent emissions during 30 days

are less than derived annual dose limits for normal operation

0,5

5

20

+

5

50

200

+

30

300

1200

N

100

1000

4000

N

250

1500

5000

N

Legend: + the limiting condition will be satisfied for the worst failure sequence of the

specified class of events

N the limiting condition is not necessary

Acceptance criteria level 1Criteria derived from associated licensing requirements

Acceptance criteria level 2Criteria derived from analysis modelling assumptions

EVENT CLASS Probability1/reactor * year

1

2

3

4

5

>10-2

10-2 10-3

10-3 10-4

10-4 10-5

10-5 10-7


26/42


Requirements for the licensee

The Licensee has to take actions to develop and maintain thecapability for full independent from the original designercalculations.

The Licensee will address the issue of the systematical review

of safety within the periodical safety review process, in thelong term research and development program, in cooperationwith COG.

The performance of all the calculations for the FSAR and

support documents, are to be performed based on codeswhich are in V&V (verification and validation ) and/or alreadyvalidated. The data are checked against the site specific data.


27/42


4. Nuclear Safety Analyses Performed for Cernavoda NPPs

For Cernavoda NPP Unit 1, the process systems failures analysed in

Chapter 15of FSAR, include: loss of reactor regulation;

LOCA events (large LOCA and small LOCA);

pressure tube rupture;

channel flow blockage;

end-fitting failure; fuelling machine events;

pipe breaks in HT auxiliary systems;

loss of off-site power;

seizure of a primary heat transport system main pump;

pressurisation events - primary side;

depressurisation events - primary side;

feedwater line breaks;

steam main breaks;

steam generator tube


28/42

Regional Workshop on Application of Best Estimate Plus Uncertainty (BEPU) Analyses,10-14 March 2008, Budapest, HungaryROMANIA

Accident Analysis Technology for Cernavoda NPP Unit 1

ACCIDENT ANALYSIS APPROACH:

Conservative approach = Conservative codes + Conservative assumptions

DESIGN BASIS

ACCIDENT

Single Failure

F/H

PHTS

LOCA

-S-LOCA

- L-LOCA

- PT rupture

- EF rupture

- Flow blockage

- Feeder break

- Single SG tub rupture

- Multiple SG tub rupt.

- HTS auxiliary failures

LOF

-Loss of normal power

- Pump seizure

LOR

-Loss of P&IC

- Loss of P&IC compon

- Loss of react. control

S/G + FW

F/W break

-Up. Check valve

-Dw. Check valve

LOF

Loss of normal

power

LOR

-Loss of BPC

- Loss of BLCLOCA

On reactor

ESCS

LOI

Pipe

breaks

LOF

Loss of

normal

power

LOHS

Loss of

RCW,

RSW

MMS

LOI

Pipe

breaks

LOF

Loss of

normal

power

LOHS

Loss of

RCW,

RSW

LOCA

Off reactor

S/G + MSS

MSLB

Inside R/B

MSLB

Outside R/B

Dual Failure =

Single Failure

+ECCS impairment

Containment impairment

Nuclear safety analyses performed for


29/42



Cernavoda NPPs (2)

The safety analyses for Cernavoda NPP Unit 2were based onthe guidelines provided in the document Requirements for theSafety Analysis of CANDU Nuclear Power Plants (C-6, 1980,issued by AECB).

For Cernavoda NPP Unit 2, the analyses provided in the

Chapter 15 of the FSAR were grouped in sections dedicated to:

Heat transport system LOCA events

Heat transport system non-LOCA

Steam and feedwater circuit events

Moderator events

Shield cooling events



30/42


Examples of safety analysis requirements introduced by C-6consultative document that differ from previous practices aregiven as follows:

a requirement for a systematic review for the identification ofpostulated initiating events;

five event classes, replacing the two concepts of single and dualfailures;

correlation of event classes with probability of occurrence andallowable release limit;

more explicit consideration of combinations of postulated initiating

events with failures of mitigating systems (not just the dual failuresconcept).


Cernavoda NPPs (3)


31/42


Licensing requirements for Unit 2

Cernavoda NPP embedded in the basic safety design the coverage of

a broad area of BDBA events (Category A of events, analyzed in

Chapter 15 of PSAR/FSAR)

The results of the review lead to a situation when some events in the

category of BDBA should be included in the DBA category for

Cernavoda unit 1. For Unit 1, the modifications are to be addressed in

the Periodical Safety Review process starting from 2008.

These results are applicable for Unit 2. The review of the licensing

requirements for unit 2 led to postulating more events from the BDBA

category, some of them involving the re-qualification (EQ for instance)

by comparison with Unit 1.

There are going on evaluations of the Cernavoda safety, including theDBA definition.


32/42


Category A Events (1)


33/42


Category A Events (2)

N l f t l f d f


34/42


A Safety Analysis Strategic Programme(SASP)was developed by

Cernavoda NPP Unit 1 and approved by CNCAN The main objective of SASP is to get a better definition of the plant

safe envelope

SASPintended also to create and develop a group that will beable to perform and re-evaluate the safety analyses results.

SAPS purpose was to update, based on plant specific models andstate of the art computer codes, the entire set of accident analysesincluded in the Cernavoda Unit 1 Safety Analyses Report.

In the framework of SASP, Cernavoda NPP started to perform anew set of analyses for Unit 1, in accordance with the currentregulatory requirements and standards.

Cernavoda NPP is a member of COG (CANDU Owners Group) and

uses the last versions of CANDU specific computer codes and shares

with COG members a common data base, SEREX, containing

operating experience events.


Cernavoda NPPs (4)



35/42


The generic severe accident analyses and severe accidentmanagement guidelines (SAMGs) developed by the CANDUOwners Group for CANDU 6 are going to be used byCernavoda NPP in the elaboration of plant specific analysesand SAMGs.

At the moment, specific information reports and procedures areprepared at the plant for establishing the framework for thisprogramme, including the allocation of resources and thenecessity of training, the activities that need to be performedwith external support, etc.

The specific computer code MAAP4-CANDU will be used forintegrated analysis of severe accident sequences.


Cernavoda NPPs (5)


36/42


Computer code and plant model val idat ion

Recent experimental data in reactor physics area identified several

shortcomings of the major analysis tools in cell codes such as

POWDERPUFS-V. The most important shortcomings found are:

inaccurate predictions of key parameters for accident conditions,

lack of proper validation data for important phenomena and

range of conditions, and

significant gap between the state of knowledge reflected in the

licensees computer codes and the current state of knowledge in

this area.

5. Specific safety issues to CANDU NPPs


37/42


Compl iance w ith Bundle and Channel Power Lim i ts

The limiting values for bundle and channel powers are specified inthe Operating License for each station.

Licensees ensure compliance with these limits by following operatingprocedures, which are based on analyses.

However, current validation of the channel and bundle poweranalyses method is such that the errors associated with theircalculations are not well-defined.

If larger allowances for uncertainties were needed, channel or bundlepower may become more limiting than bulk power.

(source: Generic Safety Issues For Nuclear Power Plants WithPressurized Heavy Water Reactors And Measures For TheirResolution, IAEA, Vienna, 2007, IAEA-TECDOC-1554 chapter AA2).

Specific safety issues to CANDU NPPs (2)


38/42


Operat ion w ith a Flux Ti l t :

The adequacy of Regional Overpower Protection (ROP) or NeutronOverpower Protection (NOP) trips for reactor operation with a fluxtilt is demonstrated by analyses, which take into account differentplant states for which continued operation is permitted.

ROP/NOP system design is based on information derived fromsimulations of certain reference and perturbed flux shapes in thereactor core.

Trip setpoints are established from these simulations to prevent anychannel reaching its critical power limit in case of a bulk loss ofregulation.



39/42


Operat ion w ith a Flux Ti l t :

In order to demonstrate the adequacy of ROP/NOP trip setpoints,licensees should:

determine the maximum tilt permitted by the current operatingprocedures for prolonged operation with a flux tilt, prior to any

operator action, generate a steady state flux distribution, corresponding to the

maximum tilt permitted by the current operating procedures, anddesign-basis and abnormal perturbation flux shapes,corresponding to this steady state shape,

assess simulation ratios (ratios of changes in fluxes andchannel powers due to perturbations) for the above flux shapes,and assess the ROP/NOP trip coverage by determining whetherthe ratios are invariant within any postulated error allowance.



40/42


PHT Pump Operation Under Two -Phase Flow Cond i t ions:

The operation of Primary Heat Transport (PHT) pumps under lowsuction pressure and significant void can be detrimental to theintegrity of the PHT system piping due to the generation of largeamplitude pressure pulsations and excessive pump set vibration.

In the past, the PHT piping fatigue analysis was done using a limitingforcing function (harmonic excitation) obtained from laboratory tests offull-scale PHT pumps.

Given the underlying assumptions, especially the amplitude andfrequency of excitation, this approach was very sensitive tointerpretation of the test data and their application to the PHT system.

Consequently, the assessment of the piping fatigue life may not havebeen conservative.


6 C l i


41/42


The safety analyses support provided for the licensing of the two units ofCernavoda NPPwas based mainly on the plant designer and theanalyses of similar CANDU NPPs.

However, over the years the license holder has developed its owncapability of performing accident analyses, using state-of-the-artcomputer codes and appropriate methodologies, according to the bestpractice of CANDU NPPs .

A Safety Analysis Strategic Programme was developed by CernavodaNPP Unit 1 and approved by CNCAN. Up to date a main part of theanalyses from Chapter 15 of FSAR has been performed and a strongteam of Safety Analysis is working at Cernavoda NPP Unit 1.

Best estimate computer codes with conservative assumptions are used

for deterministic safety analyses. As an active member of COG (CANDU Owners Group), Cernavoda NPP

uses the last versions of CANDU specific computer codes and safetyanalysis methodologies and has access to a common data base.

6. Conclusions


42/42

References (excerpt)

Law No. 111/1996 on Safe Deployment of Nuclear Activities

Safety Analysis of CANDU NPP- Regulatory Guide, AECB 1999

C-006, Requirements for the Safety Analysis of CANDU NPPRegulatory

Guide, AECB 1980

C-006 (Rev. 1) (E) Safety Analysis of CANDU Nuclear Power Plants, AECB,

1999

Guidance for Accident Analysis of Commercial NPPSafety Report, IAEA

1999 Regulatory Document RD310, Safety Analysis for Nuclear Power Plants,

2008

The Technology of CANDU Loss of Coolant AnalysisTTR 276, AECL 1991

CSA N286.7Quality Assurance of Analytical, Scientific and Design

Computer Programs for NPP, rev. 4, 1998

Manual on Quality Assurance for Computer Software Related to the Safety ofNPPTRS 282, IAEA 1988

Generic Safety Issues For Nuclear Power Plants With Pressurized Heavy

Water Reactors And Measures For Their Resolution, IAEA, Vienna, 2007,

IAEA-TECDOC-1554