EPR, an explosive technology

This is the translation of one of the documents the Network “Sortir du nucléaire” (“Phasing out nuclear power”) got from an EDF inside source. It brings an overview of the technical issues hinted to in the other documents and particularly in the set of EDF leak documents.

All the documents can be downloaded on the website of Sortir du nucléaire at www.sortirdunucleaire.org

For more detailed information, contact charlotte.mijeon [at] sortirdunucleaire [dot] fr, or + 33 6 75 36 20 20

EPR, an explosive technology

A reactor with reduced power output

The "Preliminary Safety Analysis Report [PSR] of the Flamanville 3 EPR" (public version 2006) lists the characteristics of the reactor, and compares them to those of the "N4 type" reactors (the Chooz and Civaux power plants). However, an EDF report from 2004 [1] shows that the EPR electrical output would initially be 180 MWe less than the figure put forward in the Preliminary Safety Report.

The power of the EPR reactor will therefore be equivalent to that of more recent power plants (N4 type). As for the unbelievable technological leap of a 1.5% efficiency increase, it all seems a bit of a smokescreen. Given the same thermal power (Pth) and electric power (Pe), the two types of reactor can only have the same efficiency, of the order of 34%.

Another document explains that "EPR is designed to operate with an increased output of 4,500 MWth [thermal megawatts] in the medium term" [2] (§4.10). There is hint of what "medium term " is. "However, the figure used for the accident analysis published in the Preliminary Safety Analysis Report EPR is 4250 MWth" [1] (§4.1).

An exorbitant energy

Is this power discrepancy important? Yes, because it affects the production cost of the reactor. For the same construction costs, a more powerful reactor will produce more energy, and at a lower cost per megawatt hour (MWh).

C. Pierre Zaleski and Sophie Meritet of the Centre de géopolitique de l’énergie et des matières premières (CGEMP, the French Research Centre for the Geopolitics of Energy and Raw Materials) estimated the cost of an EPR-MWh at €41 in 2004, based on construction costs of €3 billion and a power output of 4,500 MWth [3]. A MWh is now thought to cost around €55, because of the extra costs of construction, which have been cautiously estimated at €4 billion [4]. And this may well increase, because of building contingencies, contractor's lack of transparency over real costs and is meant by "medium term" for increasing output from 4.250 to 4.500 MWth...

The production costs of nuclear energy make an interesting study. The "baseload" MWh is sold by EDF on today's energy market at €35, with a production cost between €33 and €34 for the current PWR power stations.

The EPR will therefore produce "baseload" energy at a loss, even if the "baseload" MWh is slightly overpriced, to suit EDF. Yet the cost of a MWh at "peak" demand can exceed €100 on the electricity "Spot Market"[5].

But the EPR is designed to function in "load-following" and "frequency-power tuning" modes. It is meant to achieve rapid power changes thanks to its revolutionary control mode: "IRP", or "Instant Return to Power" (RIP in French).

In this case, EDF could probably be able to recoup its investment.

Serious accident

Probably....But we have uncovered an EDF technical report [6] which refers to the "EDG FA3".

What does this jargon mean? FA3 is the abbreviation for Flamanville 3 and EDG (“éjection de grappe”) is the acronym for a "control rod cluster ejection" accident. The function of the rod clusters is to drive and control the reactor's power output. They act both as accelerator and brake. A control rod cluster ejection accident is like having a jammed accelerator. At full speed....

Paragraph 15.2.4.e of the "Preliminary Safety Analysis Report" describes "EDG FA3".

"This accident causes a primary coolant leakage through the ruptured casing of the ejected control rod cluster control drive mechanism" and "generates a very fast transient [...] with an ejection time of 0.1 second".

The control rod cluster ejection produces a "rapid positive reactivity transient followed by a power excursion". Thankfully, "the negative Doppler feedback" and "the automatic reactor shutdown (...) initiated at the time of the peak power excursion" stop the process. In theory.

But the report also mentions that the reactor may, in the case of low power control rod cluster ejection, exceed "prompt criticality".

What does this obscure term mean? To get some idea, try doing an internet search for "prompt criticality" and visit the site of the very pro-nuclear Société française d’énergie nucléaire (the French Nuclear Energy Society). You will find a technical report of the Chernobyl accident. Without a control rod cluster ejection accident, the reactor reached "prompt criticality and the power attained a hundred times its nominal value in a few seconds" [7].

"However, one must not forget that the accident which occurred in Chernobyl was a prompt criticality accident in a power reactor.

As the IPSN [the French Institute for Radiological Protection and Nuclear Safety] points out, criticality accidents are particularly dangerous because when the medium is subcritical, the neutronic power is very low, and if the medium becomes supercritical for whatever reason, it can give rise to a neutronic power excursion similar to an explosion" [8].

The online encyclopedia Wikipedia says: "prompt criticality is the region in which nuclear weapons operate".

Could the EPR also explode?

This question is justifiable, in the light of the EDF documents.

Runaway reactor

In a feasibility study [9], EDF engineers identified the "control rod cluster ejection accident" as a "potential problem for EPR". It mentions the "critical number of fuel rods affected by boiling crisis" being "significantly exceeded". Between "20 and 30%" of the fuel rods could then break in this case.

To summarise, there is a local runaway reaction in the reactor (power excursion), the fuel heats up, the water which was cooling it starts boiling (boiling crisis).

A physicist could work out the balance sheet between the Doppler feedback and the temperature effect stabilising the supercritical reaction with the effects resulting from the phase change of the moderator (water/steam), the lower levels of boron in the steam and the presence of a "heavy reflector" to limit the rapid neutron leak rate.

Table 3 in the document [9] presents the results of the Areva simulations, showing that the fuel could reach a temperature of 2779°C, with fusion occurring at 2800°C. Such impressive precision! Intriguingly, although it contains uranium oxide at a temperature close to 2800°C, the casing would only reach 1458°C. In addition, the temperature at which fuel fusion occurs decreases with irradiation. Around 40°C for EPR high "burn-up" fuel.

Paragraph 6.1.6 tells us that "since the difficulties experienced during control rod cluster ejection are mainly due to the control system, and more precisely to the need to maintain the Instant Return to Power capacity (...), the ultimate way to improve the outcome of the risk assessment is to modify it".

So the "RIP"mode is a problem. The solution would be to withdraw this rather constraining control mechanism. Would EDF sacrifice profit for safety? This "could only be considered at best as a temporary measure, whilst finding a long-term acceptable solution".

Acceptable to whom? Chapter 7 mentions the possibility of "replacing the current criteria" with another "analytical" method. This solution will need to "be documented by evidence showing that the current criteria are respected under the existing exploitation constraints whilst the evidence is examined by the ASN (the French Nuclear Safety Authority)". The Nuclear Safety Authority, the nuclear watchdog, which has repeatedly had to eat its own hat. There is even a mention in the "Action Plan" of preparing a "strategy for approaching the ASN"....

Note that "Areva does not appear to encounter those problems in the course of the feasibility studies for OL3 (...) The main reasons for this seem to be that the penalties have not been taken into account, a more forgiving review methodology has been used, and there is a lack of evaluation of high burn up" (Chapter 5). But "OL3" refers to the EPR being built in Finland, where Areva is beset with other problems: four years behind schedule...

Problematic safety

Let's go back to the document referring to the "solutions to the control rod cluster ejection problem" [2]. This technical report considers all available solutions to the "problem" and confirms that there is "evidence of serious and generalised exceeding of the safety criteria", despite modifications to the control mode. At least, this is clear...

It also states (para. 5.3) that for the N4 type, the management of the "Alcade" [10] fuel is such that "the current safety criteria for control rod cluster ejection are followed without any safety margin". These reactors are therefore already operating on a tight rope, because "without a safety margin" there is no room for calculation error.

Major modification

At the end of 2007, Areva revised the reactor's design, planning to replace a number of highly neutron-absorbing control rod clusters (known as "black control rod clusters") by less absorbing clusters ("grey control rod clusters"), but without withdrawing the IRP control mode, the source of the problem The document [11] explains that in some cases "the shutdown margins will be small or insufficient", that "some of the difficulties persist" and "will remain present at high power levels during control rod cluster ejection", despite having replaced the "black" clusters with "grey" ones. In Appendix 1 (page 24) , the "NCE" (“Nombre de Crayons en crise d'Ebullition”, number of rods affected by boiling crisis) at nominal power stated is around 10%.

Such a change in the efficiency of a reactor's control rod cluster may appear like a major design modification, which could invalidate the safety assessment approved by the ASN. This was suggested in the following 2007 document (§ 7): "the revised cluster configuration is an important design modification subsequent to the PSAR [Preliminary Safety Analysis Report] which led to the DAC [Decree of Authorisation of Creation], and the ASN may decide that the report is no longer applicable".

The small benefits gained during control rod cluster ejection with less neutron absorbing grey rods are lost in case of steam generator tube rupture (SGTR). This squares the circle.

An insoluble problem

So we have seen that the "NCE" remains high despite various modifications. The EDF report mentioned in [6] gives a comprehensive analysis of the "EDG" problem. In 2009, the problems persist, and others related to radioprotection are becoming apparent (§8.2.1):

"Given the planned increase in EPR output to 4500 MWth, if the EDG simulation in the 4300 MWth Safety Report are run with few or no allowances, the (physical) margin balance will automatically be reduced at 4500.

Under those conditions, there are few advantages in opting for low provisions to maximise physical margins, resulting in constraints on the operations, huge amounts of calculations during recharging and degradation of safety margin in case of further modifications.

The only reason for modifying this perspective would be a concern that the calculations of radioactive discharges could not be accommodated by the equipment classification (because of modifications to the installations). Indeed, EPR equipment is only classified for 1% of broken rods.

But if the EPR discharge simulations assume, as it is currently the case, that rods affected by boiling crisis during EDG are broken, it is then ovious that this figure should be minimised. However it must be noted that it is absolutely impossible for an EDG simulation to produce a NCE lower than 1%, as the EPR NCE forecast lies between 6 and 9%".

Rupture of the first two barriers

During "control rod cluster ejection", the "number of rods affected by boiling crisis" and assumed broken will be well over 1%, the maximum value for which "EPR equipment is classified", in radiological terms. So if more than 1% of rods are affected by boiling crisis, exposed equipment may fail...

In this type of accident, the control rod cluster ejection causes a breach, through which the primary coolant circuit at boiling crisis becomes depressurised in the containment. So the second containment barrier is broken. And even if the "power excursion" is stopped within a few seconds by the "Reactor Automatic Shutdown", the water in the primary coolant circuit at 155 bar will continue to be vaporised (300°C) into the containment (1 bar). This steam is extremely radioactive because of the "broken rods". Broken rods imply rupture of the first containment barrier, the fuel cladding, which is only 0.57mm thick.

The release of mechanical energy during the fuel-water interaction is not even mentioned, yet it may well cause some disruption in this overheated part of the reactor. For example, the deformation of the fuel assembly, which will prevent the safety clusters from dropping to stop the power excursion. Assuming the automatic shutdown is triggered...

An illusory third barrier

Public health would then only be protected by the third barrier, the containment, itself not entirely leak-proof. And some components, such as the containment isolation valves for example, are not safety classified for serious accidents. In addition, "access to reactor building during power operation" is assumed: "access to the reactor building during power operation (in the period seven days before shut-down and three days after restart) is an essential condition to ensure a unit shut-down period of 16 days" [12]. If this were the case, the third and last barrier would be really vulnerable!

The reactor does not shut down in case of accident

But, come to think about it, will the "Automatic Reactor Shutdown" (“Arrêt Automatique du Réacteur”, AAR) function during control rod cluster ejection? Report [6] addresses this question in Chapter 9, "EDG transient without AAR":

"We also highlight a problem linked with the EDG simulations, which are EDG events which are too small to trigger the AAR (...). These cases are not included in the Safety Report and their examination does not come under the current scope of the EPR analyses with AREVA (Contract C). There is no existing methodology to solve this specific problem".

"It seems presently that no measures have been put in place, and the design basis for EPR safety measures appears very narrow (...)".

This includes "EPR control rod clusters drop times too high, particularly in case of earthquake [1] (4.1.2) with a "cluster speed in EPR half that of the rest of other designs" [9] (6.1.6).

"In the specific case of EDG and its occurrences without AAR, evidence will be necessary to avoid any gaps in the safety assessment".

But note that the recommendation for the "careful preparation of the evidence showing the design basis for protection in an internal document not shared with the ASN" remains discreet. [6]

The "evidence" will have to be rock solid because, in relation to the "safety requirements" of the "control rod cluster mechanism", the following can be found in Chapter 3.6 of the "Preliminary Safety Report of the Flamanville 3 EPR": "the drop of each control rod cluster must be guaranteed in all accident situations". "In case of EDG", it may be that no control rod cluster drops! Or they may become stuck half-way down.

Accelerator jammed at full speed and brakes out of order: Chernanville 3...

As a matter of comparison, the EDG simulation for the N4 type shows that the cluster ejection lasts 0.1 second and the power excursion peaks 0.2 seconds later. The drop is initiated only 0.6 s after a "high neutron flux - high threshold" has been detected.

Conclusion

The Areva EPR is a reactor which can be economically viable only with glaring safety shortcuts. It does not meet the standards of the Safety Report on control rod cluster ejection (EDG) in case of serious accident (AAR); the equipment is not classified for accidents involving more than 1% of broken fuel rods. Yet the core catcher is meant to collect 100% of the core melt...

Despite a lack of transparency in the major modifications to the control mechanism, EDF will be taking enormous risks to try and recoup its investment at any cost. Without “RIP”, EPR could run at a loss. With “RIP”, EPR could cost us our lives. “RIP” = “Rest in Peace” ?

References

[1] Présentation synthétique de l'EPR - EDF, avril 2004

[2] EPR FA3 - Synthèse des voies de sortie de la problématique éjection de grappe - EDF, May 2007

[3] http://www.asn.fr/index.php/S-informer/Publications/La-revue-Controle/Do...
Controle-2005/Le-reacteur-EPR

[4] Actu énergie - 09/11/2009, EDF internal information

[5] RTE - Statistiques de l’énergie électrique en France - 2008

[6] Bilan de la phase préliminaire de l’étude d’EDG FA3 et perspectives - EDF, April 2009

[7] [7] http://www.sfen.org/fr/societe/accidents/tchernobyl/1.htm

[8] Marges disponibles pour les activités d’exploitation du REP par rapport aux risques de criticité - EDF, December 1999

[9] EPR FA3 - Synthèse de l’étude de faisabilité de l’accident d’éjection de grappe - EDF, February 2007

[10] For further information on "Alcade", see Décision n° 2007-DC-0066 de l’Autorité de sûreté nucléaire du 19 juillet 2007 relative à la mise en œuvre de la gestion du combustible dite « ALCADE » dans les réacteurs des centrales nucléaires de Chooz B et Civaux.

[11] EPR - Gestion combustible - Lot 1 - Revue de conception du schéma de grappes FA3 du 25/10/2007 -EDF, November 2007

[12] Note de présentation de la deuxième revue de projet radioprotection EPR - EDF, March 2004