Level 3 PSA - EDF Hinkley Point

HPC-NNBOSL-U0-000-RES-000028 Version 1.0 

Level 3 PSA 

NOT PROTECTIVELY MARKED 

NNB GENERATION COMPANY LTD 

HINKLEY POINT C PRE CONSTRUCTION SAFETY REPORT 

SUB CHAPTER 15.5 

LEVEL 3 PSA 

PART OF CHAPTER 15, PROBABILISTIC 

SAFETY ASSESSMENT 

Version 1.0 

Date of Issue 31/07/2012 

Document No. 

Next Review Date 

Produced by 

(Company/Organisation) 

HPC-NNBOSL-U0-000-RES-000028 

NNB 

© 2012 Published in the United Kingdom by NNB Generation Company Limited (NNB GenCo), 90 Whitfield Street - London, W1T 

4EZ. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, including 

photocopying and recording, without the written permission of the copyright holder NNB GenCo, application for which should be 

addressed to the publisher. Such written permission must also be obtained before any part of this publication is stored in a retrieval 

system of any nature. Requests for copies of this document should be referred to Head of Management Arrangements, NNB 

Generation Company Limited (NNB GenCo), 90 Whitfield Street - London, W1T 4EZ. The electronic copy is the current issue and 

printing renders this document uncontrolled. Controlled copy-holders will continue to receive updates as usual. 

UNCONTROLLED WHEN PRINTED 


Page 1 of 60




{ PI removed } 

Text within this document that is enclosed within curly brackets “{…}” is AREVA or EDF 

Commercially Confidential Information (CCI) or Personal Information (PI) and has been removed. 



Page 2 of 60




TABLE OF CONTENTS 

1 INTRODUCTION ................................................................................................................. 5 

2 BACKGROUND................................................................................................................... 5 

3 ASSESSMENT OF INDIVIDUAL RISK ............................................................................... 7 

3.1 Identification of Initiating Events for Assessment .......................................................... 8 

3.2 Release Category Allocation ............................................................................................. 9 

3.3 Assessment of Level 1 PSA Non Core Damage Sequences ........................................ 11 

3.3.1 Methodology .................................................................................................................... 11 

3.4 Assessment of Level 2 PSA Core Damage Sequences ................................................ 13 

3.5 Assessment of Additional Non-core Damage Sequences ........................................... 13 

3.6 Combination of Results ................................................................................................... 14 

3.7 Calculation of Individual Risk of Fatality ....................................................................... 15 

4 ASSESSMENT OF SOCIETAL RISK ............................................................................... 16 

4.1 Input Data .......................................................................................................................... 17 

4.1.1 Source Terms ................................................................................................................... 17 

4.1.2 Meteorological Data ......................................................................................................... 17 

4.1.3 Countermeasures ............................................................................................................ 18 

4.1.4 Population and Agricultural Data ................................................................................... 18 

4.2 Methodology ..................................................................................................................... 18 

4.3 Assessment of Frequency of 100 Fatalities................................................................... 19 

4.3.1 Early Deaths ..................................................................................................................... 19 

5 WORKER RISK ................................................................................................................. 19 

5.1 Identification of Faults ..................................................................................................... 20 

5.2 Release Category Allocation ........................................................................................... 21 

5.3 Results of Worker Risk Assessment against SDO-5 .................................................... 22 

5.4 Calculation of Results for SDO-4 Comparison .............................................................. 23 

5.5 Worker Cohorts ................................................................................................................ 24 

5.6 Results of Worker Risk Assessment against SDO-4 .................................................... 25 

5.6.1 Risk of Fatality to Generic Worker from All Accidents ................................................ 25 

5.6.2 Risk Assessment for Other Worker Cohort Groups ..................................................... 26 

5.6.3 Worker Cohorts - Risk Excluding LOSAs ...................................................................... 27 

5.6.4 Worker Cohorts - Risk Including LOSAs ....................................................................... 27 

5.6.5 Worker Cohorts – Risk Summary ................................................................................... 28 

5.6.6 Effect of Having Two EPR Units on Site ........................................................................ 28 

6 REFERENCES AND ABBREVIATIONS ........................................................................... 30 

6.1 References ........................................................................................................................ 30 

ABBREVIATIONS ........................................................................................................................ 32 



Page 3 of 60




7 FIGURES ........................................................................................................................... 56 

LIST OF TABLES 

Table 1 – Overall Risk to Generic Worker from All Accidents ...................................................... 25 

Table 2 – Risk Contribution by Dose Band ................................................................................... 25 

Table 3 – Risk Contribution by Accident Group ............................................................................ 26 

Table 4 – Accidents Considered for the Fuel Building Worker Cohort ......................................... 27 

Table 5 – Risk Results for Worker Cohort Groups – Excluding LOSAs ....................................... 27 

Table 6 – Risk Results for Worker Cohort Groups – Including LOSAs ........................................ 27 

Table 7 – Effect Of Having Two EPR Units on Generic Worker Risk ........................................... 29 

Table 8: Initiating Events Considered in the Design Basis Analysis of Chapter 14 ...................... 34 

Table 9: Initiating Events Considered in the Level 1 PSA ............................................................ 36 

Table 10: Sequences Added After Expert Review, including RRC-A, and Low Consequence 

Events .......................................................................................................................................... 37 

Table 11: Assessment of Additional Initiating Events not included in Level 1 PSA ...................... 39 

Table 12: 

{ CCI removed } 

...................................................................................................................... 41 

Table 13: End States Definition for PSA Level 1 Success Sequences ........................................ 43 

Table 14: Non Core Damage End States from Level 1 PSA - Frequencies/Dose Bands ............ 44 

Table 15: Core Damage Accidents (Release Categories) covered in Level 2 PSA ..................... 45 

Table 16: Results from Assessment of Additional Sequences not Modelled in the Level 1 PSA 46 

Table 17: Results for Assessment of Individual Risk Frequency .................................................. 47 

Table 18: Results for Assessment of Societal Risk ...................................................................... 48 

Table 19: Faults Identified in the PCC List (not included in PSA) ................................................ 49 

Table 20: Faults Identified in the Expert Review List (not included in PSA) ................................. 50 

Table 21: Faults Identified in the Additional Review ..................................................................... 51 

Table 22: LOSAs .......................................................................................................................... 51 

Table 23: Worker Risk Categories ................................................................................................ 53 

Table 24: Overall Accident Frequency vs. Dose Results – SDO-5 Comparison .......................... 55 

LIST OF FIGURES 

Figure 1: Methodology for Assessment of Individual Risk ............................................................ 56 

Figure 2: Comparison of the Individual Risk Assessment Results to SDO-7 ............................... 57 

Figure 3: Methodology for Assessment of Societal Risk .............................................................. 58 

Figure 4: Worker Risk Methodology Diagram ............................................................................... 59 

Figure 5: Frequency-Dose ‘Staircase’ – SDO-5 Comparison ....................................................... 60 



Page 4 of 60




1 INTRODUCTION 

A Level 3 Probabilistic Safety Assessment (Level 3 PSA), of the UK EPR design has 

been performed to determine the risk to workers and the public due to postulated 

accidents. This sub-chapter summarises the process followed to perform this 

assessment and presents the results in terms of: 

Individual risk to any person off the site, i.e. frequency / consequence (dose band) 

couplets and the total annual risk of fatality. 

 

Societal risk, in terms of the annual frequency of events which could potentially lead 

to more than 100 immediate or eventual fatalities in the wider population. 

Risk to workers on site, i.e. frequency / consequence (dose band) couplets and the 

total annual risk of fatality. 

The results are then compared against the Safety Design Objectives (SDOs) set out in 

the Nuclear Design Assessment Principles (NSDAPs) [Ref. 1]. 

The assumptions identified within this sub-chapter are identified by the label AS-yyy, 

where yyy is the number of the assumption within this sub-chapter. All assumptions are 

then collated within the Assumptions Report [Ref. 2] where the format will be AS-PSA- 

15.5-yyy. 

2 BACKGROUND 

The Level 1 PSA analyses a number of Initiating Events (IEs) together with total and 

partial failure of associated protection or mitigation measures. The Level 1 PSA failure 

states consider events that lead to core damage. Other, less onerous, endpoints are 

modelled in the event trees but are combined into a general ‘success’ state, as they do 

not result in a designated failure state (i.e. a state beyond the design basis). 

The Level 2 PSA takes the failure states, analyses the containment response to such 

sequences and assigns a release category (RC) to each Containment Event Tree (CET) 

endpoint, which represents the characteristics of the activity released to the off-site 

environment. 

The Level 3 PSA estimates the likely impact of radiologically significant faults. Potentially 

there are many possible endpoints to a Level 3 PSA covering a wide range of health and 

socio-economic impacts. At this stage three endpoints are considered: 

 

 

 

Individual risk 

Societal risk 

Worker risk 

The approach followed and the results obtained for each of these assessments is 

described below. 

The assessment uses the results from existing PSA analyses of the EPR design for 

Hinkley Point C, presented elsewhere in the HPC PCSR2, as is described in detail 

below. 

It should be noted that the three parts of the Level 3 PSA have all been completed at 

different times. The individual risk is taken directly from March 2011 Generic Design 

Assessment (GDA) PCSR Sub-chapter 15.5 [Ref. 3], but updated to include HPC 



Page 5 of 60




specific frequency data and other site specific updates. Between the March 2011 GDA 

PCSR Sub-chapter 15.5 [Ref. 3] and the issue of this sub-chapter an update to the Level 

1 PSA model occurred. The Individual Risk calculations were updated to take the PSA 

model update into account. 

The methodology for the Societal Risk was developed before the PSA model update but 

the assessment referenced within this sub-chapter was completed after the update. 

The Worker Risk is comprised of three reports. The first describes the methodology, the 

second calculates the Release Categories for the assessment and the third details the 

actual assessment. The first two reports were completed before the model update along 

with an initial assessment, and the final assessment presented within this sub-chapter 

was undertaken after the PSA model update was complete. 

The differing timings of the assessments for the three parts of the Level 3 PSA impact on 

their presentation within this sub-chapter. Because of this the three aspects of the Level 

3 PSA are presented separately – including the tables for the inputs to each part. 

At the moment the Level 1 and Level 2 PSA only considers a single unit site. However 

certain aspects of the Level 3 PSA require the fact that HPC is intended to be a twin unit 

site to be taken into account. This is discussed in more detail in the Strategy to Assess 

the Impact of Twin Reactor Site on the PSA [Ref. 4] and its impact on each aspect on 

the Level 3 PSA is discussed within the relevant sections of this sub-chapter. 



Page 6 of 60




3 ASSESSMENT OF INDIVIDUAL RISK 

The radiological consequence which is considered in this assessment of Individual Risk 

is the unmitigated effective dose to a child at 500 m downwind from the point of release 

during the first 7 days following the release using weather condition DF2. 

The methodology used in the March 2011 GDA PCSR Sub-chapter 15.5 [Ref. 3] for 

calculation of Individual Risk has not been updated for the site specific PCSR. 

The justification for adopting the simple approach used in the GDA is given in 

Sub-chapter 2.2 [Ref. 5], where it is shown that the GDA methodology is bounding of a 

site specific method. Sub-chapter 2.2 shows that the GDA methodology for Societal Risk 

is bounding of the HPC site, and the same methodology was used within the GDA for 

both Societal Risk and Individual Risk. 

Comparison nuclide concentration calculations were made to show that the deterministic 

weather condition “DF2” used in the GDA calculations used for calculation of Individual 

Risk is bounding at Hinkley Point C based on historical meteorological data. The 

advanced dispersion model UK-ADMS was run using 5 years of sequential metrological 

data from HPC to investigate three accident release scenarios (short, medium and long 

release) and a statistical analysis was carried out to compare the results obtained using 

UK-ADMS against those obtained using “DF2”. The study showed that the calculations 

using DF2 consistently resulted in higher air and ground deposition concentrations close 

to the source of release (distances less than 1.5 Km) and covered 98% of the results at 

distances up to 10 Km. [Ref. 6] 

Therefore, since this assessment considers a child downwind at a distance of 500m, a 

partially deterministic approach is used for individual risk rather than a fully probabilistic 

approach. The release frequencies used in the Individual Risk analysis below are the 

site specific frequencies for Hinkley Point C however the consequences are obtained 

from the conservative deterministic assessment. 

The assessment of the individual risk to any person off-site takes input from four 

sources: the Level 1 PSA, the Level 2 PSA and the Design Basis Assessment (DBA) 

together with the additional initiating events identified by expert review in section 3.1 of 

this sub-chapter. 

The objective of the Level 1 PSA is to identify those sequences that result in a 

designated failure state and hence, by definition, fall outside the design basis, i.e. those 

that lead to core damage. The other sequences are classified as success states within 

the Level 1 PSA, or may not have been included in the PSA from the outset as they 

could not lead to core damage or are non reactor faults. Therefore, the success states 

within the Level 1 PSA may not contain sufficient detail to provide all the information 

required for the present Level 3 risk assessment. Additional Non Core Damage (NCD) 

sequences resulting from the Level 1 PSA are assessed within section 3.3 of this 

sub-chapter. 

The DBA (Chapter 14) does consider Low Consequence (LC) faults in considerable 

detail, and covers some of the initiating events excluded from the PSA as they cannot 

lead to core damage. Thus the majority of the additional plant analysis and plant data 

required for this Level 3 risk assessment is available from, or bounded by, the DBA. 



Page 7 of 60




The Level 2 PSA considers sequences that lead to core damage. As the containment 

function is considered as part of the Level 2 PSA, the results contain sufficient detail to 

allow this Level 3 risk assessment to be performed. 

The methodology for the individual risk assessment is summarised in Figure 1. 

The Safety Design Objectives (SDOs), as set out in the Nuclear Safety Design 

Assessment principles (NSDAPs) [Ref. 1], for individual risk are as follows. 

SDO-6: The risk of fatality of any person off-site (public) due to exposure to 

radiation from on-site accidents will be below 1x10 -6 per year and/or demonstrated 

as ALARP. 

Effective Dose (mSv) 

Total Predicted Frequency (per year) 

BSO 

BSL 

0.1 – 1.0 1 x 10-2 y-1 1 

1.0 – 10 1 x 10-3 y-1 1 x 10-1 y-1 

10 – 100 1 x 10-4 y-1 1 x 10-2 y-1 

100-1000 1 x 10-5 y-1 1 x 10-3 y-1 

>1000 1 x 10-6 y-1 1 x 10-4 y-1 

.SDO-7: The design of an NNB GenCo NPP will ensure that the total frequency of 

accidents in each of the different dose categories (dose bands) in the above table 

is below the BSL. However, the design objective will be to achieve an accident 

frequency in each dose category (dose band) that is below the BSO. 

3.1 Identification of Initiating Events for Assessment 

The list of initiating events has been drawn from three sources: 

Those considered in the Design Basis Analysis (see Chapter 14). These events are 

listed in Table 8. 

 

Initiating events modelled in the Level 1 PSA (see Sub-chapter 15.1 [Ref. 7]). These 

events are listed in Table 9. 

An expert review [Ref. 8] of the design and operating practices to identify additional 

initiating events whose consequences would be within the design basis. These 

events are listed in Table 10. 

The main purpose of the expert review was to identify those initiating events not already 

modelled in the Level 1 PSA which have the potential to result in off-site radiological 

consequences within the dose band range considered for the assessment of individual 

risk. These include reactor based faults and non-reactor faults. The panel of experts 

have knowledge of both the EPR design and safety assessment, with experience of 

safety cases for facilities licensed in the UK. 

The result of the expert review process is a combined list of initiating events not included 

in the Level 1 PSA. These are listed in Table 11. Note that not all the events listed in 

Tables 8 and 10 appear in Table 11. This is because some of the design basis events 

(Table 8) are considered in the Level 1 PSA, and some of the ‘additional’ events 

identified in the expert review had also been identified in the Level 1 PSA. (The expert 



Page 8 of 60




review panel deliberately chose not to look at the Level 1 PSA list, in order to take a 

more open-ended view). 

It should also be noted that, as explained in Sub-chapter 15.0 [Ref. 9], only some of the 

initiating events in the ‘hazards’ category have been considered at this stage, as follows: 

 

 

 

 

 

 

 

Internal flooding. 

Internal fire. 

External hazards leading to Loss of Ultimate Heat Sink. 

External hazards leading to Loss of Off-site Power. 

Accidental aircraft crash. 

Turbine Disintegration. 

Combined Snow and Wind 

3.2 Release Category Allocation 

Release Categories (RC) are defined in the EDF document [Ref. 10] for the probabilistic 

assessment of individual risk. Knowledge of the associated source terms allows each of 

these RCs to be assigned to an off-site dose band. 

Note: 

The dose band (DB) classification for radiological exposure is as follows: 

 

 

 

 

 

DB1 : 0.1-1 mSv 

DB2 : 1-10 mSv 

DB3 : 10-100 mSv 

DB4 : 100-1000 mSv 

DB5 : > 1000 mSv 

The radiological consequence which is considered is the unmitigated effective dose to a 

child at 500 m downwind from the point of release during the first 7 days following the 

release, with standard weather condition “DF2” (see Chapters 12, 14 and 16 on parts 

concerning radiological consequences). 

The process is performed as follows: 

 

Identification of representative radiological release types, in terms of the systems and 

locations from which the release occurs. 

Identification of the key characteristics of each of the representative radiological 

release types. 

Analysis of available results from the Level 1 and Level 2 PSA and DBA in order to 

evaluate the above parameters. 

Assignment of Release Categories, and hence dose bands, for each representative 

radiological release type. 



Page 9 of 60




Five representative radiological release types have been identified, corresponding to 

specific accidents: 

 

 

 

 

 

Steam generator release. 

Loss of Coolant Accident (LOCA) inside the reactor building. 

LOCA outside the reactor building. 

Tank or waste treatment system breaks. 

Fuel building accidents. 

For each main release type a number of variants, defined by the parameters shown as 

follows, were considered: 

Release from a Steam Generator (SG Release Categories) 

The main parameters that define variants are as follows: 

Primary coolant activity (value corresponding to either fuel clad failures or no fuel 

clad failure). 

Leakage between primary and secondary side (either due to operational leakage or 

to Steam Generator Tube Rupture (SGTR)). 

 

Type of release from the SG (either steam or liquid). 

Transient at time of fault (either normal operation or combined with an aggravating 

transient). 

Release following LOCA inside the Reactor Building (RB Release Categories) 


Activity released into the containment (initial primary coolant activity with value 

corresponding to either fuel clad failures or no fuel clad failures, with or without 

subsequent core damage). 

 

 

Mode of containment leakage (either intact or not). 

Ventilation / filtration of containment leakage (either operating as expected or not). 

Release Following LOCA Outside Reactor Building (CR Release Categories) 


 

 

 

 

Activity of the leakage (value corresponding to either fuel clad failures or no fuel clad 

failure). 

Type of leakage (either liquid or steam). 

Amount of leakage (leakage isolated or not). 

Ventilation / filtration of building (either operating as expected or not). 

Tank or Waste Treatment System Break (T Release Categories) 


 

 

Type and amount of release (release as either liquid or gas, total or partial). 


Fuel Building Accidents (FB Release Categories) 



Page 10 of 60





 

 

 

Activity of the spent fuel pool (issued from either primary coolant activity value before 

shutdown or value corresponding to fuel rod failure of one fuel assembly, including 

radioactive decay). 

Pool temperature (either maximum Technical Specification value or boiling). 


The Release Categories that correspond to these release types and variants and their 

associated dose band allocations are shown in Table 12. 

3.3 Assessment of Level 1 PSA Non Core Damage Sequences 

The aim is to assess the frequency and consequences of off-site releases resulting from 

non core damage (success) sequences of the Level 1 PSA. All initiating events 

considered in the Level 1 PSA that can result in off-site releases are analysed. The 

analysis is performed for all the reactor states that are considered in the Level 1 PSA 

(state A to state E). 

3.3.1 Methodology 

This analysis is performed in two stages: 

End state allocation: Level 1 PSA success sequences are evaluated from the 

standpoint of potential releases. Each success sequence is allocated a consequence 

end state that characterises the state of the plant with respect to the amount of 

radioactivity released and the potential pathways for that release. 

Source term and dose band identification: non core damage event trees are 

developed to produce the dose / frequency couplets resulting from the success 

sequences analysed in the first stage. These event trees model the mitigation and 

containment of the radioactive releases from the primary system. A simple source 

term model [Ref. 10] is used to allocate dose bands to the different types of releases. 

3.3.1.1 Level 1 PSA End State Allocation 

The success sequences are split into the following families: 

Transient sequences. All sequences where the integrity of the RCP [RCS] pressure 

boundary is maintained. The only potential activity release route is through the 

normal operational route from the primary side to the secondary side. 

 

 

LOCA sequences. Primary side activity is released into the Reactor Building. 

ISLOCA (Interfacing System LOCA) sequences. Primary side activity is released into 

the safeguard building or the nuclear auxiliary building. 

SGTR sequences. Primary side activity is directly released into the secondary side, 

and potentially to atmosphere through the affected steam generator. 

End states are defined within each family to differentiate sequences on the basis of the 

amount of fuel cladding failure. The amount of fuel cladding failure has a direct influence 

on the radioactive inventory of the primary system. The amounts considered are no 

cladding failure and 10% cladding failure for transients with the addition of 1% cladding 

failure for LOCAs. For SGTR sequences, another criterion used to differentiate between 

sequences is whether the affected steam generator is isolated or not. For ISLOCA 

sequences the distinction is made based on the timing of the break isolation. The list of 



Page 11 of 60




end states used in this analysis is presented in Table 13. The information is taken from 

the March 2011 GDA PCSR Sub-chapter 15.5 [Ref. 3] and the HPC PCSR2 PSA 

Update [Ref. 11], the PSA update included a refinement of the Level 1 PSA Success 

Sequence Definitions given in the March 2011 GDA PCSR. 

In general, the end state allocation is based upon the deterministic safety requirements 

of the Flamanville 3 (FA3) PSAR. In particular, the upper limit of 10% cladding failure 

corresponds to the maximum amount of clad failure expected for non-core damage 

events in the FA3 PSAR. 

By applying the above process, the following end states are allocated: 

 

 

 

 

Transients: 

o T is applied for transients where no cladding failure is expected 

o TF is applied for transients where 10% cladding failure is expected 

LOCAs: 

o L is applied in case of LOCA inside containment without cladding failure 

o L-FB is applied in case of primary leak due to Feed and Bleed operation 

without cladding failure 

o LF is applied in case of LOCA inside containment with 10% cladding failure 

o LF-FB is applied in case of primary leak due to Feed and Bleed operation with 

10% cladding failure 

o LF1 is applied in case of LOCA inside containment with 1% cladding failure 

ISLOCAs: 

o V1 is applied if automatic isolation is successful (i.e. if there is a limited release 

of coolant). 

o U1 is applied in case of Uncontrolled Level Drop with automatic Chemical and 

Volume Control System (RCV [CVCS]) isolation 

o V2 is applied if the break is isolated manually (i.e. there is potentially a large 

release of coolant). 

o U2 is applied in case of Uncontrolled Level Drop with manual RCV [CVCS] 

isolation 

Success sequences for ISLOCAs are considered only for shutdown reactor states 

and when there is no core uncovery, therefore no cladding failure is expected. 

SGTRs: 

o PI is applied where the affected SG is isolated 

o PN is applied where the affected SG is not isolated 

No cladding failure is expected for success sequences. 

3.3.1.2 Source Term and Dose Band Identification 

For each of the end states defined above and shown in Table 13, the potential fission 

product pathway is modelled using non core damage event trees. The following barriers 

to a release are modelled in these event trees: 

 

Containment isolation 



Page 12 of 60




 

 

Annulus ventilation 

Auxiliary Building ventilation 

The event trees define sequences based on the availability or unavailability of each 

barrier. The system models developed in the Level 2 PSA are used to represent the 

barriers. 

When necessary, different event trees are designed for each reactor state to reflect the 

status of the RCP [RCS] and of the containment during different reactor states. 

Based on the success or failure of these barriers, each non core damage event tree 

sequence is assigned to an RC, as shown in Table 12. 

The radiological consequences of each RC are based on the DBA radiological study 

(March 2011 GDA PCSR Sub-chapter 14.6 [Ref. 12]). The RCs thus provide the basis 

for linking non core damage event tree sequences with the appropriate off-site dose 

band. Table 12 shows the correspondence between RCs and dose bands. 

Cases that were not analysed in the DBA radiological study are shown in italic in 

Table 12. For these cases, the dose band was extrapolated based on comparable cases 

within the analysis. 

3.3.1.3 Summary of Results 

The frequency contribution from each end state to each dose band in the individual risk 

assessment, and the fraction of the total Level 1 PSA contribution from each end state 

for that dose band is shown in Table 14. 

The table gives the frequency (per reactor year) that each end state contributes to each 

dose band together with the total frequency in each dose band. Also, for the main 

contributing end states, the percentage contribution of each end state to that total is 

shown. 

3.4 Assessment of Level 2 PSA Core Damage Sequences 

In the Level 2 PSA (Sub-chapter 15.4), individual fault sequences leading to core 

damage are grouped into a smaller number of fault classes with similar characteristics. 

These are termed Core Damage End States (CDES). The containment responses to 

these CDES are then quantified using the appropriate Containment Event Tree (CET). 

The resulting output of the Level 2 PSA is a further reduced number of accident classes, 

termed Release Categories, similar in principle to those defined for non core damage 

sequences as described in section 3.2, together with a predicted frequency and 

associated source term for each RC. 

The existing information on the off-site consequences of core damage sequences is 

used to determine the dose band allocation for core damage Release Categories, as 

summarised in Table 12. 

The frequencies of the core damage Release Categories and their associated dose 

bands are shown in Table 15. 

3.5 Assessment of Additional Non-core Damage Sequences 

Table 11 lists the non core damage initiating events not considered in the Level 1 PSA. 

To assess the risk contribution from the resulting sequences, the following steps have 

been followed for each of the events identified: 



Page 13 of 60




Screen out initiating events which are assessed as low frequency (less than 

1E-06/ry) and hence are unlikely to affect the outcome of the assessment 

significantly. 

Group the remaining initiating events into broad consequence bins based on the 

available design basis analysis. In a process comparable to that used for the Level 1 

PSA success sequences, each consequence bin characterises the potential for 

off-site impact. 

Screen out initiating events which result in a deterministic off-site effective dose of 

less than 0.1 mSv, as this magnitude of release is sufficiently low to be discounted 

from this assessment. This may be done directly for DBA initiating events where 

detailed plant analysis is available. For those initiating events not considered in the 

DBA, the screening process is on the basis of similarity to DBA events and / or the 

Low Consequence Release Categories of Table 12. 

Allocate the remaining initiating events to off-site dose bands according to the 

release categories of Table 12. At this stage some consideration of the off-site 

consequences and conditional probabilities of partial failure of barriers to release is 

made. 

Two sequences remain after the frequency and consequence screening steps: fuel 

handling accident in the spent fuel pool and fuel assembly drop occurring in the reactor 

building. 

These sequences have been assessed individually, so they can be assigned to an 

appropriate dose band. This initial assessment uses the analysis results presented in 

Section 3.3 of this sub-chapter. Hence, particularly in the lowest dose bands, the 

assigned off-site consequences are likely to be upper bound estimates. 

Two further potential accidents in the spent fuel pool, loss of cooling and pool drainage, 

have been included in the analysis using results available in Sub-chapter 15.3 [Ref. 13]. 

It should be noted that this latter sub-chapter does not cover fuel handling accidents. 

The frequency contribution to potential radioactive release from accidental aircraft crash 

has also been assessed and is shown in Table 16 [Ref. 14], the consequences of an 

accidental aircraft crash have also been assessed and has been assigned 

conservatively to dose band DB2 [AS-016]. 

In addition, as part of the site specific assessment for Hinkley Point C (HPC), the risk 

due to turbine disintegration from both HPC and Hinkley Point B (HPB) has been 

assessed for each safety-related building. For all targets other than the contaminated 

tool storage building, the impact frequency is of the order of magnitude of 10 -7 per year 

and so can be screened out at this stage [Ref. 15]. The dose due to impact on the tool 

storage building has been assumed to be DB1 [AS-017]. 

The results, in terms of the summated frequency contribution to the dose bands resulting 

from these additional sequences, are shown in Table 16. 

3.6 Combination of Results 

The results from the three strands of the assessment (the Level 1 PSA, the Level 2 PSA 

and the additional non core damage sequences as described in sections 3.3 to 3.5 of 

this sub-chapter respectively) are presented in Table 17. In addition to the contributions 

from each strand, the total for each dose band is presented. 



Page 14 of 60




Figure 2 presents these results on a graph. The BSL and BSO value of the NSDAPs 

SDO-7 are also shown. 

It can be seen that the summated frequency of faults predicted to result in an off-site 

effective dose in excess of 0.1 mSv is 1.44E-03/ry (DB1 to DB5). Around 99% of this 

frequency is associated with very low off-site consequences in the lowest dose 

band, < 1mSv, and for this dose band the frequency is nearly one order of magnitude 

below the BSO. Only 4.24E-07/ry (0.03%) of this frequency is associated with off-site 

consequences above 100 mSv (DB4 and DB5). 

It appears that the frequency associated with the lowest consequence dose band (DB1) 

is significantly higher than that associated with the higher consequence dose bands 

(DB2 to DB5). As discussed in section 3.5 of this sub-chapter, this is an artefact of using 

some conservative results of the consequence assessment performed for the DBA. If a 

less conservative, best estimate, consequence assessment were applied it is likely that 

the consequences of some of the dominant sequences would be shown to be below 

dose band 1. Screening out of these sequences as low consequence would significantly 

reduce the frequency allocated to the lowest dose band. 

In dose band DB1 (0.1 to 1 mSv), the dominant events are non core damage 

sequences (85%), mainly due to SGTR (affected SG isolated), a fuel handling accident 

in the fuel building with 1 fuel assembly partially damaged (all fuel rods along one edge) 

and filtration available and fuel assembly drop in the reactor building (15%). 

In dose band DB2 (1 to 10 mSv), the dominant events are fuel handling accident in the 

fuel building with 100% clad failure and filtration available (79%) and non core damage 

sequences, mainly due to SGTR (affected SG not isolated) (20%). 

In dose band DB3 (10 to 100 mSv), the dominant events are a fuel handling accident in 

the fuel building with 100% clad failure and filtration not available (37%), core damage 

accidents with containment intact (annulus and building ventilation operational) (33%) 

and non core damage LOCA inside containment with 10% clad failure, containment 

intact but failure of the ventilation systems (25%). 

In dose band DB4 (100 to 1000 mSv), the dominant events are core damage accidents 

with containment intact (failure of annulus and building ventilation) (~100%). The 

contribution from non core damage LOCA inside containment with 1% clad failure and 

containment bypass events is negligible (~0%). 

In dose band DB5 (> 1000 mSv), the dominant events are core damage accidents with 

containment failure (98%) and fuel damage after loss of cooling or rapid drainage of the 

spent fuel pool (2%). The contribution from non core damage LOCA inside containment 

with 10% clad failure and containment bypass events is small (1%). 

It is emphasised that the identification of the dominant events, as well as any analysis of 

risk balance, must be considered with care as modelling assumptions, especially where 

varying degrees of conservatism are introduced, lead to distortions in the risk breakdown 

and profile. 

3.7 Calculation of Individual Risk of Fatality 

The risk of death to the most exposed individual can be estimated using the frequencies 

and dose band information discussed above, by making an assumption that an effective 

dose of 1 mSv will result in an increase in the risk of individual death due to effects of 

radiation of 5x10 -5 [Ref. 16]. For dose band 5 however, it is assumed that the radiation 

dose is so large that there would be a unit probability of individual death. 



Page 15 of 60




The annualised probability of death of the most exposed individual due to accidents is 

then given by: 

where 

 

F Min[1.0, 

510 

i 

5 

D ] 

i 

F i 

D i 

= the frequency of an individual receiving an effective dose in dose band i 

= magnitude of the dose in mSv 

and the summation is taken over the five dose bands. To give a conservative result D i is 

taken as the effective dose at the upper limit of the dose band except for dose band 5 

where a unit probability of individual death is assumed 1 . 

Applying the above equation, with the data in Table 17, results in a risk of individual 

death of 2.8x10 -7 /ry, which is considered pessimistic. 

If the risk from a single unit is doubled [AS-001] to take into account HPC is intended to 

be a twin unit site then this risk becomes 5.6x10 -7 per year. 

Both the risk from an individual unit site and the risk from a twin reactor site meet the 

target set by Safety Design Objective SDO-6. 

4 ASSESSMENT OF SOCIETAL RISK 

One of the goals of the EPR design philosophy is to reduce the frequency of releasing 

substantial amounts of radioactivity into the off-site environment, compared to the 

current generation of PWRs. Consideration of the frequency of accidents leading to such 

large releases is an appropriate way to assess societal risk. SDO-8, set out in the 

NSDAPs [Ref. 1], sets a target of 1.0E-07 per year for the frequency of exceeding 100 

immediate or eventual fatalities in members of the public. 

SDO-8: The total predicted frequency of on-site accidents resulting in more than 

100 fatalities (either immediate or delayed) of members of the public will be below 

1x10-7 per year and/or demonstrated as ALARP 

The Level 3 PSA identifies those accident sequences with the potential to result in 

environmental source terms sufficient to cause 100 or more fatalities in the wider 

population, both immediate and eventual, taking appropriate responses into account. 

The likelihood of early radiation induced fatalities is very low. The majority of the off-site 

fatalities are ‘statistical deaths’ arising from integrating low doses over very large 

populations over a significant period of time. 

These calculations are performed with a probabilistic accident consequence assessment 

system called PC COSYMA. This model has been updated for use in the UK by the 

Health Protection Agency (HPA). The software calculates the dispersion and deposition 

of radioactive material for a given source term using a segmented Gaussian Plume 

dispersion model. It produces a probability distribution of results based upon a sample of 

historical meteorological conditions. The detailed methodology is set out in [Ref. 17] and 

the PC COSYMA calculations and analysis are set out in [Ref. 18]. 

1 It should be noted that this is slightly different from the approach taken in the Worker Risk Assessment 

presented in section 5 where the mid-point of the dose band is used in the calculation to obtain a less 

conservative result. 



Page 16 of 60




4.1 Input Data 

4.1.1 Source Terms 

There are two stages of source term input data used to assess Societal Risk. The first 

stage is the extraction of data from the Level 2 PSA, and then the second stage is to 

convert that data into meaningful and representative input data for PC COSYMA. 

The Level 2 PSA [Ref. 19] identified a number of Release Categories, 25 of which have 

been analysed in this work – Dose Band 3 releases are assumed to result in zero 

probability of 100 deaths. 

Two additional NCD (Non Core Damage) accidents identified in the level 1 PSA have 

also been analysed, details given in [Ref. 17 and Ref. 18]. The NCD accidents are 

LOCAs (Loss of Coolant Accidents) with clad failure and containment bypass and 

release duration of 100 hours. Each NCD accident is assigned to a Release Category 

for analysis within the Level 3 PSA. The Release Category containing the NCD accident 

with 10% clad failure is assigned to Dose Band 5 and the Release Category containing 

the NCD accident with 1% failure is assigned to Dose Band 4. 

The data used for the PC COSYMA calculation is split into 11 groups of isotopes, these 

11 groups are derived using the Level 2 PSA Modular Accident Analysis 

Program (MAAP) Release Fractions, which are split into 13 groups of isotopes. The 

conversion is described in Appendix B6 of the Societal Risk Assessment [Ref. 18]. The 

Iodine Release Fractions required for PC COSYMA are also derived from the Level 2 

PSA MAAP Release Fractions, with the conversion also described in Appendix B6 of the 

Societal Risk Assessment. 

A constant energy and uniform rate of release are assumed over the duration of the 

release. A maximum of six phases are used to model the total duration, with each phase 

lasting one hour. The phases are not necessarily consecutive and are evenly spaced 

over the duration of the release. Details about the releases for each RC considered can 

be found in the Societal Risk Assessment [Ref. 18] and Methodology [Ref. 17] 

At this time some site specific buildings are not yet fully considered within the PSA. 

Most of these buildings are intended to contain limited amounts of potentially radioactive 

material. The only buildings not currently considered within the PSA that are likely to 

cause an increase in risk to the probability of 100 fatalities are the Interim Spent Fuel 

Store (ISFS) and the Intermediate Level Waste Store (ILWS). Future actions to close 

this gap are identified on the Forward Work Plan [Ref. 20]. 

4.1.2 Meteorological Data 

Two years worth of hourly historical meteorological data supplied by the Met Office has 

been used [AS-002]. The model uses wind speed, wind direction, rainfall, atmospheric 

stability category and the depth of the mixing layer. A cyclic sampling scheme is used to 

sample the meteorological data to generate 141 sequences for each source term 

calculation. 

The wind direction can change with each phase of release. Each phase of material 

continues to travel in a constant direction once released, but the different phases can be 

dispersed in different directions depending on the wind direction at the start of each 

phase. 



Page 17 of 60




4.1.3 Countermeasures 

Assumptions regarding the countermeasures that are likely to take place in the event of 

an accident have been based on the existing arrangements in place for Hinkley Point B 

[AS-003] where possible within the limitations of PC COSYMA, details are contained 

within the Societal Risk Methodology [Ref. 17]. This includes automatic sheltering 

followed by evacuation and ingestion of iodine tablets within the Detailed Emergency 

Planning Zone (DEPZ). The DEPZ has been set to 3.5km as it is for HPB. Beyond this, 

there is dose based evacuation up to 5km and dose based sheltering and intake of 

iodine tablets up to 15km. The lower limits of the Emergency Reference Levels (ERLs) 

have been used to set the intervention dose limits for dose based countermeasures [Ref. 

17]. 

European legal dose limits are used to model any food restrictions that would result from 

a severe accident. 

4.1.4 Population and Agricultural Data 

The population and agricultural gridded data files were provided together with PC 

COSYMA from HPA. The files present the data in 72 sectors and 25 distance bands up 

to 1250 km. The population data is from the 2001 Census and the agricultural data was 

updated in 2003 [AS-004]. PC COSYMA uses the agricultural data to calculate ingestion 

doses. 

4.2 Methodology 

For each source term, PC COSYMA cycles over historical weather conditions to 

calculate the dispersion and deposition patterns of the radioactive material specified in 

the source term. 

The dose is then calculated by assessing the following pathways; 

1) Cloudshine - External gamma radiation from material in the passing cloud. 

2) Groundshine - External gamma radiation from material deposited on the ground. 

3) Inhalation - The internal dose from inhalation of material in the cloud. 

4) Resuspension - Internal irradiation from inhalation of material following 

resuspension of the ground deposit. 

5) Contamination - Beta irradiation from material deposited on skin and clothing. 

6) Ingestion - Internal irradiation from ingestion of contaminated foodstuffs. 

Both short term and long term doses are calculated. The dose profile in the population 

depends mainly on the meteorological conditions. As the model cycles over the sample 

of meteorological conditions a distribution of results is produced. The short term dose is 

calculated with an integration time of 7 days and does not include ingestion dose, as it is 

assumed that food bans would be in place immediately after the accident if necessary. 

Long term doses are calculated with a 50 year integration time. Dose-risk relationships 

are then used to calculate the health effects. For early health effects, a rapid increase in 

risk of morbidity and mortality is assumed as the dose increases above a certain 

threshold, below which there is assumed to be no risk. A linear dose-risk relationship is 

used for late health effects, with the relationship between the natural cancer rate and the 

accident cancer rate varying depending on cancer type. 



Page 18 of 60




Health effects following an accident are generally split into two groups, “early effects” 

which occur within a few months of the accident, and “late effects” which occur over 

longer periods. Both the early and the late effects can be further split into those which 

are fatal and those which are not. 

The short term and long term health effects are all calculated separately and presented 

in separate distributions. These distributions are conditional on the fact that the release 

has occurred. 

In order to get the annual frequency of 100 deaths, the probability calculated by PC 

COSYMA must be multiplied by the frequency of occurrence, which is an output of the 

Level 1 and Level 2 PSA [Ref. 11]. The frequencies are presented in Table 18. Non-core 

damage release frequencies are also shown in Table 18, including spent fuel pond 

accident releases. 

The frequencies of the releases for a single unit are multiplied by two to get the 

frequencies of the releases for a site with two reactors [AS-005], this approach is 

justified within the [Ref. 7]. 

The probability of more than 100 deaths for each release category is multiplied by the 

appropriate frequency of occurrence in Table 18. The summation of all these 

frequencies results in the total site frequency for 100 deaths. 

4.3 Assessment of Frequency of 100 Fatalities 

The probability of 100 long term deaths for each release is shown in Section 15.5.3 – 

Table 14 together with the frequency of occurrence and the final site frequency of 100 

deaths. For one unit, the total frequency of accidental releases that could lead to more 

than 100 deaths is 7.2E-8/ry. For the whole site at Hinkley Point C, with 2 units, this 

frequency is 1.44E-7 per year. This is above the numerical target set in SDO-8, and as 

such is in the ALARP range. To meet SDO-8 it is then required to demonstrate that the 

value is ALARP. This is discussed within [Ref. 21], reported within Sub-chapter 15.7 

[Ref. 22] and is shown on the Forward Work Plan [Ref. 20]. 

Table 18 shows the breakdown of the frequency of at least 100 deaths per Release 

Category. It shows that 8 of the Release Categories contribute more than 90% of the 

risk. RC 504 contributes almost 30% to the total although the probability of 100 deaths is 

very low. This is due to the RC 504 having the highest frequency of occurrence of all the 

dose band 5 releases. 

4.3.1 Early Deaths 

The Societal Risk Assessment [Ref. 18] presents the break down of the consequences 

into many categories, including early deaths. At present the conditional probability of 

100 deaths is calculated using the long term effects only. Very few of the releases result 

in any early deaths. Those that could result in significant numbers of early deaths are 

RC SFP, RC 702 and RC 802 which have a conditional probability of 100 long term 

deaths of 1 (or 0.99 in of the case of 802). Therefore the impact not including the early 

deaths directly in this calculation is negligible. 

5 WORKER RISK 

The risk to workers onsite has been assessed separately to the risk to members of the 

public offsite. Worker risk is assessed by use of two NSDAP SDOs, one for the 

individual risk of fatality, SDO-4, and the other for the annual frequency of any single 



Page 19 of 60




accident that could give rise to a worker dose, SDO-5. The worker risk methodology is 

described in [Ref. 23], dose calculations performed in [Ref. 24] and the results are 

presented in [Ref. 25]. It should be noted that the methodology presented here relates 

only to risk arising from the radiological consequences of accidents. Therefore the risk to 

workers arising from annual radiation dose uptake during normal operations is not 

addressed in this document. This section also does not address the risk from accidents 

that give rise to purely conventional hazards. 

Accidents in the ILWSF, the ISFS and the Contaminated Tool Store (CTS) are not yet 

considered, they shall be addressed at a later stage when more detailed information is 

available for these facilities. The inclusion of accidents from these buildings into the 

Worker Risk Assessment is an item on the Forward Work Plan [Ref. 20]. 

The below Safety Design Objectives, taken from the NSDAPs [Ref. 1], show the targets 

for the results evaluated within the Worker Risk Assessment to be compared against. 

SDO-4; The risk of an individual worker fatality due to exposure to radiation from 

on-site accidents shall be below 1x10-6 per year and/or demonstrated as ALARP. 

SDO-5; The targets for the predicted frequency of any single accident in the 

facility, which could give doses to a person on the site, are: 

Effective Dose (mSv) 

Annual Accident Frequency 

BSO 

BSL 

2 – 20 1 x 10-3 y-1 1 x 10-1 y-1 

20 – 200 1 x 10-4 y-1 1 x 10-2 y-1 

200 – 2000 1 x 10-5 y-1 1 x 10-3 y-1 

>2000 1 x 10-6 y-1 1 x 10-4 y-1 

A diagrammatic representation of the methodology for the Worker Risk Assessment is 

presented in Figure 4. 

5.1 Identification of Faults 

The first stage of the assessment is to identify all the accidents that could result in a 

dose that is greater than 0.1mSv. Accidents resulting in a dose below this limit are 

considered to be part of normal operation. 

The accident list has been collated from the following sources [Ref. 23]; 

1) The Level 1 PSA accident list including both internal hazards and external hazards 

where these were assessed in the PSA. It was necessary to review all sequences 

from the Level 1 PSA, including non core damage ’success’ sequences that could 

still result in a dose to workers. Sub-chapter 15.1 [Ref. 7] presents the Level 1 

PSA for HPC. 

2) The Level 2 PSA Release Categories - Table 15. 

3) Design Basis Plant Condition Category (PCC) accidents which were not included 

in the PSA. (These are the non core damage faults that could still cause 

radiological consequences) - Table 19. 



Page 20 of 60




4) Accidents which were added following the expert review. This review was carried 

out with a focus on off-site consequences, see Table 10, so the conclusions have 

been re-examined with on-site consequences in mind. It is important that faults 

which do not cause off site consequences but could cause on site consequences 

are included at this stage - Table 20. 

5) Additional accidents which are included to ensure the completeness of the fault 

identification. These are faults not identified in any of the previous sources and are 

faults which will only affect workers - Table 21. 

6) Worker actions in response to fault conditions which have the potential to lead to 

dose uptake exceeding that of normal operations – referred to as Local Operator 

Safety Actions (LOSAs). Only actions claimed as part of the fault sequence are 

included. These do not include recovery or clean up actions. LOSAs are shown in - 

Table 22. 

Further details can be found in the Worker Risk Methodology [Ref. 23] 

The LOSAs are identified within the PSA model or in the design basis PCC and RRC-A 

analysis. Any LOSAs which take place in a location not affected by the accident or with 

a dose rate of less than 0.025 mSv h -1 are screened out. The frequencies of the LOSAs 

claimed within the Level 1 PSA are taken directly from the PSA model. For the LOSAs 

claimed for PCC accidents, the frequency of demand for the LOSA has been estimated 

as the mid-point frequency of the PCC class of the accident against which the LOSA is 

claimed. 

5.2 Release Category Allocation 

Once the faults have been identified, the Worker Release Categories (WRCs) are 

defined [Ref. 24]. These are defined on the basis of the release source term, the area 

ventilation, the worker location and exposure time. For some faults, more than one 

location must be considered as a significant release can be obtained both in the building 

where the accident takes place and also on site outside of the building. Therefore a fault 

can be allocated to more than one release category due to the different locations. All 

Release Categories must be taken into account when calculating the total individual risk. 

When comparing the accident frequency with the dose band limits, only the WRC with 

the highest dose is used for each accident. 

The WRCs can then be allocated to the appropriate Worker Dose Band (WDB) by 

calculating the dose received through the various exposure pathways. Three pathways 

are considered; Inhalation of airborne activity, direct radiation dose due to exposure to 

sources of gamma radiation and direct radiation dose due to the airborne release of 

gamma emitting nuclides. Other pathways are considered to have a negligible 

contribution. [AS-006] 

An assumption [AS-007] must also be made for the duration of the exposure. Depending 

on how quickly the worker would evacuate, the exposure time has been taken to be 

either 10 minutes or 60 minutes. If it is thought that the worker would be immediately 

aware of the accident then 10 minutes is used but 60 minutes is used if the worker would 

only evacuate following alarms or instructions from the control room. The dose acquired 

during LOSAs is also required and is calculated taking task duration and radiological 

consequences into account. 

It is assumed that the doses to a worker on-site but outside of a building are bounded by 

those calculated in Sub-chapter 14.6 [Ref. 12] for short term off-site doses [AS-008]. 

The dose bands are defined differently for on-site and off-site consequences, but it can 



Page 21 of 60




be shown that there is a rough equivalence between the two if the mid-value of the 

upper dose for the off-site DB is taken as representative of the actual dose. Therefore 

the only calculations that are required are those for a worker in the building, either in the 

room of the release or the adjacent room. The dose received could be higher for a 

worker in the adjacent room due the release entering the room through the HVAC 

system and a longer exposure time due to the worker not being aware of the accident so 

quickly. The higher dose is used for the building WRC. 

The WRCs have been divided into six groups, corresponding to faults in different 

buildings. 

1) WRCs in the Reactor Building. 

2) WRCs in the Safety Auxiliary Building. 

3) WRCs in the Fuel Building. 

4) WRCs in the Nuclear Auxiliary Building. 

5) WRCs in the Waste Treatment Building. 

6) WRCs in the Turbine Hall. 

In addition to the WRCs derived from the fault list put together from the sources listed 

above, the Release Categories identified in the Level 2 PSA core damage assessment 

must also be considered. The same dose band that was allocated for the off-site risk is 

allocated for the worker risk assessment, due to the severity of the core damage 

accidents the majority of them are in WDB5. 

Once the WRC has been allocated to a WDB, a direct comparison with the dose band 

accident frequencies can take place. Only the highest dose for each fault needs to be 

considered. If more than one WRC was assigned due to multiple potential locations of 

the worker, only the WRC with the highest dose needs to be considered in the 

comparison with the dose band frequency limits. The WRCs are presented in Table 23. 

5.3 Results of Worker Risk Assessment against SDO-5 

Once dose bands and frequencies have been obtained for each release it is possible to 

assess the results against the requirements of SDO-5. 

The results of the comparison against SDO-5 are shown in Figure 5 and Table 24. 

No accidents are above the BSL in the unacceptable region, with the annual frequency 

of most accidents being at least two orders of magnitude below the BSL which marks the 

boundary between the Tolerable if ALARP region and the unacceptable region. 

There are three accidents which are between the BSO and BSL and fall within the 

tolerable if ALARP region. All of these accidents are from the Hinkley Point Level 1 PSA 

and relate to LOCA accidents with the most exposed worker in the RB containment 

(WRB3, WRB4 and WRB5). However, no account has been taken of the probability that 

a worker is present when the accident occurs when comparing against SDO-5 - while 

this is not strictly a requirement of the assessment against SDO-5 it is worth taking into 

account when determining if the frequency of the accident should be considered ALARP. 

The low occupancy factor for the Reactor Building of 2 % [Ref. 26] would put these 

accidents within the Broadly Acceptable region, if it were to be factored in to the accident 

frequency. So while the frequency of the accident that has the possibility of causing a 

dose to workers is higher than the BSO the probability of a worker being present at the 

time of the accident is very low. 



Page 22 of 60




There are a further three accidents which are at the BSO on the boundary between the 

Broadly Acceptable and the Tolerable if ALARP regions. The fuel handling accidents 

(PCC4-03a and PCC4-03b) result in WDB3 and WDB4 consequences respectively and 

a leak from the gaseous waste processing system (PCC3-01) resulting in a WDB2 

consequence. For these accidents a brief ALARP discussion is presented within The 

Worker Risk Assessment [Ref. 25] 

All other PSA Level 1, PCC, expert review (EXRV) accidents and LOSAs are below the 

BSO and therefore fall within the broadly acceptable region. For these accidents no 

further discussion is considered to be necessary, assuming that the risk is already 

minimised through the safety measures that are already in place. 

The higher consequence (WDB4 and WDB5) portion of the frequency-dose ‘staircase’ is 

dominated by accidents related to LOCAs assessed in the Level 1 PSA. 

The severe (core damage) accidents shown as three representative accidents in the 

WDB3, WDB4 and WDB5 regions, have sufficiently low accident frequencies to remain 

below the BSO and within the broadly acceptable region. The frequency of any severe 

core damage accident will therefore be acceptable against the SDO-5 criteria with 

respect to consequence to workers. 

5.4 Calculation of Results for SDO-4 Comparison 

In order to calculate the annual risk of death for a worker, the risks for all the faults at all 

the potential locations are summed. In addition, occupancy factors must be taken into 

account to reflect the amount of time spent in the various locations over the year. Each 

WRC has an associated location and occupancy factor. 

Currently, UK EPR specific occupancy factors are used [Ref. 11], however they were 

directly derived from the Sizewell B (SZB) Occupancy Factors, taking into account the 

design intent of the UK EPR [AS-009]. In order to represent the severity of risk to any 

worker on site core damage accidents are allocated an occupancy factor of one [AS- 

010]. 

Each fault is also assigned an annual frequency. If the fault was originally identified in 

the PSA then the frequency is also obtained from the PSA model. For PCC faults not in 

the PSA then the mid-point frequency is used for the PCC group [AS-011]. All other 

frequencies are specifically evaluated for these calculations. 

The annualised probability of death of the most exposed individual due to accidents is 

the sum of the risk from all fault sequences and is given by: 

i[ Fi 

 

k[( 

WDBk 

) 

i 

 

( OFk 

) 

i 

( CFk 

) 

i 

]] 

where 

F i 

= the frequency of Worker Release Category i 

(WDB k ) i = the dose corresponding to the allocated worker dose band for location k and 

fault i. The dose used is half the upper dose limit for the corresponding dose 

band 

OF k 

τ 

= the occupancy factor for location k 

= Fraction of time the worker spends on site 



Page 23 of 60




CF 

= the dose risk conversion factor which is 5x10-2 Sv-1 for all dose bands other 

than dose band 5 where a probability of death is assumed to be 1; i.e. for 

DB5 (WDB x CF) = 1. 

The list of Worker Release Categories together with the Dose Band allocation is shown 

in Table 23. 

Not all WRCs identified in Table 23 are used in the risk analysis because although they 

represent credible accident scenarios, they currently do not have any accident 

sequences associated with them. 

5.5 Worker Cohorts 

To gain a better understanding of the distribution of risk, three worker profiles or ‘cohorts’ 

have been defined as follows: 

 

A generic worker - for the overall comparison against SDO-4, a generic worker profile 

has been used. This profile assumes that there is a hypothetical individual worker 

who could be present in any building on site when an accident occurs. The risk to 

this worker from accidents in each building is therefore calculated taking into account 

the probability (i.e. occupancy factor) that the worker would be in this building when 

the accident takes place. 

A Fuel Building worker – this worker profile represents a worker who spends all of 

their time when on site carrying out fuel building operations [AS-012]. This group 

therefore has a maximum risk of exposure to accidents in the fuel building, in 

particular fuel handling accidents, and a negligible exposure to accidents occurring in 

other buildings. This cohort represents the bounding case for all workers involved in 

controlled processes such as lifting operations, where the occupancy factor is taken 

as unity, whilst still representing a realistic worker group. 

A Main Control Room (MCR) worker – this worker profile represents a worker who 

has to remain present in the MCR throughout the duration of an accident anywhere 

on site [AS-013]. This worker group therefore has the maximum risk of exposure to 

the consequences in the MCR of all accidents which result in an external (on-site) 

release, including severe accidents. 

In addition, although not technically a separate worker cohort, the risk arising from the 

performance of LOSAs has been evaluated separately. This risk represents the risk to 

any individual worker if any accident requiring a LOSA occurs whilst they are on site and 

they are required to perform the LOSA. The results of the worker Risk Analysis for all 

worker cohorts, with and without the contribution from LOSAs, are presented in Sections 

5.6.3 and 5.6.4. 



Page 24 of 60




5.6 Results of Worker Risk Assessment against SDO-4 

5.6.1 Risk of Fatality to Generic Worker from All Accidents 

The overall annual risk of fatality due to exposure to radiation from on-site accidents is 

as shown in Table 1 below. This total annual risk figure is arrived at by the summation of 

the risk from all accidents as shown in Table 2. 

SDO-4 Criteria Annual Risk Target Calculated Annual Risk % of SDO-4 

BSO 

Annual risk of fatality to any 

worker on site 




Accident group Risk (y -1 ) % of total risk 

Level 1 PSA (non-core damage)* 1.5E-07 40.4 

PCC (not in Level 1 PSA)* 1.0E-07 28.6 

EXRV2 2.2E-08 6.1 

ADRV 0.0E+00 0.0 

Level 2 PSA (core damage) 4.5E-08 12.4 

LOSAs 4.6E-08 12.6 

Total 3.6E-07 100.0 

Table 3 – Risk Contribution by Accident Group 

The additional accidents identified from the Expert Review of the GDA PSA (EXRV 

group) can also be seen not to make a significant contribution to the risk, indicating that 

the accident sequences identified for the PSA and PCC analysis were reasonably 

comprehensive in relation to risk to workers as well as off-site risk. 

5.6.2 Risk Assessment for Other Worker Cohort Groups 

As previously discussed two other worker cohorts have been defined in addition to the 

generic worker. These are the Fuel Building and Main Control Room (MCR) worker 

cohorts. Considering the hierarchy of dominant accidents and their relative Occupancy 

Factor for a generic worker these two other cohorts are the most relevant to check that 

the most at risk individual on site has been assessed. The overall risk for these groups 

has been assessed separately and can be compared against the assessed risk for the 

generic worker cohort. 

5.6.2.1 Main Control Room (MCR) Worker Cohort 

This worker cohort represents workers in the MCR. This worker cohort is assumed to 

spend all of their time whilst on-site in the MCR and not to spend any time in other plant 

areas [AS-013]. As this group of workers is assumed to have to remain in the MCR in 

the event of an accident, they are assumed to have a maximum likelihood of being 

exposed to the on-site consequences of accidents anywhere on site, including severe 

accidents. Therefore, the risk to this group of workers is comprised of the risk from the 

Level 2 PSA core damage accidents and the off-site consequences [AS-008] of the 

Level 1 PSA, PCC and expert review accidents. In all cases the occupancy factor for 

exposure of MCR workers to these accidents is assumed to be unity. 

For MCR workers only the overall risk figure for comparison against SDO-4 is presented 

in Section 5.6.3 and Section 5.6.4, both with and without the contribution from LOSAs. 

5.6.2.2 Fuel Building Worker Cohort 

This worker cohort represents a specific group of workers who work exclusively in the 

fuel building whilst on-site and who do not spend any of their time in any other areas 

[AS-012]. As such, this group will have the maximum likelihood of exposure to accidents 

involving fuel handling and accidents involving the spent fuel pool. This cohort will 

therefore have an occupancy factor of unity for all fuel building accidents and an 

occupancy factor of zero for all other accidents. A list of the accidents for which the Fuel 

Building worker cohort is assumed to be affected is given in Table 4 below. 

2 Including both local and on-site risk 



Page 26 of 60




Accident 

PCC3-02 

PCC4-03a 

PCC4-03b 

Description 

Draining of the spent fuel pool 

Fuel assembly handling accident with damage to 1 row of fuel rods 

Fuel assembly handling accident with damage to all fuel rods 

EXRV-05 

Heavy object dropped into the spent fuel pool 

Table 4 – Accidents Considered for the Fuel Building Worker Cohort 

Unlike the other worker cohorts, this group is assumed not to be affected by the on-site 

consequences of accidents in other areas, except for the Level 2 PSA core damage 

accidents for which a worker anywhere on site is assumed to be affected due to the 

severity of these accidents. 

For Fuel Building workers only the overall risk figure for comparison against SDO-4 is 

presented in Section 5.6.3 and 5.6.4, both with and without the contribution from LOSAs. 

5.6.3 Worker Cohorts - Risk Excluding LOSAs 

In addition to the worker cohorts, the risk arising from LOSAs has also been assessed 

which can be added to the existing risk for any of the worker cohorts, depending upon 

which cohort would be expected to be required to perform the LOSAs. 

The overall risk results for the worker cohorts are shown in Table 5 below. 

Risk (y -1 ) 

% of SDO-4 BSO 

Generic worker 3.2E-07 32 

MCR worker 6.3E-08 6 

Fuel Building worker 2.8E-07 28 

Table 5 – Risk Results for Worker Cohort Groups – Excluding LOSAs 

These results indicate that taking the risk from the generic worker group gives an 

estimate of risk to an individual worker which is at around 30 % of the SDO-4 BSO. For 

the MCR workers the risk is assessed to be considerably lower – a factor of 5 less than 

for the generic worker at 6 % of the SDO-4 BSO. This lower risk is due to the fact that 

although MCR workers will have a high occupancy factor due to the requirement for 

them to remain on site during an accident, the dose that they receive from most 

accidents will be very low compared to workers local to the accident. The Fuel Building 

worker cohort is assessed as having a risk which is close to the generic worker, at 

around 30 % of the SDO-4 BSO. 

5.6.4 Worker Cohorts - Risk Including LOSAs 

The overall annual risk results for the worker cohorts, including the risk from LOSAs, are 

shown in Table 6 below: 

Risk (y -1 ) 

% of SDO-4 BSO 

Generic worker 3.6E-07 36 

MCR worker 1.1E-07 11 

Fuel Building worker 3.3E-07 33 

LOSA performance 4.6E-08 5 

Table 6 – Risk Results for Worker Cohort Groups – Including LOSAs 



Page 27 of 60




The overall annual risk arising from LOSAs represents an additional 5 % of the SDO-4 

BSO. 

5.6.5 Worker Cohorts – Risk Summary 

According to the current assumptions the most at risk individual worker on site is found 

to be the generic worker, with an annual risk that is 36 % of the target of 1 x 10 -6 y -1 set 

by SDO-4. The Fuel Building worker cohort is assessed as having a risk which is close 

to the generic worker, at around 33 % of the SDO-4 BSO. The MCR worker cohort risk is 

only 1/3 of the generic worker cohort risk when including LOSAs. 

5.6.6 Effect of Having Two EPR Units on Site 

It is possible to make a preliminary estimate of the effect on the overall risk to a generic 

worker of having two EPR units on a single site. This effect can be taken into account 

simplistically by making the following assumptions, and then re-calculating the overall 

risk for the generic worker cohort (In this discussion, the EPR unit at which the generic 

worker is employed is referred to as EPR Unit 1 and the adjacent EPR unit on the site is 

referred to as EPR Unit 2): 

A worker who is employed at EPR Unit 1 will be at risk from the local (in-building) 

consequences of accidents occurring at EPR unit 1 (i.e. the local consequences of 

Level 1 PSA, PCC and expert review accidents). The risk arising from LOSAs will 

also be unchanged, as in all cases the in-building consequences of accidents and 

performance of LOSAs occurring at EPR Unit 2 will have no effect on workers at 

EPR Unit 1 [AS-014] and that the occupancy factors used for the calculation shall not 

be impacted by a second unit on site [AS-009]. 

In the case of the on-site consequences of the Level 1 PSA accidents a worker at 

EPR Unit 1 would also be affected by an external (on-site) release from EPR Unit 2, 

so the contribution from this source of risk is effectively doubled. 

In the case of the PCC and EXRV accidents, a worker at EPR Unit 1 could be 

affected by the external release (i.e. on-site consequence) of accidents at EPR Unit 

2, but only when the worker is not in a specific building. Therefore, this contribution is 

effectively doubled [AS-015]. 

In the case of the severe (core damage) accidents assessed in the Level 2 PSA, a 

worker at EPR Unit 1 is assumed to be equally affected by accidents occurring at 

EPR Unit 2 due to the severity of these accidents and the magnitude of the release, 

so the risk contribution from these accidents is effectively doubled [AS-015].A 

summary of the risk contributions is shown in Table 7 below. 

These results indicate that in terms of risk to an individual worker, the effect of having 

two EPR units on the same site is minimal and would lead to a relatively small increase 

in risk of the order of 13%. This is due to the fact that the risk to workers is dominated by 

the risk arising from being exposed to the radiological release from accidents in the 

building where the worker is present. The only significant effect of having two EPR units 

on site in terms of worker risk is the effective doubling of the contribution from severe 

core damage accidents. 



Page 28 of 60




Risk contribution to a generic worker at EPR Unit 1 (y -1 ) 

Accident group 1 EPR unit only on site 2 EPR units on site 

1.4E-07 (local – Unit 1) 1.4E-07 (local – Unit 1) 

Level 1 PSA accidents 

3.3E-09 (on site – Unit 1) 3.3E-09 (on site – Unit 1) 

Sub-total (Level 1 PSA): 1.5E-07 1.5E-07 

3.3E-09 (on site – Unit 2) 


PCC (non-L1 PSA) accidents 


Sub-total (PCC): 1.0E-07 1.0E-07 



Expert review accidents 


Sub-total (Expert review): 2.2E-08 2.2E-08 


LOSAs 


0.0E+00 (local – Unit 2) 

Sub-total(LOSAs): 4.6E-08 4.6E-08 

L2 PSA core damage accidents 4.5E-08 (on site – Unit 1) 



Sub-total(L2 PSA): 4.5E-08 9.0E-08 

Total risk: 3.6E-07 4.1E-07 

Additional risk: 

4.9E-08 

% increase in total risk: 13 

Table 7 – Effect Of Having Two EPR Units on Generic Worker Risk 

This conclusion assumes that workers on one EPR unit would not be required to carry 

out LOSAs at the other EPR unit [AS-014]. If they were, the LOSAs risk contribution for 

the case with 2 EPR units on site would be doubled – taking the percentage increase in 

total risk from 13 % to 26 %, which is not insignificant but still represents a relatively 

small increase in total risk. Further work is required to analyse the impact upon the 

worker risk from a twin unit site when better knowledge of the maintenance and 

operating regimes intended for HPC exists. 



Page 29 of 60




6 REFERENCES AND ABBREVIATIONS 

6.1 References 

1. Nuclear Safety design Assessment Principles; NNB-OSL-STA-000003; Issue 1.0; 

February 2012; NNB GenCo 

2. HPC PCSR PSA Assumptions; ENFCFI120035; To be Issued 

3. GDA PCSR Level 3 PSA: Assessment of Off-Site Risk Due to Postulated Accidents; 

UKEPR-0002-155; Issue 4; March 2011; AREVA/EDF 

4. Strategy to Assess the Impact of Twin Reactor Site on the PSA ; 

HPC-NNBOSL-U0-000-RES-000073; Issue 0.5; June 2012; NNB GenCo. 

5. HPC PCSR2 Sub-chapter 2.2 Verification of Bounding Character of GDA Site 

Envelope; HPC-NNBOSL-U0-000-RES-000009; Issue 2.0; January 2012; NNB 

GenCo. 

6. Evaluation of dispersion using ADMS v.4 for accidental radiological consequences 

assessment; HPC-NNBOSL-U0-000-RET-000032; Issue 4; March 2010; AMEC 

7. HPC PCSR2 Sub-chapter 15.1 Level 1 PSA; HPC-NNBOSL-U0-000-RES-000033; 

Issue 1.0; CNEN 

8. S C Bubb, C Niculae. Screening of Initiating Events to Support the Dose Band 

Assessment for the Step 3 Submission; 14782/TR/0001; Issue 01; June 2008; 

AMEC report 

9. HPC PCSR2 Sub-chapter 15.0 Safety Requirements And PSA Objectives; 

HPC-NNBOSL-U0-000-RES-000027; Issue 2.0; March 2012; NNB GenCo 

10. Release categories for the LCHF / Level 3 PSA (supporting study for PCSR chapter 

15); ENTEAG080122; Revision A; June 2008; SEPTEN 

11. Site Specific PSA for the UK EPR at Hinkley Point, PEPS-F DC 108, Revision C, 

March 2012; AREVA 

12. GDA PCSR Sub-chapter 14.6 Radiological Consequences Of Design Basis 

Accidents; UKEPR-0002-146; Issue 5, March 2011; AREVA/EDF 

13. HPC PCSR2 Sub-chapter 15.3 PSA Of Accidents In The Spent Fuel Pool; 

HPC-NNBOSL-U0-000-RES-000034; Issue 1.0; SEPTEN 

14. Aircraft Impact Risk Frequencies Considered for LOOP, LUHS and PSA Level 3; 

ENFCFF110004: Revision B; SEPTEN 

15. Assessment of Turbine Missile Impact Frequencies on Hinkley Point C Building 

Structures.; 16281-709-HPC-RPT-001; Issue 1, 12/04/11; AMEC 

16. UK Health and Safety Executive (HSE). The Tolerability of Risk from Nuclear Power 

Stations; ISBN 0118863681; The Stationery Office Ltd; 1992. 

17. Methodology for UK societal risk level 3 PSA; ENFCFF090213; Revision C; 

October 2010; SEPTEN / NNB GenCo 

18. Calculation of UK Societal Risk for Level 3 PSA at Hinkley Point; 

HPC-NNBOSL-U0-000-RES-000051; Issue 1.0; 16 May 2012. 



Page 30 of 60




19. PCSR2 Sub Chapter 15.4 Level 2 PSA; HPC-NNBOSL-U0-000-RES-000035; 

Issue 2.0; SEPTEN; July 2012 

20. PSA PCSR Forward Work Plan. HPC-NNBOSL-U0-000-REP-000045; NNB GenCo 

21. Assessment of Societal Risk Results for HPC; HPC-NNBOSL-U0-000-RES-000074; 

Issue 1.0; March 2012; NNB GenCo 

22. HPC PCSR2 Sub-chapter 15.7 Discussion And Conclusions; 

HPC-NNBOSL-U0-000-RES-000036; Issue 1.0; NNB GenCo 

23. Methodology for Assessing Worker Risk for the UK EPR – Head Document.; 

ENFCFF100382; Issue B; September 2011; SEPTEN 

24. Methodology for Assessing Worker Risk for the UK EPR – Worker Release 

Categories; ENTEAG100429; Issue B; November 2011; SEPTEN 

25. Preliminary Worker Risk Assessment for the UK EPR; ENFCFI110114; Issue B; 

March 2012; SEPTEN 

26. Initial Assessment of Worker Occupancy for the UK EPR. 

HPC-NNBOSL-U0-000-REP-000042; Issue 1.0; December 2011; NNB GenCo 

27. Consistency between PSA list and PCC list, NEPR-F DC 584, Revision A; AREVA 

28. GDA PCSR Sub-chapter 14.4 Analyses Of The PCC-3 Events; UKEPR-0002-144; 

Issue 7; March 2011; AREVA/EDF 

29. GDA PCSR Sub-chapter 14.5 Analyses Of The PCC-4 Events; UKEPR-0002-145; 

Issue 7; March 2011; AREVA/EDF 

30. The Calculation of Operator Risk of Fatality from the Radiological Consequences of 

Faults at Sizewell B; ENTDE/10.03/64; Revision 001; Nov. 2003 

31. Human Reliability Analysis Notebook of the UK EPR Probabilistic Safety 

Assessment; NEPS-F DC 191; (Appendix A); Revision A; January 2010; AREVA 

32. EPR FA3 – Données d’entrées pour la réalisation des études d’accessibilité des 

actions locales requises au titre du chemin sur CIA pour la gestion d’un PCC généré 

par une agression, ECEF101935, Revision A ; 

33. Liste des actions locales à effectuer pou la gestion en CIA des PCC initiés par 

incendie, ou avec incendie pris en cumul indépendant, ECEF 10 1623, Revision A. 



Page 31 of 60




ABBREVIATIONS 

Term / Abbreviation 

AAD [SSS] 

ADRV 

ARE [MFWS] 

ALARP 

ATWS 

BSL 

BSO 

CCF 

CDES 

CET 

CF 

CTS 

DB 

DBA 

DEPZ 

ERL 

EXRV 

Definition 

Start-up and Shutdown Feed Water systems 

Additional Review Accidents 

Main Feed Water System 

As Low As Reasonably Practicable 

Anticipated Transient Without Scram 

Basic Safety Level 

Basic Safety Objective 

Common Cause Failure 

Core Damage End States 

Containment Event Tree 

Conversion Factor 

Contaminated Tool Store 

Dose Band 

Design Basis Assessment 

Detailed Emergency Planning Zone 

Emergency Reference Level 

Expert Review Accidents 

FA3 Flamanville 3 

FB 

GCT [MSB] 

GDA 

HPA 

HPB 

HPC 

HVAC 

IEs 

ISFS 

ISLOCA 

ILWS 

ILWSF 

LC 

LHSI 

Fuel Building 

Main Steam Bypass 

Generic Design Assessment 

Health Protection Agency 

Hinkley Point B 

Hinkley Point C 

Heating, Ventilation and Air Conditioning 

Initiating Events 

Interterm Spent Fuel Store Facility 

Interfacing System LOCA 

Intermediate Level Waste Store 

Intermediate Level Waste Store Facility 

Low Consequence 

Low Head Safety Injection 



Page 32 of 60




LOCA 

LOCC 

LOOP 

LOSA 

MAAP 

MCR 

MHSI 

NCD 

NPP 

NSDAP 

PCC 

PCSR 

PSA 

PSAR 

PTR [FPCS] 

PWR 

RB 

RBS [EBS] 

RC 

RCCA 

RCP [RCS] 

RCV [CVCS] 

RHR 

RIS/RRA [SIS/RHRS] 

SDO 

SFP 

SG 

SGTR 

SRU[UCWS] 

SZB 

VDA [MSRT] 

WDB 

WRC 

Loss of Coolant Accident 

Loss of Cooling Chain 

Loss Of Off-site Power 

Local Operator Safety Action 

Modular Accident Analysis Program 

Main Control Room 

Medium Head System Injection 

Non Core Damage 

Nuclear Power Plant 

Nuclear Safety Design Assessment Principle 

Plant Condition Category 

Pre-Construction Safety Report 

Probabilistic Safety Assessment 

Preliminary Safety Analysis Report 

Fuel Pool Cooling System 

Pressurised Water Reactor 

Reactor Building 

Extra Boration System 

Release Category 

Rod Control Cluster Assemblies 

Reactor Coolant System 

Chemical and Volume Control System 

Residual Heat Removal 

Safety Injection System / Residual Heat Removal System 

Safety Design Objective 

Spent Fuel Pond 

Steam Generator 

Steam Generator Tube Rupture 

Ultimate Cooling Water System 

Sizewell B 

Main Stream Relief Train 

Worker Dose Band 

Worker Release Category 



Page 33 of 60




Tables 

Table 8: Initiating Events Considered in the Design Basis Analysis of Chapter 14 

N° Initiating Event PCC 

1 Increase and reduction in RCP [RCS] temperature 1 

2 Step load changes 1 

3 Ramp load changes 1 

4 Load reduction, up to and including the design full load rejection 1 

5 Loss of the grid, with the auxiliary system available 1 

6 Loss of main feed water system (ARE [MFWS]) with the start-up and shutdown system 

(AAD [SSS]) available 

1 

7 Partial reactor trip 1 

8 Spurious reactor trip 2 

9 Main feed water (ARE [MFWS]) malfunction causing a reduction in feed water 

temperature 

2 

10 Main feed water (ARE [MFWS]) malfunction causing an increase in feed water flow 2 

11 Excessive increase in secondary steam flow 2 

12 Turbine trip 2 

13 Loss of condenser vacuum 2 

14 Loss of normal feed water flow (loss of all ARE [MFWS] pumps and the start-up and 

shutdown (AAD [SSS]) pump) 

2 

15 Partial loss of core coolant flow (loss of one reactor coolant pump) 2 

16 Uncontrolled rod cluster control assembly (RCCA) bank withdrawal 2 

17 RCCA Misalignment up to rod drop, without limitation function 2 

18 Start-up of an inactive reactor coolant loop at an improper temperature 2 

19 RCV [CVCS] malfunction that results in a decrease in boron concentration in the reactor 

coolant 

2 

20 RCV [CVCS] malfunction causing increase or decrease of the reactor coolant inventory 2 

21 Primary side pressure transients (spurious pressuriser spraying, spurious pressuriser 

heating) 

2 

22 Uncontrolled RCP [RCS] level drop 2 

23 Loss of one cooling train of the RIS/RRA [SIS/RHRS] in RHR mode 2 

24 Loss of one train of the fuel pool cooling system (PTR [FPCS]) 2 

25 Small steam or feed water system piping failure including break of connecting lines (not 

greater than DN 50) 

3 

26 Inadvertent opening of a pressuriser safety valve 3 

27 Inadvertent opening of a steam generator relief train (VDAa [MSRT]) or of a steam 

generator safety valve (MSSV) 

3 

28 Small break (not greater than DN 50), including a break occurring on the extra boration 

system (RBS [EBS]) injection line 

3 



Page 34 of 60




29 Steam generator tube rupture (SGTR) (1 tube) 3 

30 Inadvertent closure of one/all main steam isolation valves (VIV [MSIV]) 3 

31 Inadvertent loading of a fuel assembly in an improper position 3 

32 Forced decrease of reactor coolant flow (4 pumps) 3 

33 Leak in the gaseous waste processing systems 3 

34 Uncontrolled rod cluster control assembly (RCCA) bank withdrawal 3 

35 Uncontrolled single rod cluster control assembly withdrawal 3 

36 Loss of primary coolant outside the containment 3 

37 Long term loss of off-site power supplies (> 2 hours), fuel pool cooling aspect 3 

38 Loss of one train of the fuel pool cooling system (PTR [FPCS]) 3 

39 Isolatable piping failure on a system connected to the fuel pool 3 

40 Long term loss of off-site power in state C (> 2 hours) 4 

41 Feed water system piping break 4 

42 Inadvertent opening of SG relief train or safety valve 4 

43 Spectrum of RCCA ejection accidents 4 

44 Intermediate and Large Break LOCA (up to the surge line break in states A and B) 4 

45 Small break LOCA (not greater than DN 50), including a break in the RBS [EBS] injection 

line 

4 

46 Reactor coolant pump seizure (locked rotor) 4 

47 Primary coolant pump shaft break 4 

48 Steam generator tube rupture (2 tubes in 1 SG) 4 

49 Fuel handling accident (spent fuel pool) 4 

50 Boron dilution due to a non-isolatable rupture of a heat exchanger tube 4 

51 Isolatable safety injection system break ( DN 250), in residual heat removal mode 4 

52 Safety injection system break in residual heat removal mode - fuel pool drainage aspect 4 

53 Rupture of radioactivity containing systems 4 



Page 35 of 60




Table 9: Initiating Events Considered in the Level 1 PSA 

N° Initiating Event 

54 Loss of primary coolant accident (LOCA) 

55 Interfacing system LOCA (ISLOCA) 

Secondary system breaks: 

56 Breaks on secondary side (steam or feed water) 

57 Secondary break and SGTR 

58 Steam generator tubes rupture (SGTR) 

Secondary system transients: 

59 Total loss of main feed water 

60 Loss of the start-up and shutdown feed system 

61 Loss of condenser 

62 Spurious Turbine Trip 

Loss of off-site power (LOOP): 

63 Short loop < 2 hours – Plant states A and B 

64 Short loop < 2 hours – Plant states C and D 

65 Long LOOP < 24 hours – Plant states A and B 

66 Long LOOP < 24 hours – Plant states C and D 

67 Short consequential LOOP 

68 Long consequential LOOP 

Primary system transients: 

70 Homogeneous dilutions 

71 Total loss of RIS [SIS] cooling in RHR mode 

72 Uncontrolled drop of primary coolant level 

73 Spurious Reactor Trip 

Loss of cooling water systems: 

74 Partial or total loss of cooling system in power states 

75 Total loss of the cooling chain in shutdown 

76 Transients without automatic reactor shutdown (ATWS) 

77 Heterogeneous external dilutions 

124 Hazards (including accidental aircraft crash) 



Page 36 of 60




Table 10: Sequences Added After Expert Review, including RRC-A, and Low Consequence 

Events 

N° Initiating Events 

78 ATWS caused by rods failure - excessive increase of the steam flow rate on the secondary side 

(opening of the GCT [MSB]) 

79 ATWS caused by rods failure – loss of normal SG feed water supply 

80 ATWS caused by rods failure - loss of the main power grid 

81 ATWS caused by rods failure - failure of the RCV [CVCS] that leads to a decrease in the boron 

concentration of the primary coolant 

82 ATWS caused by rods failure – uncontrolled withdrawal of a group of control rods 

83 ATWS caused by failure of the protection system signal - excessive increase of the steam flow 

rate (opening of the GCT [MSB]) 

84 ATWS caused by failure of the protection system signal – loss of normal SG feed water supply 

85 ATWS caused by failure of the protection system signal – loss of main power grid 

86 ATWS caused by the failure of the protection signal - failure of the RCV [CVCS] that leads to a 

decrease of the boron concentration of the primary coolant 

87 ATWS caused by failure of the protection system – uncontrolled withdrawal of a group of control 

rods 

88 Total loss of off-site and onsite power supply (Station Blackout) 

89 Total loss of feed water supply to the steam generators 

90 Total loss of the cooling chain leading to leakage at the seals of the primary coolant pumps 

91 LOCA (breach of size smaller than 20 cm²) with failure of the Safety Injection signal 

92 LOCA (breach of size smaller than 20 cm²) without MHSI 

93 LOCA (breach of size smaller than 20 cm²) without LHSI 

94 Uncontrolled drop in the primary level without ISI signal of the protection system 

95 Homogeneous dilution not from the RCV [CVCS] with failure by the operator to isolate the dilution 

source 

96 Total loss of cooling chain in state D 

97 LOCA outside containment on RIS/RRA [SIS/RHRS] train and failure of the automatic isolation 

signal or the injection signal 

98 Total loss of the ultimate heat sink for 100 hours in states A and C 

99 Loss of the two main trains of the fuel pool cooling system (PTR [FPPS/FPCS]) during shutdowns 

for refuelling/ Station Blackout 

100 Common Cause Failure of LH switchboards [CCF-LH] 

101 Loss of RCV [CVCS] pumping 

102 Double ended primary guillotine break (LOCA - 2A) 

103 Multiple steam generator tube rupture (SGTR - 20A) 

104 Fuel assembly drop (into reactor building) 

105 Fuel assembly mishandling (into reactor building) 



Page 37 of 60




N° Initiating Events 

106 Fuelling machine fault leading to dropping of heavy items into the core leading to clad failure 

107 Fuel element stuck in the fuel transfer mechanism 

108 Heavy object dropped into fuel pool 

109 Faults associated with spent resin transfer 

110 Inadvertent discharge of liquid waste 

111 Inadvertent discharge of gaseous waste 

112 Dropping of solid waste package 

113 Dropping of activated filter 

114 Fire involving solid waste material 

115 Inadvertent operation of the auxiliary feed water system 

116 Inadvertent partial cooldown to below 80 bar 

118 RCCA Bank misalignment 

119 Decay of frequency of off-site power system 

120 Faults in sensors common to the control and protection system 

121 Loss of spent fuel pool cooling 

122 Rapid drainage of the spent fuel pool 

123 Boiling of the spent fuel pool 



Page 38 of 60




Table 11: Assessment of Additional Initiating Events not included in Level 1 PSA 

N° Initiating Events Ass t 

1 Increase and reduction in RCP [RCS] temperature LowC 

2 Step load changes, LowC 

3 Ramp load changes LowC 

4 Load reduction, up to and including the design full load rejection LowC 

5 Loss of the grid, with the auxiliary system available LowC 

7 Partial reactor trip LowC 

9 Main feed water (ARE [MWFS]) malfunction causing a reduction in feed water 

temperature 

LowC 

10 Feed water (ARE [MWFS]) malfunction causing an increase in feed water flow LowC 

11 Excessive increase in secondary steam flow LowC 

15 Partial loss of core coolant flow (loss of one Reactor Coolant Pump) LowC 

16 Uncontrolled rod cluster control assembly (RCCA) bank withdrawal LowC 

17 RCCA misalignment up to rod drop, without limitation function LowC 

18 Start-up of an inactive reactor coolant loop at an improper temperature LowC 

19 RCV [CVCS] malfunction that results in a decrease in boron concentration in the 

reactor coolant 

20 RCV [CVCS] malfunction causing increase or decrease of the reactor coolant 

inventory 

21 Primary side pressure transients (spurious pressuriser spraying, spurious 

pressuriser heating) 

LowC 

LowC 

LowC 

23 Loss of one cooling train of the RIS/RRA [SIS/RHRS] in RHR mode LowC 

24 Loss of one train of the fuel pool cooling system (PTR [FPCS]) LowC 

30 Inadvertent closure of one/all main steam isolation valves LowC 

31 Inadvertent loading of a fuel assembly in an improper position LowC 

32 Forced decrease of reactor coolant flow (4 pumps) LowC 

33 Leak in the gaseous waste processing systems LowC 

34 Uncontrolled rod cluster control assembly (RCCA) bank withdrawal LowC 

35 Uncontrolled single rod cluster control assembly withdrawal LowC 

38 Loss of one train of the fuel pool cooling system (PTR [FPCS]) LowC 

39 Isolatable piping failure on a system connected to the fuel pool LowC 

46 Reactor coolant pump seizure (locked rotor) LowC 

47 Primary coolant pump shaft break LowC 

49 Fuel handling accident (spent fuel pool) TBC 

53 Rupture of radioactivity containing tank/pipe in radwaste systems LowC 

100 Common Cause Failure of LH switchboards [CCF-LH] LowF 



Page 39 of 60




N° Initiating Events Ass t 

101 Loss of RCV [CVCS] pumping. LowF 

102 Double ended primary guillotine break (LOCA - 2A), LowF 

103 Multiple steam generator tube rupture (SGTR - 20A) LowF 

104 Fuel assembly drop (into reactor building) TBC 

105 Fuel assembly mishandling (in reactor building ) LowC 

106 Fuelling machine fault leading to dropping of heavy items into the core leading to 

clad failure 

LowF 

107 Fuel element stuck in the fuel transfer mechanism LowC 

108 Heavy object dropped into fuel pool LowF 

109 Faults associated with spent resin transfer LowC 

110 Inadvertent discharge of liquid waste LowC 

111 Inadvertent discharge of gaseous waste LowC 

112 Dropping of solid waste package LowC 

113 Dropping of activated filter LowC 

115 Inadvertent operation of the auxiliary feed water system LowC 

116 Inadvertent partial cooldown to below 80 bar LowC 

118 RCCA Bank misalignment LowC 

119 Decay of frequency of off-site power system LowC 

120 Faults in sensors common to the control and protection system LowF 

121 Loss of spent fuel pool cooling TBC 

122 Spent fuel pool drainage TBC 

123 Boiling of the spent fuel pool LowC 

Assessment: 

LowC: event screened out on Low Consequence 

LowF: event screened out on Low Frequency 

TBC: event to be considered in off-site consequence assessment 



Page 40 of 60




Table 12: 




Page 41 of 60







Page 42 of 60




Table 13: End States Definition for PSA Level 1 Success Sequences 

End State ID 

T 

TF 

L 

L-FB 

LF 

LF-FB 

LF1 

PI 

PN 

V1 

U1 

V2 

U2 

Description 

Transient sequence, with no cladding failure 

Transient sequence, with 10% cladding failure 

LOCA inside containment, with no cladding failure 

Primary Leak with Feed and Bleed, with no cladding failure 

LOCA inside containment, with 10% cladding failure 

Primary Leak with Feed and Bleed, with 10% cladding failure 

LOCA inside containment, with 1% cladding failure 

SGTR with no cladding failure, where the affected SG is isolated 

SGTR with no cladding failure, where the affected SG is not isolated 

Interfacing system LOCA isolated automatically with no cladding rupture 

Uncontrolled Level Drop, with automatic RCV [CVCS] isolation 

Interfacing LOCA isolated manually with no cladding rupture 

Uncontrolled Level Drop, with manual RCV [CVCS] isolation 

Note: The information for this table is taken from the March 2011 GDA PCSR Sub-chapter 15.5 and the 

PSA Update [Ref. 11], the PSA update included a refinement of the Level 1 PSA Success Sequence 

Definitions. 



Page 43 of 60




Table 14: Non Core Damage End States from Level 1 PSA - Frequencies/Dose Bands 

This table presents the frequency /ry each end state contributes to each dose band together with the total frequency in each dose band and the percentage contribution [Ref. 11]. 

LCHF End State Description 

End State 

ID 

DB0 

< 0.1 mSv 

DB1 

0.1 – 1mSv 

DB2 

1 – 10mSv 

DB3 

10 – 100mSv 

DB4 

100 – 1000mSv 

DB5 

> 1000mSv 

Total 

LOCA inside containment without cladding failure L 2.93E-03 

(0.16%) 

8.33E-06 

(0.68%) 

1.50E-07 

(5.44%) 

2.94E-03 

Feed and Bleed without cladding failure L-FB 1.15E-07 

(0.00%) 

8.99E-10 

(0.03%) 

1.16E-07 

LOCA inside containment with 10% cladding failure LF 1.98E-06 

(0.16%) 

3.40E-07 

(83.39%) 

2.91E-10 

(18.52%) 

2.32E-06 

Feed and Bleed with 10% cladding failure LF-FB 3.53E-06 

(0.29%) 

6.77E-08 

(16.61%) 

1.28E-09 

(81.48%) 

3.60E-06 

LOCA inside containment with 1% cladding failure LF1 1.73E-05 

(0.00%) 

6.12E-09 

(0.22%) 

6.44E-10 

(100%) 

1.73E-05 

SGTR without cladding failure, affected SG isolated PI 1.18E-03 

(96.78%) 

1.18E-03 

SGTR without cladding failure, affected SG not isolated PN 2.60E-06 

(94.32%) 

2.60E-06 

Transient sequence without cladding failure T 1.82E+00 

(99.28%) 

6.45E-07 

(0.05%) 

1.82E+00 

Transient sequence with 10% cladding failure TF 2.48E-05 

(2.03%) 

Small Interfacing LOCA V1 1.10E-04 

(0.01%) 

2.48E-05 

1.10E-04 

Large Interfacing LOCA V2 4.87E-08 

(0.00%) 

Uncontrolled Level Drop with automatic isolation U1 1.02E-02 

(0.56%) 

Uncontrolled Level Drop with manual isolation U2 8.50E-08 

(0.00%) 

1.78E-09 

(0.00%) 

1.19E-08 

(0.00%) 

5.05E-08 

1.02E-02 

9.69E-08 

e TOTALS 1.83E+00 1.22E-03 2.76E-06 4.08E-07 6.44E-10 1.57E-09 



Page 44 of 60




Table 15: Core Damage Accidents (Release Categories) covered in Level 2 PSA 

Doseband 

(mSv) 

RC No. Containment Failure Mode Frequency 

(/y) [Ref. 11] 

Total 

Frequency 

(/y) 

DB5 

> 1000 

RC 200 Isolation failure – in-vessel recovery 8.71E-10 1.80E-07 

(21.0%) 

RC 201 Isolation failure – in-vessel recovery 2.90E-10 

RC 202 Isolation failure 1.29E-12 




RC 206 All small isolation failures (< 2 inch) 4.44E-09 

RC 301 Early failure 7.53E-12 




RC 401 Intermediate failure 2.02E-11 




RC 501 Late failure 5.50E-13 




RC 602 Basemat failure 7.90E-10 

RC 701 SGTR (scrubbed) 1.02E-08 

RC 702 SGTR (unscrubbed) 5.14E-09 

RC 802 

Large ISLOCA unscrubbed, deposition in 

building 

3.84E-09 

DB4 

100 - 1000 

RC 101 

Containment intact 

Deposition in annulus and building 

2.39E-07 

2.39E-07 

(27.9%) 

DB3 

10 - 100 

RC 102 

Containment intact 

Annulus and building ventilation 

operational 

4.37E-07 

4.37E-07 

(51.1%) 

DB2 

1 - 10 

DB1 

0.1 - 1 

n/a - - 

n/a - - 

TOTAL 

8.57E-07 



Page 45 of 60




Table 16: Results from Assessment of Additional Sequences not Modelled in the 


Dose Band 

(mSv) 

Frequency (/ry) 

IE no. Description Frequency Total 

Frequency 

DB5 

> 1000 

DB4 

100 - 1000 

See 15.3 Spent fuel pool drainage 2.30E-09 

See 15.3 

n/a 

Loss of spent fuel pool 

cooling 

5.31E-10 

2.83E-09 

DB3 

10 - 100 

49 Fuel handling accident 

(spent fuel pool) 100% 

clad failure, no filtration 

5.00E-07 (1) 

5.00E-07 

DB2 

1 - 10 


(spent fuel pool) 100% 

clad failure, filtration ok 

See 15.2 

Accidental transport 

aircraft crash 

1.00E-05 (1) 

4.15E-07 (2) 

1.04E-05 

DB1 

0.1 - 1 


(spent fuel pool) 6% clad 

failure, filtration ok 

1.00E-04 (1) 

104 Fuel assembly drop (in 

reactor building) 

1.00E-04 

2.08E-04 

See 15.2 

Impact due to Turbine 

disintegration 

8.00E-06 

DB0 




Table 17: Results for Assessment of Individual Risk Frequency 

Off-site 

Effective 

Dose Band 

(mSv) 

Non Core Damage Sequences 

from Level 1 PSA 


Additional Non 

Core Damage 

Sequences 

Core Damage 

Sequences from 


Total 

DB5 

> 1000 

1.57E-09 

(0.85%) 

2.83E-09 

(1.54%) 

1.80E-07 

(97.83%) 

1.84E-07 

DB4 

100 - 1000 

6.44E-10 

(0.27%) 

0 2.39E-07 

(99.73%) 

2.39E-07 

DB3 

10 - 100 

4.08E-07 

(30.31%) 

5.00E-07 

(37.17%) (1) 

4.37E-07 

(32.52%) 

1.35E-06 

DB2 

1 – 10 

2.76E-06 

(21.08%) 

1.04E-05 

(78.92%) (1) 

0 1.32E-05 

DB1 

0.1 - 1 

1.22E-03 

(85.21%) 

2.08E-04 

(14.65%) 

0 1.43E-03 

9) The frequency contribution to this dose band is derived from fuel handling faults 

allocated to DB1. This frequency is associated with the conditional probability of 

additional failure of mitigation systems. 

Note: The data within this table is compiled from Tables 14, 15 and 16. 



Page 47 of 60




Table 18: Results for Assessment of Societal Risk 

Release 

Category 

Frequency of 

Occurrence 

[Ref. 11] 

Frequency of 

Occurrence for Two 

Reactors 

Probability of 

100 deaths on 

Occurrence of 

Release [Ref. 

18] 

Annual Site 

Frequency of 

100 deaths 

200 8.71E-10 1.74E-09 0.908 1.58E-09 

201 2.90E-10 5.80E-10 0.972 5.64E-10 

202 1.29E-12 2.58E-12 0.950 2.45E-12 

203 1.61E-12 3.22E-12 1.000 3.22E-12 

204 1.05E-09 2.10E-09 0.972 2.04E-09 

205 1.19E-09 2.38E-09 1.000 2.38E-09 

206 4.44E-09 8.88E-09 0.965 8.57E-09 

301 7.53E-12 1.51E-11 0.986 1.48E-11 

302 1.08E-11 2.16E-11 0.986 2.13E-11 

303 9.69E-09 1.94E-08 0.972 1.88E-08 

304 1.00E-08 2.00E-08 0.986 1.97E-08 

401 2.02E-11 4.04E-11 0.957 3.87E-11 

402 7.92E-12 1.58E-11 0.972 1.54E-11 

403 9.35E-10 1.87E-09 0.915 1.71E-09 

404 1.05E-09 2.10E-09 0.972 2.04E-09 

501 5.50E-13 1.10E-12 0.014 1.54E-14 

502 1.45E-10 2.90E-10 0.489 1.42E-10 

503 6.45E-10 1.29E-09 0.007 9.03E-12 

504 1.30E-07 2.60E-07 0.163 4.24E-08 

602 7.90E-10 1.58E-09 0.440 6.95E-10 

701 1.02E-08 2.04E-08 0.957 1.95E-08 

702 5.14E-09 1.03E-08 1.000 1.03E-08 

802 3.84E-09 7.68-09 0.993 7.63E-09 

SFP * 2.83E-09 5.66E-09 1.000 5.66E-09 

NCD (10%) † 1.57E-09 3.14E-09 0.121 3.80E-10 

Total 1.85E-07 3.69E-07 1.44E-07 

Only Dose Band 5 releases are included in this table as they are the only events that 

caused more than 100 fatalities. 

* The value for SFP is calculated as a combination of the Dose Band 5 SFP events detailed in Table 16. 

† The numerical value for NCD (10%) is calculated as the combined contribution from the Dose Band 5 

LOCA 10% fuel failure and Feed and Bleed 10% fuel failure events detailed in Table 14. 



Page 48 of 60




Table 19: Faults Identified in the PCC List (not included in PSA) 

Fault 

Identifier 

PCC3-01 

PCC3-02 

PCC3-03 

PCC4-01 

PCC4-02 

PCC4-03a 

PCC4-03b 

Description 

Leak in the gaseous waste 

processing system 

Isolable piping failure on a 

system connected to the 

spent fuel pool 

Inadvertent loading of a 

fuel assembly in an 

incorrect position 

Failure of systems 

containing radioactivity in 

the NAB under earthquake 

conditions 

Rupture of systems 

containing radioactivity in 

the NAB 

Fuel handling accident with 

damage to one row of fuel 

rods 

Fuel handling accident with 

damage to all rows of fuel 

rods 

Fault Origin 

NEPR-F DC 584 [Ref. 27] (PCSR Sub-chapter 14.4 [Ref. 28]) 

Event 33 in Table 8 

(PCC3 non-core damage event screened out of Level 1 PSA) 





Event 31 in Section 15.5.3 -Table 8 


PCSR Sub-chapter 14.6 [Ref. 12] 


Note: Faults of seismic origin were not included in Section 

15.5.3 -Table 1 as seismic events were not addressed in the 

Level 1 PSA. 












Page 49 of 60




Table 20: Faults Identified in the Expert Review List (not included in PSA) 

Fault identifier Description Fault Origin 

EXRV-01 Fuel assembly drop (into reactor building) Table 10 Event no. 104 

EXRV-02 Fuel assembly mishandling (into reactor building) Table 10 Event no. 105 

EXRV-03 

Fuelling machine fault leads to dropping of heavy 

items into the core leading to clad failure 

Table 10 Event no. 106 

EXRV-04 Fuel element stuck in the fuel transfer mechanism Table 10 Event no. 107 

EXRV-05 Heavy object dropped into fuel pool Table 10 Event no. 108 

EXRV-06 Faults associated with spent resin transfer Table 10 Event no. 109 

EXRV-07 Inadvertent discharge of liquid waste Table 10 Event no. 110 

EXRV-08 Inadvertent discharge of gaseous waste Table 10 Event no. 111 

EXRV-09 Dropping of solid waste package Table 10 Event no. 112 

EXRV-10 Dropping of activated filter Table 10 Event no. 113 

EXRV-11 Fire involving solid waste material Table 10 Event no. 114 

EXRV-12 Rapid drainage of the spent fuel pool Table 10 Event no. 122 

EXRV-13 Boiling of the Spent Fuel Pool PCSR Sub-chapter 15.3 [Ref. 

13] 



Page 50 of 60




Table 21: Faults Identified in the Additional Review 

Fault 

identifier 

ADRV-01 

ADRV-02 

ADRV-03 

Description 

Worker receives excessive external gamma 

or neutron irradiation due to being 

inadvertently exposed to an unshielded 

source of radiation. 

Worker receives excessive external gamma 

or neutron irradiation due to inadvertently 

entering a radiologically controlled area. 

Spent fuel assembly over-raise during fuel 

handling leading to exposure of worker to 

high dose rates. 

Fault Origin 

Event added after additional review of 

comparable faults in [Ref. 30]. 





Table 22: LOSAs 

Fault Identifier Description Fault Origin 

LOSA-01 

OP_MAKEUP 

LOSA-02 

OP_MAKEUP H REF 

LOSA-03 

OP_EFW/MSRT_2H 

LOCAL 

LOSA-04 

OP_LHSI ISO 

LOCAL 

LOSA-05 

OP_SBODG_LOCAL 

LOSA-06 

OP_FEED_TK 

LOSA modelled in the Level 1 PSA 

(from NEPS-F DC 191 Appendix A 

[Ref. 31]) 



[Ref. 31]) 



[Ref. 31]) 



[Ref. 31]) 



[Ref. 31]) 



[Ref. 31]) 

Worker initiates fuel pool make-up 

before 10.3 m level is reached and start 

of fuel uncovery 

Note: Although not specifically identified 

as a local action in the Level 1 PSA, it is 

indicated in Appendix A of [13] that 

there could be a requirement to perform 

this action locally. 

Worker initiates fuel pool make-up in 

case of loss of PTR [FPCS] header in 

refuelling states 

Note: Although not specifically identified 

as a local action in the Level 1 PSA, it is 

indicated in Appendix A of [13] that 

there could be a requirement to perform 

this action locally. 

Worker performs the cross-connection 

of the SGs and opening of MSRT 

before 2 h in SBO conditions 

Worker isolates LHSI TR1 (t>4h after 

complete emptying of the IRWST) (in 

states C to E) 

Worker starts the SBO diesel by local 

action 

Worker refills the MFWS or EFWS 

tanks and cross connects the EFWS 

trains (if required) to ensure secondary 

heat removal 

LOSA-07 

LOSA claimed in the PCC analysis 

Event code : ASG-FS-05 

(from [Ref. 32] and [Ref. 33]) 

Realignment of the supply of the EFWS 

pumps 



Page 51 of 60




Fault Identifier Description Fault Origin 

LOSA-08 

LOSA-09 

LOSA-10 

LOSA-11 

LOSA-12 

LOSA-13 

LOSA-14 

LOSA-15 

LOSA-16 

LOSA-17 

LOSA-18 

LOSA-19 

LOSA-20 









(from [Ref. 33]and [Ref. 27]) 


Event code : JAC-FS-01 



Event code : PTR-FS-07 









Event code : RCV-FS-E 



Event code : SRU-FS-02 



Event code : VDA-FS-A 



Event code : VDA-FS-B 



Event code : VDA-FS-C 



Event code : DMK-FS-01 


Realignment of the output of the EFWS 

pumps 

Re-supply of the EFWS from a diverse 

cooling supply 

Re-supply of the spent fuel pool water 

supply in the event of loss of cooling 

train 

Re-supply of the EFWS pumps 

Isolation of the water supply to the 

spent fuel pool PTR [FPCS] cooling 

pumps 

Isolation of the 3rd train of the PTR 

[FPCS] following pipe work breach 

Cross-connection of the PTR [FPCS] 

supply to the fire fighting system supply 

Isolation of a heat exchanger following 

heat exchanger tube rupture 

Initiate the supply of the SRU [UCWS] 

from the discharge pipe work in the 

forebay 

Isolation of the condenser discharge to 

atmosphere valve 

Action for protection against secondary 

overpressure 

Action for protection against secondary 

overpressure 

Actions to provide emergency cooling of 

the fuel assembly canister 



Page 52 of 60




Table 23: Worker Risk Categories 

WRC Description Calculated 

Worker 

Dose 

Allocated 

WDB 

Reactor Building WRCs 

WRB0 

WRB1 

WRB2 

WRB3 

Very small LOCA in normal operation or spurious pressuriser 

opening with normal operation primary coolant activity 

Very small LOCA in normal operation or spurious pressuriser 

opening coincident with primary coolant transient activity peak 

Small LOCA (PCC3 LOCA size) with normal operation primary 

coolant activity 

Small LOCA (PCC3 LOCA size) in normal operation coincident 

with primary coolant transient activity peak 

0.06 mSv WDB0 

0.4 mSv WDB1 

0.6 mSv WDB1 

3.8 mSv WDB2 

WRB4 LOCA with 1 % cladding rupture >2000 mSv WDB5 

WRB5 LOCA with 10 % cladding rupture >2000 mSv WDB5 

WRB6 

WRB7 

WRB8 

WRB9 

WRB10 

WRB11 

Small LOCA (PCC3 LOCA size) with normal operation primary 

coolant activity and failure of the primary containment boundary 

(worker in adjacent building or annular space) 

LOCA with 1 % cladding rupture and failure of the primary 

containment boundary (worker in adjacent building or annular 

space) 

LOCA with 10 % cladding failure and failure of the primary 

containment boundary (worker in adjacent building or annular 

space) 

Small LOCA (PCC3 LOCA size) coincident with primary coolant 

transient activity peak and containment bypass (worker in 

adjacent building or annular space) 

Small LOCA during shutdown coincident with primary coolant 

oxygenation activity peak 

Small LOCA during shutdown coincident with primary coolant 

oxygenation activity peak and failure of the primary containment 

boundary (worker in adjacent building or annular space) 

3.7 mSv WDB2 

>2000 mSv WDB5 

>2000 mSv WDB5 

23 mSv WDB3 

1 mSv WDB1 

6.2 mSv WDB2 

Safety Auxiliary Building WRCs 

WSAB0 

WSAB1 

WSAB2 

WSAB3 

External radiation from a pipe containing high activity primary 

coolant (e.g. RIS [SIS] system pipe following an accident 

resulting in 1 % cladding rupture) 

Failure of RRA [RHRS] system pipe work with partial (~54 te) 

primary coolant release 

External radiation from a pipe containing high activity primary 

coolant (e.g. RIS [SIS] system pipe following an accident 

resulting in 10 % cladding rupture) 

Failure of RRA [RHRS] system pipe work with complete (320 te) 

primary coolant release 

65 mSv WDB3 

3.7 mSv WDB2 

647 mSv WDB4 

21 mSv WDB3 

Fuel Building WRCs 

WFB0 

Boiling of the spent fuel pool due to failure of the PTR [FPCS] 

system 



1.6 mSv WDB1 

Page 53 of 60




WRC Description Calculated 

Worker 

Dose 

Allocated 

WDB 

WFB1 

WFB2 

WFB3 

Fuel handling accident leading to damage to one row (17 fuel 

rods) of a spent fuel assembly 

Fuel handling accident leading to damage to all 265 fuel rods of 

an assembly 

Rapid drainage of the spent fuel pool coincident with fuel 

handling activities 

51 mSv WDB3 

789 mSv WDB4 

< 200 mSv WDB3 

Nuclear Auxiliary Building WRCs 

WNAB0 

WNAB1 

WNAB2 

WNAB3 

WNAB4 

WNAB5 

WNAB6 

Leak of cold primary coolant (




Table 24: Overall Accident Frequency vs. Dose Results – SDO-5 Comparison 

Accident/LOSA WDB Frequency (y -1 ) SDO-5 region 

L2 PSA:CD (WDB5) WDB5 1.8 x 10 -7 Broadly Acceptable 

L1 PSA:WRB4 WDB5 1.7 x 10 -5 Tolerable if ALARP 

L1 PSA:WRB7 WDB5 6.4 x 10 -10 Broadly Acceptable 



L1 PSA:WSAB2 WDB4 5.9 x 10 -6 Broadly Acceptable 

L2 PSA: CD (WDB4) WDB4 2.4 x 10 -7 Broadly Acceptable 

PCC4-03b WDB4 1.0 x 10 -5 At BSO 

EXRV-05 WDB4 1.0 x 10 -6 Broadly Acceptable 

L2 PSA: CD (WDB3) WDB3 4.4 x 10 -7 Broadly Acceptable 


PCC3-02 WDB3 4.2 x 10 -7 Broadly Acceptable 

PCC4-03a WDB3 1.0 x 10 -4 At BSO 



L1 PSA:WAC1 WDB3 3.2 x 10 -7 Broadly Acceptable 



LOSA-04 WDB3 1.1 x 10 -9 Broadly Acceptable 

L1 PSA: WSAB1 WDB2 1.1 x 10 -4 Broadly Acceptable 

L1 PSA: WRB11 WDB2 6.5 x 10 -7 Broadly Acceptable 



PCC3-01 WDB2 1.0 x 10 -3 At BSO 



L1 PSA:WTH2 WDB1 2.5 x 10 -5 Broadly Acceptable 

L1 PSA:WTH0 WDB1 1.2 x 10 -3 Broadly Acceptable 






LOSA-17,18,19 WDB1 1.0 x 10 -5 Broadly Acceptable 




Page 55 of 60




7 FIGURES 

Figure 1: Methodology for Assessment of Individual Risk 

Design Basis 

Analysis 

Initiating event 

Minimum 

Safeguards 

Sequences 

Reliability 

Estimation 

Frequency 

Estimation 

Beyond design 

basis initiating 

events 

Other faults with a 

potential for offsite 

release e.g. waste 

handling faults 


success states 

Frequency 

Equipment 

Configuration 

Frequency 

from L1 


Screen on 

Frequency 

Screen on 

Consequences 

Assign to 

off-site 

Dosebands 

Sum 

Doseband 

frequencies 


Release 

Categories 

Frequency 

from 

L2PSA 

PSA data 



Page 56 of 60




Figure 2: Comparison of the Individual Risk Assessment Results to SDO-7 

Doseband Staircase Diagram for public off-site 

1.0E+00 

0.1 1 10 100 1000 10000 

1.0E-01 


1.0E-02 

1.0E-03 

1.0E-04 

1.0E-05 

1.0E-06 

1.0E-07 

Dose (mSv) 

Black squares represent the frequency / dose couplets for the five dose bands. The Red line represents the BSL and the Green line the BSO. 



Page 57 of 60




Figure 3: Methodology for Assessment of Societal Risk 

Level 1 & 2 

PSA RCs 

Frequency 

from Level 2 


Source 

Terms from 

Level 1 & 2 


RCs in dose 

band 5 and 4 

Calculation of 

societal risk 

with PC 

COSYMA 

Frequency 

of >100 

fatalities 

Results of 

Major accident 

assessment 



Page 58 of 60




Figure 4: Worker Risk Methodology Diagram 



Page 59 of 60






Page 60 of 60 

Figure 5: Frequency-Dose ‘Staircase’ – SDO-5 Comparison 

Worker Risk Assessment for the UK EPR 

1.00E+00 

0 1 2 3 4 5 

LOSA-04 

L1 PSA:WRB8 


LOSA-21 


LOSA-22 

LOSA-25 

LOSA-17,18,19 

L1 PSA:WTH2 

LOSA-23 

EXRV-06 

LOSA-01 LOSA-12 

L1 PSA:WTH0 

L1 PSA: WSAB1 

L1 PSA: WRB11 

EXRV-09 

L2 PSA: CD (WDB3) 

PCC4-02 

L1 PSA:WAC1 PCC4-03a 

PCC4-01 


L1 PSA:WSAB0 


PCC3-02 


L2 PSA: CD (WDB4) 

PCC4-03b 

EXRV-05 

L2 PSA:CD (WDB5) 



PCC3-01 


1.00E-01 

1.00E-02 

1.00E-03 

1.00E-04 

1.00E-05 

1.00E-06 

Tolerable if ALARP region 

Unacceptable region 

BSL 

BSO 

1.00E-07 

1.00E-08 

1.00E-09 

Broadly Acceptable Region 

1.00E-10 

WDB1 WDB2 WDB3 WDB4 WDB5 

2 

0.1 20 200 2000 

Dose to worker (mSv) 

Frequency (y -1 )

Level 3 PSA - EDF Hinkley Point

Create successful ePaper yourself

Delete template?

Save as template?