[en] Based on recent methodological extensions and advancements performed by GRS as well as on international insights, particularly from multi-national activities by the OECD Nuclear Energy Agency (NEA), GRS has developed a comprehensive systematic approach for extending Level 1 and Level 2 probabilistic safety analyses (PSA) for individual rector units to a so-called Site-Level PSA for the entire reactor units and other radio-active sources collocated at a nuclear site.

[en] When the 13"t"h amendment of the Atomic Energy Act came into force, eight Germ an nuclear power plant units had their power operating licences revoked and are now in the so-called post operation phase. Of the remaining nuclear power plants, one have by now also entered the post operation phase, with those left in operation bound for entering this phase sometime between now and the end of 2022. Therefore, failure mechanisms that are particularly relevant for post operation were to be identified and described in the frame of the present project. To do so, three major steps were taken: Firstly, recent national and international pertinent literature was evaluated to obtain indications of failure mechanisms in the post operation phase. It turned out that most of the national and international literature deals with the general procedure of the transition from power operation to decommissioning and dismantling. However, there were also some documents providing detailed indications of possible failure mechanisms in post operation. This includes e.g. the release of radioactive materials caused by the drop of containers, chemical impacts on systems important to safety in connection with decontamination work, and corrosion in connection with the storage of the core in the spent fuel pool, with the latter leading to the jamming of the fuel assemblies in the storage racks and a possible reduction of coolant circulation. In a second step, three safety analyses of pressurised water reactors prepared by the respective plant operators were evaluated to identify failure mechanisms based on systems engineering. The failure mechanisms that were found here include e.g. faults in the boric acid concentration of the reactor coolant, damage to the equipment airlock upon the unloading of Castor casks, leakages in connection with primary system decontamination, and the drop of packages holding radioactive residual materials or waste with subsequent mobilisation of radioactive aerosols. Finally, national and international operating experience was evaluated with the aim to derive general failure mechanisms from events that have occurred. For this purpose, the database of German reportable events (VERA), the database of the OECD/NEA ''International Common-cause Data Exchange (ICDE)'' project as well as the database of the ''International Reporting Systems for Operating Experience (IRS)'' of the IAEA was searched. As these data sources comprise a total number of about 12,000 events, initially the evaluation focused on the 309 events that occurred in plants that are in the post operation or decommissioning phase. In order to capture events from power operation whose damage phenomena have special relevance for post operation, too, attempts were made to develop automatic searches that would deliver a pre-selection of relevant results. To evaluate this method, 900 events from a German twin unit plant over a period from their construction until the present were analysed manually. It turned out that an automated search did not deliver enveloping results. All in all, 12 events from German plants in post operation or decommissioning and 36 events from plants with power operation licences as well as 6 events from international operating experience (IRS and ICDE) which showed a failure mechanism with special relevance for the post operation phase were identified. The events were presented individually, with special emphasis on the description of the failure mechanism that was particularly relevant for post operation. The failure mechanisms identified can be allocated to the following three general categories: special operating modes; changed operating or ambient conditions; organisational and personnel boundary conditions. The failure mechanisms assigned to these categories are presented in a summarized form and discussed.

[en] An important task of GRS as the competent institution for probabilistic safety analyses in Germany is to continuously enhance, extend, and validate methods and data for probabilistic safety assessments according to the state-of-the-art as well as to enhance the corresponding analytical tools for efficiently carrying out probabilistic safety analyses (PSA) up to Level 2 for nuclear power plants during all plant operational states covering power operation as well as low pow power and shutdown phases. Probabilistic safety analyses (PSA) have been performed for nuclear power plants in Germany for more than 35 years. Insights from PSA in the past have resulted in significant safety improvements and thus contributed essentially to the high safety level of German nuclear power plants. Probabilistic safety analyses have to be performed regularly every ten years in the frame of Periodic Safety Reviews according to the regulatory requirements for German nuclear power plants, but also case specifically. Plant internal initiating events and selected internal and external hazards occurring power operation have to be analysed in the frame of the Safety Reviews according to the German nuclear regulations. For low power and shutdown plant operational states mainly analyses for plant internal events have been carried out. However, in contrary to full power states, parts of the safety systems as well as of operational systems are not available because of inspection and maintenance activities, and barriers not completely available. The consequences of hazards can therefore be non-negligible during low power and shutdown states with respect to nuclear safety.

[en] As part of a research and development project funded by the Federal Ministry for the Environment, Nature Conservation and Nuclear Safety (BMU), GRS is developing a generic level 1 PSA for a research reactor based on the methodological state of science and technology. The aim of the project is the development of PSA competence at GRS in relation to research reactors (also regarding plant- and safety technology). In this project, the development and application of PSA methods are in the foreground. No risk assessment should be carried out for the examined reference reactor. It is therefore adequate to make appropriate simplifications in some areas of PSA which, however, should not materially affect the usability of the PSA results for methodological evidence. This paper presents the status of a Level 1 PSA development process for a German reference research reactor. The research reactor being analysed is an open-pool reactor with 20 MW thermal power and one fuel element. One hot and one cold neutron source produce neutron fluxes which are guided by beam tubes to the experimental halls. Additionally, radioactive isotopes for medical applications can be produced with the reactor. The relevant initiating events and accident sequences during power operation are, e. g., control rod withdrawal with maximum speed, loss of offsite power, loss of converter plate cooling or loss of coolant outside the pool. The initiating events pool leakage, seismic hazard or aircraft crash are relevant for all operational states. The initiating event frequencies have been mostly determined based on the operating experience of German research reactors with a thermal power > 1 MW and which were in operation beyond the year 2003. Damage states can be fuel element damage and converter plate damage. Main safety functions required to reach the safety goals after an initiating event are reactor shutdown functions and cooling system functions. Event sequence analysis and derivation of success criteria in the PSA are based on the Safety Report. Selected event sequences are evaluated by means of thermal hydraulic calculations. The unavailability of safety functions is computed by means of fault trees, which are the result of systems analyses performed for safety systems as well as for operating systems credited for cooling functions after initiating events. The PSA model also includes simplified modelling of the power supply. The used reliability data for single failures are mainly based on an IAEA data source (TECDOC-930) /IAE 97/. The data have been applied to the research reactor using the super-population method (a two-stage Bayesian approach). Common cause failure data are mainly taken from a database comprising the operating experience in German nuclear power plants. The quantification of the PSA model shows that the generic data used are very conservative and partly have very high uncertainties. This leads to results that are not representative for the investigated reactor. For this reason, no absolute frequencies for damage states are indicated, but the relative contributions of the initiating events to the overall result. The results of this research project were presented to the international scientific audience at the IGORR / RRFM 2019 in Jordan and the “International Topical Meeting on Probabilistic Safety Assessment and Analysis (ANS-PSA 2019)” in Charleston, USA.

[en] The subject of the BMUV/BASE project 4719R01378 was the assessment of events that occurred in foreign nuclear power plants during mid-loop operation and the evaluation of their safety significance for the German nuclear power plants. For this purpose, the existing PSA for shutdown operation was extended to include so far unconsidered event sequences during mid-loop operation. For the identification of relevant events, the foreign operating experience of the past 20 years, in particular the events reported within the framework of the IAEA's Incident Reporting System, was used. For the events that occurred abroad, it was checked whether they are transferable to the German plants. The following events have been evaluated probabilistically: failure of the residual heat removal with closed reactor pressure vessel and simultaneous large cold side opening at the primary circuit (so-called Diablo Canyon scenario), actuation of the emergency core cooling criteria due to errors in the nitrogen injection and leaks in the primary circuit due to incorrect operator actions. Overall, a fuel damage frequency of 5.6E-07/year was calculated for the evaluated events. The largest contribution (approx. 60 %) is due to the event "actuation of the emergency core cooling criteria due to errors in the nitrogen injection". The newly considered events were evaluated comprehensively regarding their safetyrelated significance. A significant potential for safety improvement could not be derived.

[en] As part of the research and development project 4718R01500 sponsored by the Federal Ministry of the Environment, Nature Conservation and Nuclear Safety (BMU) GRS has developed a methodological approach for considering long-lasting event sequences, in particular resulting from hazards and hazard combinations, with complex damages and failure modes within Level 1 probabilistic safety analyses (PSA). After the identification and description of hazards and hazard combinations which may result in event sequences of longer durations with highly complex damages and failure modes and determining the specific boundary conditions of initiating events as well as accident mitigation measures needed, the Level 1 PSA plant model of the reference plant has been adapted accordingly. In a first step, for a selected reference plant in Germany, those hazards and hazard combinations relevant for a selected reference plant site and the reactor unit to be analysed have been identified applying the Hazards Screening Tool (HST) developed by GRS. A long-duration external flooding has been analysed in detail. In this context, it has been assumed in addition that in the event of such an external flooding the plant will not be accessible by road and that there will be a complete loss of offsite power. As a result, the operation of the emergency diesel generators over a long period as well as a continuous replacement of the shift personnel are needed. For continuously running the emergency diesel generators the support with diesel fuel needs to be ensured after at the latest after a given time period. Two supplementary emergency measures ensuring the supply of the plant with personnel and fuel, a ferry service with amphibious vehicles and helicopter transport, have been analysed in detail. These supplementary emergency measures are also applicable after seismic events with long-lasting event sequences and a loss of offsite power. The measures analysed in detail have been implemented and quantified in an existing Level 1 PSA plant model, taking into account postulated event-specific boundary conditions and plant states. The quantification of the PSA model demonstrates that in the external flooding event analysed assuring the supply of personnel provides a significantly higher contribution to the success of the mitigation measures than ensuring the fuel supply. The reason for this is the significant decrease in human reliability due to long shift durations. Hence, a regular staff exchange will significantly affect the success of the event mitigation measures.

[en] As a result of the 13th amendment to the Atomic Energy Act (August 2011), 8 nuclear power plants have been permanently switched off. Since these nuclear power plants were not prepared for shutdown, applications for a permit to decommission the facilities at that time were not yet placed or prepared. Until the granting of the decommissioning permit, the following were found to be these installations with still valid operating licence, but without authorization for power operation, in an operating phase that also simplifies the "post-operational phase"- or "permanent non-power operation". In the first few years, for many of these facilities there was no sufficient number of transport and storage containers for spent fueld elements available at the site, so that this operating condition lasted a very long time. The long period between the completion of the operation and the granting of the decommissioning permit has not been considered in detail. For this period, therefore, there were no specific regulations. The safety and system availability for (longer-term) post-operation under consideration of the current requirements given by the German rules and regulations are sufficiently guaranteed. Likewise, the evaluation of the available operating experience of German nuclear power plants does not identify new findings with respect to the noted item list or the existing standards. Based on the evaluation according the state of the art in science and technology and the analyses carried out the available operating experience (reportable events and forwarding messages) German nuclear power plants, in the view of GRS, no new measures have to be taken. Based on the results of the evaluation of the operating experience, the following measures were taken probabilistic investigations. For the PWR and BWR plant under consideration the expected value for the fuel rod damage frequency was in the same order of magnitude as in the investigations on non-commercial operation. Also from the determined frequency of fuel rod damage there are no indications deficiencies. The safety systems available in post-operation and their redundancies appear as follows sufficient and adequate. In the installations under consideration, fires and earthquakes can cause the largest releases of activity from sources other than the nuclear fuel. However, the potential radiation exposure due to these events are, it is significantly lower than the exposure due to design basis accidents.

[en] The advanced handbook of safety analyses (HSA) comprises a comprehensive electronic collection of knowledge for the compilation and conduction of safety analyses in the area of reactor, plant and containment behaviour as well as results of existing safety analyses (performed by GRS in the past) with characteristic specifications and further background information. In addition, know-how from the analysis software development and validation process is presented and relevant rules and regulations with regard to safety demonstration are provided. The HSA comprehensively covers the topic thermo-hydraulic safety analyses (except natural hazards, man-made hazards and malicious acts) for German pressurized and boiling water reactors for power and non-power operational states. In principle, the structure of the HSA-content represents the analytical approach utilized by safety analyses and applying the knowledge from safety analyses to technical support services. On the basis of a multilevel preparation of information to the topics ''compilation of safety analyses'', ''compilation of data bases'', ''assessment of safety analyses'', ''performed safety analyses'', ''rules and regulation'' and ''ATHLET-validation'' the HSA addresses users with different background, allowing them to enter the HSA at different levels. Moreover, the HSA serves as a reference book, which is designed future-oriented, freely configurable related to the content, completely integrated into the GRS internal portal and prepared to be used by a growing user group.

[en] Internationally the integral deterministic-probabilistic safety analysis (IDPSA) is consid-ered as an important research area. The advantage applying an IDPSA in reactor safety analysis is to appropriately represent and evaluate the large variety of possible accident sequences which may arise from stochastic influences. Above all, an IDPSA with MCDET allows to consider time dependent interactions as well as the variety of random times of events and to quantify their effect on the accident sequence. Safety assessment can be considerably improved by application of advanced dynamic methods as, for ex-ample, MCDET which can be used to perform an IDPSA. With the development of the new MCDET-scheduler and ATHLET-CD driver the practi-cability of applying MCDET in combination with ATHLET and ATHLET-CD was essen-tially improved. Additionally, the large variety of accident sequences simulated in an MCDET analysis were processed more efficiently. In addition to mere deterministic anal-ysis ATHLET and ATHLET-CD in combination with MCDET now can be applied to per-form an integrated deterministic-probabilistic safety analysis. The newly developed MCDET-scheduler and driver of ATHLET-CD were successfully applied within an IDPSA on a thermally induced steam generator tube rupture in a high-pressure scenario. Stochastic influences were considered and probabilistically quantified which until now could not be analyzed in the required detail due to the lack of appropriate methods. For example, the influence of random failure time of pressurizer valves or the degradation of steam generator U-tube at the beginning of the accident scenario on steam generator tube rupture. A further objective was the development of knowledge-based behavior in the context of a dynamic analysis. Due to its complexity and inherent interactions knowledge-based behavior should be preferably modeled and quantified with advanced dynamic methods which allow a more detailed analysis. For that reason, the method of knowledge-based behavior was modeled with the Crew-Module which is a method to model and simulate a human procedure as a dynamic process. The proposed methodology of dynamic hu-man reliability analysis was successfully applied on a selected incident from the German operational experience data-base.

[en] Within the framework of a former research and development project /MAY 19/ funded by the German Federal Ministry for the Environment, Nature Conservation and Nuclear Safety (BMU), GRS has developed a generic Level 1 PSA for a research reactor. This PSA was in accordance with the methodical state of the art in science and technology but was subjected to simplifications in certain areas. In the recent project described here; the weaknesses identified in the preceding project were eliminated. In particular, a comprehensive spectrum of single hazard events and hazard combinations was investigated. Furthermore, site-specific reliability parameters were determined in order to reduce the conservatism known from the previous project and to reduce the uncertainties of the reliability data. Furthermore, the investigations were extended by the definition of an interface between the Level 1 and Level 2 PSA as well as by a case study application of the advanced method MCDET for a dynamic PSA. A comprehensive scope of hazards events was assessed using the "Hazards Screening Tool" developed at GRS for the reference plant. As a consequence of these results, an internal and an external hazard (internal flooding and aircraft crash, respectively) were probabilistically analysed in detail. A two-step Bayesian procedure using generic operating experience (i.e., other research reactors) and plant-specific operating experience was used to re-evaluate the reliability parameters of the independent failures. With respect to CCF, the operating experience of German power reactors was basically used, as in the previous project. In addition, however, a procedure was developed and applied for quantitatively taking into account technical and operational differences between power reactors and the reference research reactor. For the interface to the Level 2 PSA, the specific characteristics relevant for a research reactor were determined and assigned to the individual core damage states. For the case study of an analysis with MCDET, the scenario "Transition to natural circulation operation in the post-cooling phase after reactor shutdown" was selected. In this scenario, human actions are of particular importance in addition to technical aspects. The influences on the natural circulation operation due to temporal variations in the shut-down of the heat removal systems as well as due to damages of technical components, which do not lead to failure, but affect e.g., the delivery rate of pumps or opening cross sections of valves, were determined.