FUNDAMENTAL SAFETY OVERVIEW VOLUME 2: DESIGN AND SAFETY CHAPTER I: AUXILIARY SYSTEMS 2. VOLUME AND CHEMICAL CONTROL (RCV [CVCS])

Transcription

1 PAGE : 1 / VOLUME AND CHEMICAL CONTROL (RCV [CVCS]) 2.0. SAFETY REQUIREMENTS Safety functions Control of reactivity In normal operation, the RCV [CVCS] regulates and adjusts (jointly with the REA [RBWMS]) the boron content of the primary system in order to control power variations (in conjunction with the control rods), in plant start-up and shutdown conditions, or to offset fuel burn-up. The boron content is adjusted by boron make-up (controlled and regulated in the REA [RBWMS]) via the RCV [CVCS] charging line and by regulating the letdown from the primary system. During an accident, the RCV [CVCS] must fulfil the following safety functions: - limit the consequences of a homogeneous boron dilution accident (PCC-2) - prevent heterogeneous boron dilution accidents Decay heat removal The RCV [CVCS] helps control maintenance of the water inventory of the primary system in certain RRC-A- situations Radioactive substance containment The RCV [CVCS] must ensure the following: - leaktightness of the primary system at the primary pump seals by injection of cooled and purified water into the primary pump seals and by directing leaks from the seals to the RCV [CVCS] - the charging function of the primary system in the event that the normal charging line is unavailable, via injection at the number 1 seal of the primary pumps - appropriate chemical characteristics of the primary water, to limit corrosion of the fuel rod cladding - auxiliary spray in the pressuriser - prevention of overfill of the steam generators (PCC-3 and PCC-4) As the RCV [CVCS] conveys radioactive products in the form of solid or ionic flow and in the form of dissolved gases, the RCV [CVCS] pressure boundary must be designed as a barrier for containing radioactive products. In a post-accident situation, the RCV [CVCS] must contribute to containment isolation.

2 PAGE : 2 / 16 In a post-accident situation, the RCV [CVCS] must ensure isolation of the main primary system in the event of a rupture downstream of the main primary system isolation valves Functional criteria Control of reactivity The RCV [CVCS], in association with the REA [RBWMS], enables controlled injection of water (dilution) or boric acid (boration) so as to adjust the soluble poison content, to control any planned variations in reactivity, including Xenon transients. When the reactor is operating, the boration capacity of the RCV [CVCS] in conjunction with the REA [RBWMS], enables the core to be brought to a sub-critical state in cold shutdown, ensuring a sufficient shutdown margin (including Xenon effects). The RCV [CVCS], in conjunction with the REA [RBWMS], must also be capable of controlling small reactivity variations by adjusting the primary system boron content and thus follow the expected load variations (including Xenon effects), so that fuel limits are not reached. The RCV [CVCS] and the REA [RBWMS] must be designed to protect the primary system from risks of heterogeneous or homogeneous boron dilution, using appropriate means of detection and actions for isolating the RCV [CVCS] downstream of the volume control tank (PCC-2) and injecting boron into the primary system Decay heat removal Two pumps must be operated (selection of the maximum flow rate by the operator) to ensure that the primary system water inventory is maintained, in conjunction with the safety injection, in certain RRC-A situations, in particular during bleed and feed operation Radioactive substance containment To prevent leakages, seal no. 1 of the primary pumps must be maintained at a temperature lower than that of the primary fluid. In these conditions, the borated water make-up at the level of this seal must be delivered 1 at a pressure higher than that of the primary system. Each RCV [CVCS] line crossing the containment must be equipped with two isolation valves, each fitted with leak control devices. Each RCV [CVCS] line connected to the primary system must be fitted with two valves for isolating the main primary system. The RCV [CVCS] must provide enough water to the auxiliary spray of the pressuriser when normal spray is not available, in order to enable a reduction in the primary system pressure. The charging line of the RCV [CVCS] must be isolated when the level in the steam generators is high (PCC-3 and PCC-4). 1 Protection of the no. 1 seals of the primary pumps is provided by the RRI [CCWS] thermal barrier or by the DEA [SSSS] (GMPP [RCP] no. 1 seal leaktightness system at shutdown)

3 PAGE : 3 / Design-related requirements Requirements deriving from safety classification - Safety classification The RCV [CVCS] must be safety-classified according to the classification principles presented in Chapter C.2. - Single failure criterion (active and passive) For components performing F1 functions, the single failure criterion must be taken into account in order to ensure a sufficient level of redundancy. - Backed up supplies Supply of all motor-driven valves and of the electric motors of the charging pumps must be backed up by diesels. Their safety function is thus always ensured, even in the event of loss of external electrical supplies. The chemical reagent injection system is connected to the normal electrical supply. - Qualification under normal operation The components fulfilling an F1 or F2 safety function must be qualified to remain functional in normal or post-accident operating conditions. The resulting requirements for the components (integrity, availability, functional capacity, etc.) are presented in Chapter C.7. - Mechanical, electrical and control-command classifications The mechanical classification of the RCV [CVCS] must be established according to the classification principles presented in Chapter C.2. The RCV [CVCS] electrical classification must be established according to the classification principles presented in Chapter C.2. The RCV [CVCS] instrumentation and control classification must be established according to the classification principles presented in Chapter C.2. If the Main Control Room is unavailable, the components of the RCV [CVCS] and the REA [RBWMS] used to bring the plant to a safe shutdown state must be able to be operated from the remote panel or locally. - Seismic classification The RCV [CVCS] must be seismically classified according to the classification presented in Chapter C Other regulatory requirements later - Official texts

4 PAGE : 4 / 16 - Technical Guidelines The prescriptions specific to the RCV [CVCS] are presented in sections B1.4.2, B2.3.1 and B (see Chapter C.1.2). None - Specific EPR reactor texts Internal/external hazards - Internal hazards The RCV [CVCS] must be protected against internal hazards, in accordance with Chapter C.4. - External hazards The RCV [CVCS] must be protected against external hazards, in accordance with Chapter C TESTS - Preliminary tests The preliminary tests must show that the design is compatible with the performance of the RCV [CVCS] in conjunction with the REA [RBWMS]. - Periodic tests and inspection during operation The safety-classified components of the RCV [CVCS] must undergo periodic tests. The installation and design of RCV [CVCS] equipment must allow easy access to it to allow inspections during operation and periodic tests for F1- and F2-classified equipment which is rarely used FUNCTIONAL ROLE In addition to the safety functions described in Chapter I.3.2.0, the RCV [CVCS] has the following functions: - to ensure continuous control, in normal operating conditions, of the water inventory of the primary system (RCP [RCS]) by adjusting the charging and letdown flow rates - to ensure the flow rate necessary for chemical control of the primary water, with the system for purification, treatment, degassing and storage of primary water (see auxiliary systems) - to enable adjustment of the chemical characteristics of primary water by injection of chemical reagents in the charging flow - to control the concentration of gas dissolved in the primary system using a degassing system - to control the hydrogen content of the primary system

5 PAGE : 5 / 16 - to inject cooled and purified water into the primary pump seal system (to ensure cooling and leak resistance for each pump) and recover the leaks from the seals - to ensure auxiliary spray in the pressuriser, if normal spray cannot or is not sufficient to fulfil the spray function - to carry out hydraulic tests on the main primary system - to provide a means for filling and emptying the primary system in shutdown conditions - to purify the primary system water at high flow capacity 2.2. APPLICABLE CRITERIA, ASSUMPTIONS AND CHARACTERISTICS The RCV [CVCS] is designed to fulfil the following functions: - control of primary water volume - control of reactivity by adjustment of the boron content - control of chemistry in the primary water (in conjunction with the purification, treatment, degassing and storage system): - injection at primary pump seals - control of hydrogen content - control of oxygen content and ph - purification and filtration - provision of auxiliary spray in the pressuriser The RCV [CVCS] is also used to fill and empty the primary system (RCP [RCS]) in shutdown conditions, and in the hydraulic testing of the main primary system. To fulfil these functions, the RCV [CVCS] bleeds primary fluid via the letdown line and makes-up to the RCP [RCS] via the charging line: - before injection into the RCP [RCS], the primary fluid drained via the letdown line is purified and its chemical characteristics adjusted - make-up of borated water (via the charging line) is performed to ensure the primary system water inventory is maintained and has the same boron content as the letdown fluid - make-up of borated water or boric acid to ensure reactivity control To ensure acceptable reliability of the main functions of the RCV [CVCS], functional redundancy must provide a sufficient flowrate for the letdown and charging functions. The charging function is performed by the charging line and/or by the injection capacity at the seals of the primary pumps.

6 PAGE : 6 / 16 a) Volume control of the primary The RCV [CVCS] helps maintain the primary system water inventory within the acceptable pressuriser level limits in normal operation, during power transients, during start-up of the plant and during heating and cooling transients of the primary. This is achieved by regulating the letdown flow rate, using the volume control tank to supply the primary system with water or to store the excess primary water. The RCV [CVCS] is also able to deliver sufficient make-up (in association with the REA [RBWMS]) to maintain the volume of primary water in the event of a small break in the primary piping. b) Control of reactivity The RCV [CVCS], in conjunction with the REA [RBWMS], controls the boron content of the primary water in order to control reactivity variations due to changes in the temperature of the primary water between cold shutdown and full-power operation, in the burn-up of fuel and burnable poisons, in the accumulation of fission products in the fuel, and in Xenon transients. The RCV [CVCS] may inject borated water from the REA [RBWMS] boric acid tanks or from the IRWST to the primary system until the required boron content is achieved for conditions of cold shutdown or shutdown for refuelling. c) Control of the primary fluid chemistry In conjunction with the purification, treatment, degassing and storage systems of the primary water and with the REA [RBWMS], the RCV [CVCS] controls the chemistry of the primary water and in particular: - the RCV [CVCS] provides the means to control the nature and content of gas dissolved in the primary fluid to avoid explosion and corrosion by accumulation of fission gases - the dissolved hydrogen is used to control the oxygen produced by radiolysis of the water in the core region. A sufficient nitrogen pressure is maintained in the RCV [CVCS] volume control tank to preserve the hydrogen balance concentration required in the primary fluid. The dissolution of hydrogen in the primary fluid is achieved in the RCV [CVCS] low-pressure section at a hydrogenation station - Lithium hydroxide is used to control the ph of the primary fluid at start-up and during subsequent operation d) Injection at primary pump seals The RCV [CVCS] performs continuous injection of cooled and purified water to the seals of each primary pump and recovers leaks from the seals of each primary pump. The water from seals is filtered to ensure the level of cleanliness required by the sealing system of the primary pumps. e) Auxiliary spray of the pressuriser The RCV [CVCS] has an auxiliary spray line to the pressuriser to control primary pressure in the event of failure of normal spray or when primary pressure must be reduced to meet cold shutdown conditions. The auxiliary spray line and each of the main spray lines are separate. It is also used to reduce primary pressure in the event of RTGV [SGTR] (it is not an F1B function). A redundant auxiliary spray function is provided. f) Other functions

7 PAGE : 7 / 16 - the RCV [CVCS] fills and empties the primary system - the RCV [CVCS] supplies water and controls the primary pressure during the first part of the hydraulic test of the main primary system (before being replaced by the test pump belonging to the safety boration system) DESCRIPTION OF FUNCTIONAL DIAGRAMS, FUNCTIONAL CONNECTIONS AND CHARACTERISTICS OF IMPORTANT EQUIPMENT The simplified functional diagram of the RCV [CVCS] is presented in I.3.2. FIG 1 The RCV [CVCS] is designed to maintain a continuous primary fluid letdown and charging flow via a letdown line and a charging line. The letdown line reduces the primary water to pressure and temperature conditions that are compatible with the purification/degassing systems. The RCV [CVCS] is also designed to fulfil the functions of injection into the primary pump seals and auxiliary spray Description of functional diagrams and functional links a) Letdown The letdown line is tapped on the U-shaped leg of the no. 1 cold leg and is equipped with isolation valves close to the primary loops. The letdown is cooled in two stages through the regenerative heat exchanger and one of the high-pressure non-regenerative heat exchangers. The pressure is reduced in a single stage via one of the two high-pressure reduction stations. In normal operation, a single high-pressure nonregenerative heat exchanger and a single high-pressure reduction station are in service. All this equipment is located inside the reactor building. Isolation of the containment is achieved by two motor-driven valves, one inside and one outside the containment. When the RIS/RRA [SIS/RHR] is connected to the primary system, the RIS/RRA [SIS/RHR]-RCV [CVCS] link is opened to take samples of cooled primary fluid, whose pressure is reduced using a low-pressure reduction valve, to ensure continuous purification of the primary water. In the event of non-availability of the RCV [CVCS] in the Fuel Building or in the Auxiliary Nuclear Building, an emergency letdown line is provided downstream of the high-pressure reduction valves with a line for letdown of primary fluid to the IRWST. b) Volume control tank Whenever the primary system is pressurised, the letdown flow goes through the hydrogenation station. Part of the letdown is directed via a by-pass line to the liquid phase of the volume control tank to achieve uniform boron content. During all the operation phases (in operation or at shutdown), the gaseous phase of the volume control tank is nitrogen. When the primary system is depressurised, the RRA [RHR] pumps must ensure sufficient flow in the RCV [CVCS] line to by-pass the volume control tank, the hydrogenation station and the RCV [CVCS] charging pumps. In normal operation, the flow is directed towards the purification station and if necessary to the degassing station. In the event of high level in the RCV [CVCS] volume control tank, the fluid is directed towards the primary effluent treatment system (TEP [CSTS]).

8 PAGE : 8 / 16 Provided the volume control tank level remains within its normal operating range, the charging pumps draw partly from the hydrogenation station and partly from the volume control tank. The REA [RBWMS] performs make-up upstream of the hydrogenation station and of the volume control tank. The volume control tank is protected from excess pressure by a pressure safety valve located downstream of the tank. c) Charging function The charging pumps are supplied with cooled and purified water with a hydrogen content at the required level. Additional lines allow suction from the IRWST in the event of low levels in the volume control tank. In this case, the hydrogenation station and the volume control tank are automatically isolated. Downstream of the charging pumps, the RCV [CVCS] flow is divided into the charging flow via the charging regulation valve, the seal injection flow, and if necessary, the miniflow of the charging pumps via the automatic checkvalves of the miniflow line. These valves automatically position their disk according to the main flow rate. If minimal flow rate conditions occur, the recirculation flow is implemented to avoid over-heating of the pump. The charging flow is heated in the regenerative heat exchanger and directed towards two primary cold legs. At cold shutdown the charging flow is directed via the auxiliary spray line to the pressuriser. The pressuriser may thus be cooled/depressurised at the desired rate when normal spray is unavailable (in particular at cold shutdown and in the event of RTGV [SGTR]). d) Injection at primary pump seals and leaks Part of the flow of the RCV [CVCS] charging pumps is directed towards the primary pumps after filtering. The seal leak recovery line (single line) for each pump is equipped with a filter and a regulation valve in order to maintain sufficient pressure in this line to avoid degassing of the hydrogen Characteristics of major equipment All parts of the RCV [CVCS] (piping, valves and components) in contact with the primary fluid are made of austenitic stainless steel. To avoid primary water leaks, all pipe couplings and connections are welded except when flanges are required to facilitate dismantling of equipment for maintenance or pressure tests. Regenerative heat exchanger The regenerative heat exchanger is designed to recover the heat from the letdown flow and heat the charging flow. The letdown flow rate considered for thermal sizing of the heat exchanger is the maximum letdown flow rate during heating of the primary system with one or two RCV [CVCS] charging pumps in operation. High-pressure heat exchangers

9 PAGE : 9 / 16 These letdown heat exchangers use the component cooling system (RRI [CCWS]) to cool the letdown flow to a temperature acceptable to the demineraliser resins. Each high-pressure heat exchanger is able to cool all the letdown fluid pre-cooled through the regenerative heat exchanger, in both normal operation and during cooling of the primary system. The high-pressure heat exchangers are designed as 2x50%, to accommodate heat-up of the primary and the high purification/degassing flow rate in hot shutdown conditions. The high-pressure heat exchangers and the regenerative heat exchanger are designed to enable letdown flow without charging (with a limited letdown flow) and charging without letdown flow. The primary fluid flows through the heat exchanger tube side while the cold fluid (RRI [CCWS]) flows through the shell side. Each high-pressure heat exchanger is equipped with two rupture disks (upstream/downstream) in order to protect the RRI [CCWS] from the pressure wave in the event of rupture of a heat exchanger tube. Using the information passed to the control room (activity measurements, temperature and flow rate measurements, RRI [CCWS] tank level measurements), the operator may identify and isolate the defective heat exchanger. High pressure reducing stations The pressure reducing stations are designed to reduce pressure to a level compatible with the design pressure values for purification and treatment. It is possible to operate the two pressure reducing stations at the same time. The pressuriser level is controlled by the high pressure reducing stations. Volume control tank - the volume control tank provides the pressuriser surge capacity: expansion volume due to power increase not included in the pressuriser level setpoints - its volume must be sufficient to ensure continuous flow rate at suction of the charging pump before automatic switch to suction from the IRWST in the event of loss of the letdown flow - it must ensure correct operation of the automatic make-up of the REA [RBWMS] - in normal operation, the gaseous phase of the volume control tank is made up of nitrogen at a pressure of about 2.7 bar, - the tank is connected to the gaseous effluent treatment system (TEG [GWPS]) and to the nitrogen distribution system. The fission gases and the hydrogen are removed from the tank by venting of the gaseous phase to the TEG [CCWS]. Charging pumps - the charging flow rate must be sufficient to offset the following: - the letdown flow rate during normal operation of the plant, load follow operation and controlled cooldown transients; operation of the two charging pumps at the same time is possible - the loss of inventory due to a limited leak - the charging pumps are vertical-axis, multi-stage centrifugal pumps There is a minimum flow rate line to protect the pump

10 PAGE : 10 / 16 Relief valves Safety relief valves are installed on lines and components whose pressure may exceed the design pressure following an incorrect operator action or component malfunction. Each valve must have a capacity equal to the maximum flow rate through the protected line and its setpoint pressure must be equal to the maximum allowed line pressure OPERATING CONDITIONS a) Normal operation General Normal operation of the RCV [CVCS] corresponds to normal operation of the plant: base-load operation and load follow operation. In normal operation, the RCV [CVCS] configuration is as follows: part of the primary fluid flows through the letdown line, the low-pressure RIS/RRA [SIS/RHR]-RCV [CVCS] letdown line being isolated. The regenerative heat exchanger, a high-pressure heat exchanger, a high pressure reduction station and a charging pump are in operation. The letdown fluid is routed outside the reactor building to the purification plant and hydrogenation station. The primary fluid is returned to the primary system via the normal charging line. The seal injection flow to the primary pumps passes though a filter. The auxiliary spray system is isolated. During normal operation of the plant, the RCV [CVCS] fulfils the following functions: volume control, chemical control, purification of the primary fluid. Volume control In normal operation, the mass of coolant in the primary system is kept constant by regulation of the letdown flow with a constant charging flow. According to the plant power level, the primary fluid expands or contracts when its temperature rises or falls. The pressuriser absorbs these expansions or contractions, if the level setpoint changes within limits according to the power level. When the volume control tank level exceeds the upper level, part of the letdown flow is diverted to the TEP [CSTS]. When the extreme upper level is reached, the entire letdown flow is diverted to the TEP [CSTS]. When the charging flow rate is higher than the letdown flow rate, the volume control tank level may reach the lower level, which triggers automatic make-up from the REA [RBWMS]. If this action is insufficient and/or inoperable, a very low level causes the charging pump suction to switch to the IRWST (this is not normal operation). Control of reactivity

11 PAGE : 11 / 16 If power variations arise and the new power level is maintained for long periods, adjustment of the boron content may be required to offset the xenon transient and ensure a sufficient shutdown margin. This adjustment is performed by injecting borated or demineralised water from the REA [RBWMS] via the RCV [CVCS]. Chemical control The purification system can be used provided the letdown fluid temperature downstream of the heat exchangers remains below 60 C. If the temperature exceeds 60 C, the purification station is automatically by-passed. Lithium hydroxide is added by an injection mechanism linked to the charging pump suction to control the ph of the primary fluid. Lithium hydroxide is removed from the system by one of the mixed-bed demineralisers when the plant is in normal operation. The hydrogen content of the primary fluid is controlled by the hydrogenation station, located on the low-pressure section of the RCV [CVCS], upstream of the charging pumps. The oxygen produced by water radiolysis is also scavenged by adding hydrogen to the primary system. b) Cold shutdown During cold shutdown, normal letdown flow through the regenerative heat exchanger and one or two high-pressure heat exchangers operates until the final depressurisation of the pressuriser performed by the auxiliary spray. Provided the primary pressure is greater than 25 bar, the RIS/RRA [SIS/RHR]-RCV [CVCS] connection does not need to be open. When the last primary pump is stopped, the high-pressure heat exchangers are isolated and the letdown flow is directed from the RRA [RHR] heat exchangers to the RCV [CVCS] low pressure reduction station and the letdown portion of the RCV [CVCS] (hydrogenation station and volume control tank). Although the letdown flow goes through the hydrogenation station, no hydrogenation is performed in this plant state. Part of the flow is directed to the volume control tank. From there, the fluid is reinjected into the primary system by the normal charging line (charging pumps in service). The charging flow goes through the regenerative heat exchanger and is then injected towards the charging nozzles when at least one primary pump is operating. Otherwise, the charging flow goes through the auxiliary spray valve when primary pressure reaches 5 bar (when the pressuriser is cooled). During operation at ¾ loop, the system for regulating the level in the primary loops acts on the RCV [CVCS] low-pressure letdown flow regulation valve to provide a sufficient level of water for operation of the ISBP [LHSI] pumps. When the minimum level in the primary loops is reached, letdown is isolated. c) Hot Shutdown The RCV [CVCS] operates as during normal operation. According to purification/degassing needs, the RCV [CVCS] letdown flow may be increased. Depending on the duration of the hot shutdown, it may be necessary to adjust boron content to take account of xenon transients. d) Start-up of the plant The initial conditions of the plant before start-up are as follows: - the primary system is cold and depressurised - the boron content of the primary system is at the cold shutdown value - the RRA [RHR] function is active

12 PAGE : 12 / 16 - the RCV [CVCS] is filled with coolant with a boron content corresponding to that of cold shutdown - the low-pressure reduction valve on the RIS/RRA [SIS/RHR]-RCV [CVCS] line is in service During start-up of the plant, the RCV [CVCS] is used for the following: - filling the primary circuit - providing the required injection flow into the primary pump seals - controlling the volume and chemistry of the primary fluid during the primary heatup Degassing of the primary system is achieved via the RCV [CVCS] by diverting the letdown flow to the TEP [CSTS] to remove the oxygen (mainly after refuelling) from the RCP [RCS]. Heating of the primary system is achieved using the primary pumps. Before the primary temperature reaches 120 C, Lithium hydroxide is added to the charging pump suction to control the ph of the primary fluid. When the chemical characteristics of the primary fluid satisfy the prescribed chemical values, the volume control tank may be placed under a nitrogen blanket, ensuring the hydrogen content of the primary fluid and thus controlling the dissolved oxygen content during power operation. During heatup and pressurisation of the pressuriser, the RIS/RRA [SIS/RHR]-RCV [CVCS] connection is opened when the RIS/RRA [SIS/RHR] is connected in RRA [RHR] mode to the primary system. When the primary pressure is above 25 bar, the RIS/RRA [SIS/RHR]-RCV [CVCS] connection is isolated and the letdown flow goes via the normal letdown system. As the primary system pressure increases, the pressuriser pressure is regulated using the pressuriser heaters and the auxiliary spray; when the primary pumps are operating, the main spray operates. Assuming that a heatup rate of 25 C/hr is taken for the thermal sizing of the RCV [CVCS] heat exchangers, the excess letdown fluid resulting from expansion of the primary system is directed towards the TEP [CSTS]. During the entire start-up phase, the pressuriser contains a steam bubble and the water level is maintained at its setpoint value. The seal injection flow rate is maintained at 4 x 1.8 tonne/hr during this phase. e) Switch from hot shutdown conditions to hot standby conditions. The concentration of boric acid in the primary system is reduced in order to reach reactor criticality conditions. Dilution is performed by the REA [RBWMS] via the RCV [CVCS]. f) Plant shutdown After insertion of the control rods and during the cooldown and depressurisation of the RCP [RCS], the boron content of the primary fluid is increased according to the final plant state to be reached. The REA [RBWMS] supplies borated fluid to the RCV [CVCS] to offset the contraction of the primary fluid and minimise waste. In addition, the primary fluid is degassed to eliminate the fission gases and decrease the hydrogen content. This operation is performed by diverting the letdown flow to the TEP [CSTS] degasser.

13 PAGE : 13 / 16 g) Cooldown of the reactor The initial cooldown is performed with the steam generators and the turbine by-pass system. To preserve a minimum letdown flow rate for purification/degassing and the level required in the pressuriser with a cooling rate of 50 C/hr, it is necessary to offset the contraction of the primary fluid using both RCV [CVCS] charging pumps. When the temperature of the primary system reaches about 120 C, the RIS/RRA [SIS/RHR] is connected in RRA [RHR] mode to the primary system and cooling is performed via the RIS/RRA heat exchangers. When the temperature downstream of the RIS/RRA [SIS/RHR] heat exchangers is low enough and the primary pressure is falling, the high pressure reduction stations may be isolated and the RIS/RRA [SIS/RHR]-RCV [CVCS] connection is opened. Depressurisation of the primary system is carried out using auxiliary spray, diverting part of the RCV [CVCS] charging flow rate to the pressuriser. After final depressurisation of the RCP [RCS], the RCV [CVCS] pumps may be stopped and bypassed. Injection at seal no. 1 of the primary pumps is performed by the ISBP [LHSI] pumps via the purification line when this is necessary PRELIMINARY SAFETY ANALYSIS Brief description of Safety functions The RCV [CVCS] is involved in the following safety functions: The containment is isolated by F1A-classified valves. The containment penetrations of the letdown line and the seal leak return line are each isolated by automatic closure of two motordriven valves: one in the reactor building and the other in the fuel building. The containment is isolated on the charging line and on the RCP seal no. 1 injection line by a motor-driven valve located in the fuel building and by a check valve located in the reactor building, ensuring redundancy of the containment isolation. The possible sources of dilution from the RCV [CVCS] and the auxiliary systems connected upstream of the volume control tank and the hydrogenation station are isolated by F1 means and charging pump suction switches to the IRWST. A boron meter station (four boron content measurements) at the discharge of the charging pumps on a shared section of the charging line and the GMMP [RCP] seal no. 1 injection line is used to detect dilution. This boron meter station is F1-classified. The methods for isolating the RCV [CVCS] from the primary system are part of the isolation of the main primary system pressure boundary. This part of the RCV [CVCS] is therefore F1- classified. If a very high SG level is reached (in the case of SGTR), the charging line will receive an automatic closing signal to avoid overfill and abnormal pressurisation of the SGs. The RCV [CVCS] may be used for borated water make-up during bleed and feed operation following total loss of the feedwater.

14 PAGE : 14 / 16 The following functions of the RCV [CVCS] are F1-classified: - isolation of the containment isolation of the RCPB limitations of the consequences of homogeneous boron dilution charging isolation on very high GV [SG] level Compliance with design requirements Safety classification The compliance of design and manufacture of materials and equipment with requirements derived from classification rules is detailed in Chapter C CDU [SFC] or redundancy The single failure criterion (active or passive) is not applicable, except for the parts of the system involved in F1 functions. However, functional redundancy of the charging function is achieved to offset the lost availability of an active component of the corresponding systems. This means that the charging pumps, boric acid supply and the corresponding active valves are redundant for the boration function Qualification The equipment is qualified in accordance with the requirements described in Chapter C Instrumentation and control The compliance of design and manufacture of instrumentation and control with requirements derived from classification rules is detailed in Chapter C Backed up electrical supplies The electrical powering of active charging and letdown components is supplied by independent trains backed up by diesels Hazards The rules and criteria for protection against internal and external hazards are established in the corresponding paragraphs (see Chapters C.3 and C.4). Internal hazards and their protection principles with corresponding failure assumptions are described in Chapter C.4. Inside or outside the containment, protective mechanisms are needed if the RCV [CVCS] high-energy pipes can cause major damage to safety systems or to the containment. The equipment that can accumulate radioactive material (filters, related piping) is located in compartments with restricted access and radiological protection.

15 PAGE : 15 / 16 Physical and electrical separation are implemented when actuators linked to a safety function (e.g.: primary break without safety injection signal) are located and supplied within one division. For example: the volume control tank requires two isolation valves and each valve is installed in a different building; one in fuel building 1 and the other in fuel building 2. They are also powered from different electrical trains. Based on the same principle, two redundant isolation valves are installed in parallel to preserve the water inventory of the IRWST in the event of CPP [RCPB] rupture without a IS [SI] signal Other requirements This system is examined in the demonstration of the practical elimination of the risk of containment bypasses (see Chapter R.1) SPECIFIC TEST PROVISIONS Within the framework of plant operation, periodic tests, surveillance controls and instrument calibration are performed to monitor the state and performance of equipment. Most components are used regularly, thus the assurance of their availability and performance of the system and equipment is given by the control room and/or local indicators FUNCTIONAL DIAGRAM See I.3.2 FIG 1: simplified functional diagram of the RCV [CVCS]

16 FIGURE : 1 PAGE :16 / 16 FIG 1: SIMPLIFIED FUNCTIONAL DIAGRAM OF THE RCV [CVCS]