FUNDAMENTAL SAFETY OVERVIEW VOLUME 2: DESIGN AND SAFETY CHAPTER I: AUXILIARY SYSTEMS

Transcription

1 PAGE : 1 / FUEL HANDLING SYSTEM 4.0. SAFETY REQUIREMENTS Safety functions The fuel handling system, whose main role is to unload and reload the core, does not directly fulfil a safety function. This system must be designed to prevent, during normal operation or accident conditions, any accidental criticality, any unjustified exposure to ionizing radiation and any unacceptable discharge of radioactive substances (in particular with respect to the risk of fuel assembly drop or collision) Reactivity control The fuel handling system must be designed to maintain the sub-critical state of the fuel assemblies Decay heat removal The fuel handling system must be designed to remove the decay heat of the fuel assemblies Radioactive substance containment The fuel handling system must be designed to maintain the integrity of the fuel cladding. The fuel transfer device tube is an integral part of the isolation of the containment enclosure Functional criteria Reactivity control During all normal operations performed in the fuel building (handling, inspection, restoration, assembly, etc.), all risks of criticality must be excluded, including in the most adverse conditions with zero boron content in the pool water. Although the fuel handling system is designed to prevent assemblies from being dropped, the sub-criticality of the situation resulting from a dropped assembly into the BK (fuel building) pool (with or without loss of integrity of the assembly) must be confirmed, taking into account the minimum boron concentration required by technical specifications. The fuel handling system must be designed to limit the risk of incorrect positioning of an assembly in the vessel during core refuelling operations. The fuel handling system must be designed to limit the risk due to placing a new assembly in a compartment for underwater storage of spent fuel assemblies Decay heat removal The fuel handling system must be designed to cool the irradiated fuel assemblies.

2 PAGE : 2 / Radioactive substance containment The fuel handling system must be designed to prevent any load dropping or any impact on fuel assemblies in the event of earthquake and loss of electrical power. Moreover, the handling operations must be performed without fuel assemblies being subjected to strains and deformation exceeding their resistance capacity. The containment penetration by the fuel transfer tube must ensure isolation of the reactor building even in the event of earthquake or shaking following an aircraft crash Design-related requirements Requirements resulting from safety classifications Safety classifications The fuel transfer tube, the solid plug and the manual isolation valve must be classified according to the principle given in Chapter C Single failure criterion (active and passive) Although the single failure criterion does not apply to the fuel handling system, certain components of the fuel handling system are designed with redundancy to prevent a load fall if one of these components fails Emergency power supplies Not applicable Qualification for operating conditions Not applicable, except for isolation elements of the fuel transfer tube Mechanical, electrical, instrumentation and control classifications The mechanical, electrical, instrumentation and control classification of safety elements must comply with the requirements in Chapter C Seismic classification The fuel handling system must be seismically classified in accordance with the principles given in Chapter C Periodic tests The fuel handling system is subject to periodic tests which ensure its ability to fulfil its function and which check the state of the components which are essential from a safety point of view. Specifically, the elements that help isolate the enclosure must be tested to check they are watertight following shutdown for refuelling.

3 PAGE : 3 / Other regulatory requirements Official texts, laws, orders and decrees To follow Basic Safety Rules To follow Technical Directives None of Technical Guidelines specifically applies to the fuel handling system Specific EPR texts Not applicable Hazards Hazards other than earthquakes and aircraft crashes have no specific impact on the fuel handling system due to the installation of the system in the fuel building and in the reactor building Internal hazards The fuel handling system must be protected against internal hazards, in accordance with Chapter C External hazards The following fuel handling system equipment must maintain its integrity, with a handled load, under the effects of the design basis earthquake and vibrations caused by an aircraft crash: - refuelling machine - reactor building platform - fuel transfer tube - overhead crane - fuel elevator - spent fuel inspection station - auxiliary crane - manual spent fuel handling tool

4 PAGE : 4 / ROLE OF THE SYSTEM The fuel handling system, comprising equipment and structures, is used for handling new and spent fuel assemblies during normal and unscheduled refuelling operations DESIGN BASES The bases of the fuel handling system design are as follows: a) the fuel handling system is designed to limit the risk of dropping or damaging the fuel assemblies during transfer from one location to another. The fuel assembly handling equipment is fail safe in the event of loss of power b) the fuel handling equipment inside and outside the containment may be stopped on demand c) the following fuel handling equipment is designed to maintain its integrity, with a handled load, under the effects of the design basis earthquake and vibrations caused by an aircraft crash: - refuelling machine - reactor building platform - fuel transfer tube - overhead crane - fuel elevator - spent fuel inspection station - auxiliary crane - manual spent fuel handling tool d) all operations relating to fuel handling are designed to ensure protection of staff against radiation and to prevent overheating of the fuel e) the calculation of the radiological consequences of a fuel handling accident takes account of the general installation of the equipment (structures, systems and elements) to ensure the safety and protection of the general public f) the components that handle the fuel assemblies between the reactor building and the fuel building are designed to limit as far as possible the risk of clogging or blockage. If a blockage occurs, the design must allow the fuel assembly to be extracted manually. g) the following handling equipment is designed either according to the requirements of the KTA 3902 code Design of nuclear plant hoisting equipment or the requirements of the CST 60.C High-security hoisting and handling equipment. - refuelling machine - fuel transfer system (excluding plug, valve, conduit and compensators) - overhead crane

5 PAGE : 5 / 24 - manual spent fuel handling tool - fuel elevator - auxiliary crane 4.3. DESCRIPTION AND CHARACTERISTICS OF EQUIPMENT Description of the system The fuel handling system comprises the equipment needed for refuelling the reactor core, i.e.: refuelling machine, fuel transfer device and overhead crane. The areas associated with the fuel handling equipment are the reactor pool, the transfer pool in the reactor building and the fuel building Description of fuel handling operations The new UO 2 fuel assemblies received for replacement of spent fuel are individually extracted from the transport container, examined at the new fuel inspection station, introduced into the storage pool by the fuel elevator and then stored in the underwater new fuel storage rack. The new UO 2 fuel assemblies can also be temporarily stored in the dry fuel storage rack. MOX assemblies are received under water via the pit handling system for irradiated fuel packages. The new MOX fuel assemblies are individually extracted from the package, examined at the spent fuel inspection station then stored in the underwater new fuel storage rack. Underwater handling is performed using the overhead crane. The fuel handling equipment is designed to handle a spent fuel assembly under water from the time it enters the storage pool to the time it is placed in a transport cask for shipment off the site. Underwater handling of spent fuel assemblies is an efficient, economical and transparent protection against radiation as well as a reliable means of cooling to remove decay heat. The concentration of boric acid in the water is sufficient to prevent any risk of criticality. The reactor pool and the transfer pool in the reactor building are filled with water only during shutdown of the reactor for refuelling. However, the underwater fuel storage pool is permanently filled with water and is always accessible to operations staff. The reactor building and the fuel building are linked by the fuel transfer tube. This tube is equipped with a solid plug on the reactor building side and a valve on the fuel building side. The solid plug is in place except during refuelling to ensure containment isolation. The fuel assembly is transported through the tube in a container using a submerged trolley. Between the reactor vessel and the fuel transfer device, the fuel assembly is handled by the refuelling machine. The fuel transfer device is used to handle fuel assemblies through the tube between the reactor building and the fuel building. After a fuel assembly is inserted in the vertical position into the transfer device container, the container swings to the horizontal position to allow it to pass through the transfer tube on the trolley. Once the submerged trolley has transported the assembly to the other end of the transfer tube, the swinging chassis at this end of the tube swings the transfer container into the vertical position to allow the assembly to be removed.

6 PAGE : 6 / 24 In the fuel building, dry handling of new UO 2 fuel assemblies is performed by the auxiliary crane winch using the new fuel handling tool. Underwater handling of new and spent fuel is performed using the overhead crane. The new UO 2 assemblies are taken down to the bottom of the storage pool using the fuel elevator. Handling as far as the underwater new fuel storage rack, is performed using the overhead crane. The decay heat of the irradiated fuel assemblies in the spent fuel pool is removed by the pool cooling system. After a sufficient decay period, the spent fuel assemblies may be removed from the underwater storage rack and placed in a transport cask to be shipped off the site. N.B.: In the final design, the fuel handling system may be modified to also allow dry handling of new MOX fuel assemblies identical to the handling of UO 2 fuel assemblies. The solid plug of the transfer tube may also be replaced by a valve identical to the one located in the fuel building Refuelling procedure The main defuelling and refuelling operations are as follows: - removal from the core of all fuel assemblies for transfer to the underwater fuel storage rack in the fuel building - changing of rod cluster controls in the fuel building between the assemblies - loading into the core of fuel assemblies from the underwater fuel storage rack The fuel handling system is divided into several zones: - the storage pool is always filled with water and always accessible to operations staff - the new fuel dry storage zone - the refuelling pit located near the spent fuel pool, filled with water during the spent fuel assembly removal phases or during introduction of new MOX fuel assemblies - a zone for introduction of new UO 2 fuel assemblies located near the new fuel storage zone - the reactor pool which is filled with water only during reactor shutdown to allow refuelling - the instrumentation lance pool, always filled with water - the transfer pool in the reactor building - the transfer pool in the fuel building The underwater fuel storage pool comprises two areas. The first is dedicated to storage of new fuel. The second comprises racks placed close together and is used for storage of spent fuel. The fuel storage pool and the transfer pool are linked by an opening; this opening is kept closed by a door and a sluice gate except during refuelling operations. The fuel storage pool and the refuelling pit are linked by an opening; this opening is kept closed by a door except during fuel removal operations and during introduction of MOX assemblies. The fuel transfer tube is closed with a solid plug on the reactor building side and a valve on the fuel building side.

7 PAGE : 7 / 24 The various handling and transfer operations performed during refuelling are described below: The refuelling machine is positioned above the first fuel assembly to be removed. The fuel assembly is raised high enough to pass above the vessel whilst remaining submerged in water, in order to minimise any risk of exposure of operations staff to radiation. The transfer system container is placed in a vertical position by the swinging chassis of the fuel transfer device. The refuelling machine introduces the fuel assembly into the fuel transfer device container. The transfer device container is placed in a horizontal position by the swinging chassis of the fuel transfer device. The conveyer trolley with the container is moved through the fuel transfer tube towards the transfer pool of the fuel building. The container is placed in the vertical position by the swinging chassis of the fuel transfer device. The fuel assembly is removed from the container by the overhead crane. The fuel assembly is inserted into a cell in the underwater fuel storage rack or, if necessary, in a storage cell for defective assemblies. When all the fuel assemblies have been transferred into the underwater fuel storage rack, the control clusters and the thimble plugs are changed between the fuel assemblies using the overhead crane. Refuelling of the core with new and spent fuel assemblies consists essentially of performing the above operations in reverse Description of equipment Reactor building platform The reactor building platform is a removable bridge. It is moved manually above the reactor pool and uses the same runway track as the refuelling machine. Its main function is to allow access above the reactor pool in order to carry out the following operations during shutdown for refuelling: - accessing the hoisting equipment of the vessel cover - manoeuvring the tool for handling the vessel water level measuring device - manoeuvring the handling tool for the instrumentation lances - manoeuvring the tool for latching/unlatching the drive shaft

8 PAGE : 8 / Refuelling machine The main function of the refuelling machine is to handle the new or spent fuel assemblies under water in the BR (reactor building). The refuelling machine comprises a crane, a trolley and a fuel hoisting mast. The gripper, located on the lower end of the hoisting mast, may grasp a fuel assembly and move it in three directions (X, Y, Z) in the reactor pool. The refuelling machine is equipped with a tool to assist with loading fuel assemblies, known as Built-in Shoehorn, or CPI. The CPIs are used to insert fuel assemblies into the reactor and help guide the lower end of the fuel assembly when it reaches the lower core plate. There are four independent CPIs which may be used in all parts of the reactor vessel without rotation of the fuel mast. The refuelling machine is also equipped with the following devices: - a control console placed on the service floor of the reactor building linked to the instrumentation and control devices needed to operate the refuelling machine via a PLC - positioning devices which provide the PLC with information such as the position (X, Y, Z) of the fuel mast - a system for permanent control of the handled load with automatic shutdown in the event of excess load or under-load. In addition to its main function, the refuelling machine performs the following functions: - checking for leakage from fuel assemblies using an onboard sniffing device - mapping of the core (identification and control of the position of assemblies in the core after reloading) N.B.: In the final design of the fuel handling system, the refuelling machine may be equipped with a second mast for handling clusters to allow changing of rod control clusters in the reactor building in the event of partial unloading of the core Fuel transfer device The fuel transfer device is used to transport fuel assemblies between the reactor building and the fuel building and vice versa, through the containment penetration formed by the fuel transfer tube. A container used to transport a fuel assembly is mounted on a conveyer trolley. The trolley is moved horizontally on runway tracks by a rigid pusher chain driven by an electric motor located on the service floor. At each end of the transfer tube, a swinging chassis is used to place the container in the horizontal or vertical position. The fuel assemblies are placed into and removed from the container using the refuelling machine or overhead crane. The chassis is swung by electrical winches located at the service floors and is controlled locally from two control consoles: one in the fuel building which also controls the lateral movement of the conveyer trolley, and the other in the reactor building.

9 PAGE : 9 / 24 During operation of the reactor, the transfer tube is isolated on the fuel building side by a manual valve controlled from the service floor and on the reactor building side by a bolted plug with rapid opening and closing. N.B.: In the final design of the fuel handling system, the plug may be replaced by a valve identical to the one in the fuel building Overhead crane The overhead crane is used to handle the underwater fuel assemblies in the fuel building in moving between the following equipment: fuel elevator, underwater storage rack, transfer system, system for handling irradiated fuel packages from the pit and spent fuel inspection station. The overhead crane is also used to change the rod control clusters. The overhead crane is a crane equipped with a trolley and a hoisting mast. A double gripper, attached to the lower end of the hoisting mast, is used to move a fuel assembly in three directions (X, Y, Z) in the fuel building pools. The overhead crane is equipped with lateral guide rails to help insert a deformed fuel assembly into a compartment in an underwater storage rack. The overhead crane is also equipped with the following devices: - a control console linked to all the instrumentation and control systems needed to operate the overhead crane via a PLC - positioning devices which provide the PLC with information such as the position (X, Y, Z) of the hoisting mast - a system for permanent control of the handled load, with automatic shutdown in the event of excess load or under-load. N.B.: In the final design of the fuel handling system, the overhead crane may be equipped with an onboard sniffing device identical to the one in the refuelling machine. This device would replace the sniffing device in the fuel building with a system with equivalent performance Supervision stations The fuel handling system is equipped with a supervision station located in the reactor building and a supervision station located in the fuel building, used to manage and monitor all fuel handling in the reactor building and in the fuel building. The two stations are connected to video cameras for viewing of handling operations and to the PLCs of the refuelling machine, the transfer device and the overhead crane via a data exchange network. The supervision station in the reactor building is only used during unloading and reloading operations. It is installed during shutdown for reloading and may be dismantled following reloading. The supervision station in the fuel building is installed permanently in the fuel building. During unloading and reloading operations, the two supervision stations are interconnected via the data exchange network.

10 PAGE : 10 / Fuel elevator The fuel elevator comprises a trolley travelling on two vertical rails using an electric winch located on the service floor. It is used to take new UO 2 fuel assemblies from the surface of the storage pool to the bottom of the pool. In repair mode, the fuel elevator can bring the assembly up to the surface for any intervention. N.B.: In the final design of the fuel handling system, the fuel elevator may be equipped with a function for video inspection of fuel assemblies. In this case, the fuel elevator would replace the spent fuel inspection station described below Spent fuel inspection station The spent fuel inspection station is used to inspect irradiated fuel assemblies under water using a video system. All mechanical faults observed can be checked and evaluated to decide whether or not an assembly can be loaded into the core. The station comprises a positioning cell mounted on a revolving plate, a camera mounted on a trolley and two swinging mirrors to examine the top, bottom and sides of the fuel assemblies. The trolley is also equipped with lighting to ensure good visibility. An X-Y indexing system can be used to locate faults. Operations are controlled manually from the service floor Auxiliary crane The auxiliary crane of the fuel building travels along a runway track attached to cantilevers located at the top of the building walls. The auxiliary crane is used during the construction phase to install the main equipment inside the fuel building (e.g.: the underwater fuel storage rack). During the nuclear phase, the auxiliary crane is used to handle the following: - the new UO 2 fuel assemblies - the sluice gate of the spent fuel removal pit or the transfer pool - the fuel assemblies and clusters in the event of failure of the overhead crane hoisting function - the container for transporting new UO 2 fuel The auxiliary crane comprises a trolley equipped with a 20tonne winch New fuel inspection station The new fuel inspection station is used to inspect new UO 2 fuel assemblies above the pool surface. During the inspection, the fuel assembly is handled by the auxiliary crane winch using the new fuel handling tool. N.B.: If, in the final design, dry handling of new MOX fuel is chosen, the new fuel inspection station will be equipped with a camera mounted on a trolley with lighting to ensure good visibility. Operations will be controlled manually from the service floor.

11 PAGE : 11 / Handling tools New fuel handling tool The new fuel handling tool is hooked up to the auxiliary crane winch and is used to handle the new UO 2 fuel assemblies above the pool surface in movements between the following areas: - receipt of the transport container - new fuel inspection station - new fuel dry storage rack - fuel elevator The fuel assembly grasping gripper features a mechanical locking device. Two guiding pins help align the tool on the fuel assembly head. N.B.: If, in the final design, dry handling of new MOX fuel is chosen, the new fuel handling tool will be equipped with a motor to rotate the assembly and allow inspection of the fuel. The fingers of the tool gripper will be activated by an electric motor built into the tool Manual spent fuel handling tool The manual spent fuel handling tool is used for underwater handling of fuel assemblies in the event of breakdown of the refuelling machine or the overhead crane hoisting function. It may be used as follows: - in the reactor building with the auxiliary winch of the polar crane, which has a specific limit of travel to prevent the risk of raising the fuel assembly above the required level, thus ensuring protection against radiation (see Chapter I.1.5.2). - in the fuel building with the auxiliary crane winch The fingers of the tool gripper are activated using a locking control which is built into the tool. The control lever has two spring locking positions: locked and unlocked. A removable pin is used to block the tool in the locked or unlocked position. Two guide pins are used to align the tool on the upper end of the fuel assembly Manual fuel cluster handling tool The manual fuel cluster handling tool is used in the event of breakdown of the overhead crane hoisting function or to change the control clusters and the thimble plugs between the fuel assemblies. It comprises two parts: an upper part and a lower part. The lower part of the square section comprises guide plates perpendicular to the tool axis. The geometry of each plate allows and guides the free movement of the cluster along the tool axis. The lower end is equipped with two guide pins which fit into the upper end of the fuel assembly when a cluster is withdrawn or inserted.

12 PAGE : 12 / 24 A gripper activated from the upper part of the tool moves vertically inside the lower part where it is guided by the plates. The upper part of the tool is equipped with a manual winch with a brake for lifting the gripper (up and down). A control mechanism allows the gripper to be engaged or disengaged. The upper part of the tool is also equipped with a lifting ring PRELIMINARY SAFETY ANALYSIS Observance of functional criteria General provisions Control of reactivity Maintenance of the sub-critical state of fuel assemblies. During all operations in normal conditions performed in the fuel building (handling, inspection, restoration of assembly, etc.), sub-criticality is ensured at the minimum boron content required by technical specifications (K eff < 0.95) and also in pure water conditions (K eff < 0.98). Moreover, the minimum boron content required by the technical specifications ensures a K eff value below 0.98 in the following possible configurations following drop of an assembly into the BK (fuel building) pool: - assembly lying on the rack or between the rack and the pool wall - a heap of fuel rods resulting from an assembly s loss of integrity Prevention of risk of core loading error. The supervision stations help to ensure traceability of movements of assemblies and clusters. All movements of an assembly or a cluster, from its initial position to its final position, are recorded in a movement file. To ensure core loading is in compliance with the plan, the fuel handling system operating mode defines the following steps: the loading plan and sequences for the fuel building and reactor building are previously programmed in one of the supervision stations each sequence (movement of an assembly or a cluster from one position to another) is automatically provided to the loading manager concerned for verification of compliance with the plan after verification by the loading manager, the coordinates of the pick-up and setdown positions are transmitted to the equipment concerned (refuelling machine or overhead crane; these are the orders for the transfer device for the transfer from the fuel building to the reactor building and vice versa)

13 PAGE : 13 / 24 the operators of the refuelling machine and the overhead crane activate joystick movements proposed by the PLCs of these machines to perform the sequence requested by the supervisor The movement is interrupted as soon as the operator stops activating the joysticks in the case of the refuelling machine, the next movement sequence is only possible once the loading manager on the reactor building side has closed the file for the movement in progress. In order to close the file, the loading manager must enter the ID number for the assembly being handled by the refuelling machine. Closure is authorised if the number corresponds to the number given in the loading plan. Furthermore, the supervision stations allow monitoring of the development of occupancy plans for the fuel building pool and the core throughout the course of fuel assembly movements. The supervision stations enable centralisation of information required during handling and centralisation of the means of communication. The refuelling machine in mapping mode allows identification to be performed as well as control of the position of assemblies in the core at the end of reloading. Prevention of the risk of placing a new assembly in a compartment for storage of spent fuel. The supervision station helps to ensure traceability of movements of assemblies. All movements of an assembly or a cluster, from its initial position to its final position, are recorded in a movement file. The supervision station enables monitoring of the development of the occupancy table for the fuel building pool throughout the course of fuel assembly movements. During underwater handling of assemblies in the fuel building, the fuel handling system operating mode defines the following steps to guarantee that no new fuel assemblies are placed in compartments for storage of spent fuel: the movements (i.e. movements of an assembly or a cluster, from one position to another) are previously programmed into the supervision station of the fuel building each movement is automatically proposed to the manoeuvring manager to check compliance of the movement after validation by the manoeuvring manager, the coordinates of the pick-up and set-down position are transmitted to the overhead crane the operator of the overhead crane activates the joystick movements proposed by the overhead crane PLC to perform the sequence requested by the supervisor The movement is interrupted as soon as the operator stops activating the joystick The overhead crane transmits to the supervision station its state and information relating to pickup and set-down of the clusters and assemblies to allow update of the pool occupancy table. If the movement schedule is unexpectedly interrupted to deal with a problem, the overhead crane may be operated independently of the supervision station. However, the overhead crane transmits the pick-up and set-down coordinates to the supervision station.

14 PAGE : 14 / 24 Furthermore, during the phases for loading new UO 2 assemblies in the fuel elevator or new MOX assemblies in the underground handling system, the travel scope of the overhead crane is interlocked in a configuration that prohibits placing the assembly in a compartment for storage of spent fuel. During phases of core reloading and unloading, the overhead crane travel scope is interlocked in a configuration that prohibits placing the assembly being handled in a compartment for storage of spent fuel Decay heat removal Handling of irradiated fuel assemblies and/or their clusters is performed under borated water. This water is cooled by the PTR system [FPPS/FPCS] which enables removal of the decay heat of the fuel assemblies. In addition, it enables visual monitoring of the operations and ensures proper radiological protection Radioactive substance containment The handling system equipment is designed to ensure individual handling of fuel assemblies. The grippers can handle only one assembly and the baskets can hold only one assembly. Interlocks are provided to prohibit the transfer of a fuel assembly to a piece of equipment that already holds an assembly. The design reduces the risk of dropping or damaging a fuel assembly during handling operations. The rules of the KTA 3902 code or the specifications of the CST 60.C (internal design rules) contain provisions for load restart (redundant brakes and cables, anti-drop mechanisms) in the event of failure of certain components of the fuel handling system equipment. The design rules out any collision between fuel assemblies or against columns or other structures during handling operations. The fuel assemblies are not raised or handled in the horizontal position unless they are supported along their entire length. The fuel assemblies are stored in a vertical position. The fuel assemblies are never stored in the vertical position without side support, except when they are loaded into the core or inspected at the spent fuel inspection station. Fuel assembly movements that place the grids of assemblies in contact with other assemblies are performed at very low speed. Longitudinal and transversal accelerations and decelerations, at the start or end of a movement, as well as speed changes, applied to fuel assemblies, are lower than 2 g, gravity included. The axial strain on a fuel assembly that is not supported at the sides does not exceed 4500 N. The axial strain on a fuel assembly that is supported at the sides does not exceed 9000 N. The fuel rods have no contact with the external elements during storage and handling operations. The parts of the fuel handling system, or parts linked to it, are designed to exclude the risk of falling into a pool or onto a service floor.

15 PAGE : 15 / 24 The electrical systems are designed in accordance with the principle of closed-circuit design. All travel limit switches and locking mechanisms are fail safe (positive opening manoeuvre). The safe position is ensured by mechanical components in the event of loss of electrical power Specific provisions Refuelling machine Decay heat removal The following interlocking is required if there is no position available in the core to rapidly place a fuel assembly safely in the event of accidental draining of the pool: the transfer device container is kept in the reactor building in the vertical position. This measure enables the fuel assembly to be placed in the container which is then placed in the horizontal position Radioactive substance containment The refuelling machine is seismically classified 2. Its integrity, including consideration of the load, is ensured in the event of design basis earthquake. The refuelling machine hoisting winch comprises an open sequence chain featuring the following: - a service brake - an auxiliary brake in case of the KTA 3902 design - a safety brake which acts on the drum in the event of excess speed, breakage of the sequence chain or static or dynamic reverses The hoisting mast is suspended by two cables and comprises a balancing system and a cable breakage detector. A travel limit switch stops the mast raising movement at the top limit position. A load cell measures the weight of the suspended load and three control circuits associated with the cell ensure the following: - activate the brake during the upward movement, if the suspended load is more than 10% higher than the normal load - activate the brake during the downward movement, if the load is slightly lower than that of the hoisting mechanism - activate the brake during the downward movement, if the suspended load is 10% lower than the normal value The brakes are designed to close when no longer powered. They close in the event of malfunction of the hoisting chain. A load compensator protects the fuel assembly during normal handling movements in the core in the event of contact between two fuel assemblies. It has the following main functions:

16 PAGE : 16 / 24 - limiting loads applied to the fuel assembly grids - limiting loads applied to the ends of fuel assemblies In a normal situation, the refuelling machine may move horizontally only within a defined travel area to avoid any risk of collision. The travel area is determined by coders and limit switches. The following interlocks are provided: - the movements of the crane, the trolley and the hoisting mast are locked to avoid simultaneous horizontal movements and hoisting movements; however, simultaneous movements of the crane and the trolley are permitted. - outside of the approach or indexing phases, operation of the trolley and the crane is possible only when the hoisting mast is in the top position, loaded or empty. - the winch control systems can only be activated when the position limit switches indicate that the gripper fingers are either engaged or disengaged - the refuelling machine cannot insert a fuel assembly into the transfer device container if it already contains a fuel assembly. - the refuelling machine is interlocked with the fuel transfer device to exclude any simultaneous displacement of the refuelling machine and the fuel transfer device if the refuelling machine is above the transfer container and the hoisting mast is not in the top position, loaded or empty. - the gripper mechanism comprises an internal mechanical locking system that prevents the fingers moving, except if the gripper is placed on a fuel assembly, if it bears the full weight of the hoisting mast, and if the load is nil. In addition, the gripper fingers are mechanically locked (engaged or disengaged). They cannot be activated by an impact or by radial loads. This interlocking acts as a safety mechanism to prevent dropped loads during movement of fuel assemblies Fuel transfer device Decay heat removal The transfer device container has sufficient holes to ensure cooling of the transferred assembly. Tests have shown that cooling via natural convection is sufficient to ensure the integrity of fuel assemblies indefinitely if the conveyer trolley remains stuck in the open transfer tube. Thus no maximum time limit is imposed for non-availability of the system Radioactive substance containment The fuel transfer device is seismic class 1. Under the effect of the design basis earthquake, the stability and integrity of all equipment, with consideration of the load, is ensured. After an earthquake, the operability of the following components is ensured, taking into account the fact that the operations required to perform each movement are performed manually:

17 PAGE : 17 / 24 - conveyor trolley - swinging chassis - swinging chassis winches - transfer tube isolation valve Each hoisting winch of the fuel transfer device comprises an open sequence chain featuring the following: - a service brake - a safety brake which acts on the drum in the event of excess speed, breakage of the sequence chain or static and dynamic reverses The brakes are designed to close when no longer powered. They close in the event of malfunction of the sequence hoisting chain. The penetration constituted by the transfer tube is also presented within the context of enclosure penetrations in Chapter C.5.2. The attachment of the transfer tube to the wall of the internal enclosure of the reactor building is rigid and airtight, so as not to compromise the integrity of the containment. The use of a solid plug and a manual valve as isolation units ensures the airtightness of the tube, which is checked under pressure both in the plant and on site after installation. The leak tightness of the pools is guaranteed at each end of the transfer tube by two metallic compensators. These compensators are welded to both the tube and the supports of the civil engineering structure, which in turn are welded to the walls of the transfer pools. A compensator is also used to make the connection between the transfer tube and the exterior enclosure of the reactor building. The compensators also absorb the differential expansions and displacements between the internal enclosure, which is firmly attached to the transfer tube, and to the external enclosure and the walls of the transfer pools. Each pair of compensators features a leak detection sensor. The sensors deliver the information via an alarm sent to the control room. These two detectors are powered permanently and they operate independently of the commissioning of the transfer device. A redundant translation system controlled from the fuel building may be used to bring the conveyor trolley into the fuel building from any position in its normal travel, in the event of malfunction of the control system. After return of the trolley, the valve may be closed manually to restore integrity of the containment. In the event of mechanical or electrical failure, the fuel assembly present in the transfer device may be transferred to the fuel building and provided to the overhead crane using the redundant translation system or manual controls. A load cell prevents the transfer device from operating if there is excess load or if a cable has lost its tautness. Manual emergency controls are provided. The winches are also equipped with redundant cables to prevent swinging baskets from falling into the horizontal position if a cable breaks. The remaining cable is sufficient for performing the operation required.

18 PAGE : 18 / 24 The swinging and transfer operations are stopped at low speed. Accelerations and decelerations are gradual to avoid impacts on the fuel assembly. Each control console is equipped with an emergency stop which triggers the main circuit breakers if the operator notes a malfunction. In addition to the limit switches, the fuel transfer device is equipped with locking systems that prevent the following: - the horizontal movement of the conveyer trolley when the two swinging chassis are not simultaneously in the horizontal position - swinging of chassis when the conveyer trolley is not in the extreme position on the reactor building side or the fuel building side - swinging when the overhead crane or the refuelling machine is above the container and the gripper is not in the top position, empty or loaded - the horizontal displacement of the conveyer trolley when the valve is closed Overhead crane The specific provisions relating to the overhead crane concern mainly the maintenance of radioactive substance containment. The overhead crane is seismic class 2. Its integrity, with consideration of the load, is ensured under the effects of the design basis earthquake. The overhead crane hoisting winch comprises an open sequence chain featuring the following: - a service brake - an auxiliary brake in case of a KTA 3902 design - a safety brake which acts on the drum in the event of excess speed, breakage of the sequence chain or static and dynamic reverses The brakes are designed to close when no longer powered. They close in the event of malfunction of the sequence hoisting chain. The overhead crane travel area is limited so as to prevent fuel assemblies from hitting the walls of the spent fuel and transfer pools and the loading pit. The hoisting mast is suspended by two cables and comprises a cable balancing system and a cable breakage detector. A travel limit switch stops the mast raising movement above the top limit position. A load cell controls the suspended load and stops the hoisting movement if there is excess load or under-load. The following interlocks are provided:

19 PAGE : 19 / 24 - the movements of the crane, the trolley and the hoisting mast are interlocked to avoid simultaneous horizontal and hoisting movements; however, simultaneous movements of the crane and the trolley are permitted. - operation of the trolley and the crane is possible only when the hoisting mast is in the top position, loaded or empty. - the winch control systems can only be activated when the position limit switches indicate that the gripper fingers are either engaged or disengaged - the overhead crane is interlocked with the fuel transfer device to exclude simultaneous displacement of the overhead crane and the fuel transfer device if the overhead crane is above the transfer container and the hoisting mast is not in the top position, loaded or empty. - the overhead crane cannot insert a fuel assembly into the transfer device container if it already contains a fuel assembly. - the overhead crane is interlocked with the fuel elevator as follows: the overhead crane can only approach the fuel elevator descent axis if the axis is in its lowest position the overhead crane can only approach the fuel elevator descent axis if the overhead crane gripper is in the top position when empty - the mechanism for hooking fuel assemblies is equipped with an internal mechanical locking system This device blocks the gripper mechanism and prevents it from operating except if the gripper is placed on a fuel assembly, if it bears the full weight of the overhead crane and if the load is nil. - the gripper for the clusters is equipped with a mechanical locking system which is automatically activated when the cluster is almost fully extracted from the fuel assembly. In addition, the locking mechanisms are activated (i.e. engaged or disengaged) mechanically. Consequently, they cannot be activated following an impact or radial loads. This locking system acts as a safety mechanism which prevents load drops during the handling operation. - the overhead crane is interlocked with the auxiliary crane to prevent the overhead crane from passing below the auxiliary crane if the auxiliary crane hook is not in the top position when empty Fuel elevator The specific provisions relating to the fuel elevator concern mainly the maintenance of radioactive substance containment. The fuel elevator is seismic class 2. Its integrity, with consideration of the load, is ensured under the effects of the design basis earthquake. The fuel elevator hoisting winch comprises an open sequence chain featuring the following: - a service brake

20 PAGE : 20 / 24 - a safety brake which acts on the drum in the event of excess speed, breakage of the sequence chain or static and dynamic reverses The winch is equipped with limit switches and a load cell which stops the winch if the trolley is overloaded. It also has a manual emergency control. The fuel elevator basket is equipped with a shock absorber mounted onto the perforated base plate. The shock absorber absorbs shocks in the event that the basket reaches the lower limit of the high-speed movement (in the event of a failure in switch from high speed to low speed). The brakes are designed to close when no longer powered. They close in the event of malfunction of the sequence hoisting chain. Slow accelerations/decelerations allow jerk-free movements and shock prevention. Speed is very low when the fuel elevator arrives at the stop. The open portion of the basket is bell-mouthed and the sides are smooth to allow fuel assemblies to be easily inserted and removed. The following interlocks are provided: - no movement is performed in the event of electrical or mechanical failure (particularly in the event of breakage of one of the cables) - except in repair mode, the basket cannot be raised when it contains an irradiated fuel assembly - use of the fuel elevator is not possible when the auxiliary crane mast is located directly above the basket and the hook is not in the top position, with or without load - use of the fuel elevator is not possible when the overhead crane is in the fuel elevator area - the overhead crane may access the fuel elevator only when the basket is in the bottom position and if the overhead crane gripper is in the top position without load Spent fuel inspection station The specific provisions relating to the spent fuel inspection station concern mainly the maintenance of radioactive substance containment. The spent fuel inspection station is seismic class 2. Its integrity, with consideration of the load, is ensured under the effects of the design basis earthquake. The equipment is designed to ensure that the fuel assembly cannot be damaged in any way during insertion, rotation or extraction operations. The fuel assembly compartment features two centring pins which use a visual indicator to help direct the fuel assembly Auxiliary crane The specific provisions relating to the auxiliary crane concern mainly the maintenance of radioactive substance containment.

21 PAGE : 21 / 24 The auxiliary crane is seismic class 2. Its integrity, with consideration of the load, is ensured under the effects of the design basis earthquake. The auxiliary crane hoisting winch comprises an open sequence chain featuring the following: - a service brake - a safety brake which acts on the drum in the event of excess speed, breakage of the sequence chain or static and dynamic reverses The brakes are designed to close when no longer powered. They close in the event of malfunction of the sequence hoisting chain. The following interlocks are provided: - translation/steering movements are authorised in the following situations: no hoisting movement the hoisting hook is in one of the following configurations: in the top position if the fuel handling mode is not selected at the predefined heights for each handling zone at any height within a range of 25 mm around the predefined indexing (fuel elevator, new fuel assembly storage cells, new fuel inspection station, new UO 2 fuel container). - the auxiliary crane hook may be lowered above the elevator basket only in the following situations: the basket is in the top position, and the hook is not handling a fuel assembly the basket is empty in the top position, and the hook is handling a fuel assembly - the auxiliary crane is interlocked with the overhead crane to prevent the auxiliary crane from passing above the overhead crane if the auxiliary crane hook is not in the top position when empty. - the auxiliary crane is interlocked with the new fuel handling tool to prevent hoisting if the tool is not locked Handling tools The specific provisions relating to handling tools concern mainly the maintenance of radioactive substance containment. The handling tools are equipped with positioning and locking mechanisms which allow the following: - correct alignment of the tool with the fuel assembly to be handled using centring devices - correct placement of the tool with respect to the fuel assembly

22 PAGE : 22 / 24 - correct pick-up of the fuel assembly (pick-up authorisation if the centring devices are properly inserted) - complete security of the fuel assembly handling by blocking the gripper finger movement mechanism Compliance with design requirements Safety classifications The classification of the fuel handling system equipment is presented in Chapter C Hazards Internal hazards Internal Hazards Protection required in principle General protection Specific protection introduced in the design of the system Pipe break Yes Location in the BK (fuel Breaks of tanks, Yes building) and the BR - pumps and valves (reactor building) Internal missile Yes BR (reactor building) - compartment Dropped loads Yes Design of handling - equipment Internal explosion Yes Prevention and BR (reactor - building) compartment Fire Yes BK (fuel building) and BR - (reactor building)fire protection Internal flooding Not applicable External hazards The following equipment of the fuel handling system is designed to so its integrity will be maintained, with a handled load, under the effects of the design basis earthquake and in the vibrations caused by an aircraft crash: - refuelling machine - reactor building platform - fuel transfer device - overhead crane - fuel elevator - spent fuel inspection station