 So after having described the some important principle of safety such as the safety function and the defense in depth concept, we are now going to see in some details the deterministic approach which is the way to analyze the safety of a nuclear plant at the design stage. So it is not feasible to study with a lot of detail everything that could happen on a nuclear reactor. So it's necessary to make a selection of typical transients and accidents which are representative of a family of events. And for instance it is not possible to study all the potential size of a break of a pipe. So we will select three representative size of break the complete rapture of the break a small one and an intermediate one. These three studies will be deemed to represent all that would happen in such an accident such as a pipe rapture. And these transients and accidents that we call design basis transients or design basis accidents are used to design the safety system to define for instance the flow of the safety injection system. So these design transients and accidents are studied with very conservative assumption and for instance all the initial parameter will be taken at the worst condition. And very stringent design rule for the safety system will be used such as for instance the single failure criteria that you will assume that any failure could occur on safety system reducing its capacity to counteract the accidents. Also in this kind of study consideration will be taken for common mode failures. And the important design rule also is the quality of the equipment of the safety system that need to be first classified in terms of quality design of quality and procurement but also in terms of qualification because if the system has to operate in an accident environment there should be qualified to sustain this environment for instance in terms of those temperature or pressure. So the design basis events are categorized according to their frequency and consequences and usually we make a distinction between internal events that is failure of the system itself of the component of the plant. Internal hazards such as internal flooding or internal fire or a load drops and external hazards which are the events that could occur outside but that may affect the plant such as earthquake or flooding or fire also outside or plant crash. We will see a little bit later how these hazards are treated. So an important design rule is that the frequency of the accident or transient with the consequences. The rule is that the higher the potential consequences the lower the frequency should be. So we could distinguish several regions. First normal operation here the consequence should be very limited if not nailed. At the other part of the spectrum the accident with potential high consequence should have a very low frequency something less than one in a million year and between them the events are classified according to their frequency and consequence and should remain in this domain. Of course this path is unacceptable. So it's the way that we define what we call the design condition. Include normal operation, transient, accident and sever accident. You have here the estimated frequency of each of these design conditions. Normal operation is something that happens permanently or it's include frequent transients. The transients as could happen once a year or once in a century. The accident should have a probability because we are talking here about probability less than 10 to the minus 4 that is one every 10,000 years and the sever accident the objective is to have less frequency less than one in a million of a year. So the consequence of this design condition of course in normal operation the consequence of should remain in the authorized limit because there is some regulation about the amount of rapid activity that could be released in normal operation and using the ALARA principle that we already mentioned that everything should be done to reduce this release as low as reasonably practicable. For the transients that has this frequency between a period and 10 to the minus 2 the consequence should also remain in the authorized limit. For the accident and there could be some consequences that meet some limited fuel degradation but the containment should remain completely leak tight and no degradation is allowed. And then for the sever accident the objective is to there will be some radioactive releases and the objective is to reduce them also as low as practicable and the design condition as the word means serves to define and to design the various system of the plant. Of course for normal operation you have the main system and they are associated the control and regulation. The transients serve to define the shutdown set points of the various system and especially of the rectot itself that we call the rectotrip that is the control rod falling down the rectocall. The accident design conditions serve to determine and to define and to design all the emergency system including the containment and finally the sever accident consideration and study allows to prepare the emergency preparedness and to define the various arrangement that should be included in the emergency preparedness plan. So these are some examples of design basis accidents which are considered in this deterministic approach. So the first one is a rupture of a main primary piping such as here but also we consider the rupture of the steam line here on the top of the steam generator or of the feedwater line because these events have an impact on the reactivity. I mentioned previously the importance of the steam generator tubes which are part of both the second and the third barrier and so the studies of this accident is something very important because it has a frequency a little bit higher than the other given the number of tubes which are in this component. Other accident study is the ejection of the control rod that will have an impact on the reactivity of the core and we consider also fuel handling accident when the reactor is shut down. Of course the fuel assembly should be removed and transferred to the fuel building and so if there is a drop or loss of cooling of the fuel assembly these consequences should be studied. So these transient and accident studies are a major aspect of safety analysis. They use very sophisticated computer codes with 3D dimensioned modeling of thermodynamics in the major component including the hottest fuel pin because the purpose is to limit the temperature of the fuel. This model includes numerous equations simulating very complex phenomena such as the equilibrium between steam and water and various flow distribution in the various parts of the system. And all these calculations, all these models are based on many experiments, some small scale experiment but also large experiment on of course not a real reactor but facilities that represent most of the major equipment of our reactor. So as an example let's have a look on what could happen in the large break loss of coolant accidents. What are the main phenomena and so let's assume at the beginning that we have an opening of a double handed pipe break. This is the largest break that could be considered on the reactor system and so immediately there will be a very rapid decrease of the pressure. So three seconds after the reactor protection system will let the control rod into the core and so that we call reactor scram so now the reactor is shut down. As the pressure decrease and most of the water and steam inside the system is released in the containment, the pressure riser empties, this is the first component to be emptied at six seconds and at ten seconds now the fuel is no longer cool so the cladding fuel will reach is peak temperature because very soon after the accumulators will discharge. Accumulators are large quantity, large tank with several hundred cubic meters that are at the pressure of 40 bars and that are connected with primary systems through a check valve so when the pressure in the reactor system goes below 40 bars the check valve automatically open and these tanks are discharged in the system trying to replenish the system and very soon after the low pressure safety injection system will be injecting water in the reactor coolant system. At 23 seconds there will be an equilibrium of pressure between what is in the reactor system and the containment and the containment pressure will increase at this point so this pressure will be around three or four bars and thanks to the accumulators discharging and the water injected through the safety injection system the vessel bottom will begin to be a refill and this is the core itself will begin to be a reflux around that time and you will see now on a small video the result of a calculation with the you will see how the amount of water and steam evolve in the system and how the temperature evolve so at the beginning the circuit is full of water as in blue and you see now the water being discharged in the containment as the temperature begin to increase the system is still hunting the steam generator a full of high temperature steam and soon the accumulator will discharge to begin to re-implish the refill the system you know the yeah now the bottom of the vessel begin to be full of water and the mixture of steam and water begin to reach the level of the core now the safety injection system operates and you will see progressively the blue color coming up into into the core so this is how it should be complex to represent all all these elements and all the simulation of these the transient here in this phase complex phenomena with flashing in in in the core with mixture of steam and and water I think we can stop the the movie here so the main safety criteria used for these accident for the this loss of cooling accident the the condition to be a full free is not to exceed the temperature of the cladding higher than 1200 degree C and to limit the oxidation of the cladding to 17% percent of the sickness because then this kind of accident there is the the Zircalari metal of the cladding is oxidized by this mixture of steam and water and so this oxidation reduce the six the sickness of the cladding and reduce this capacity to maintain the the fuel inside so this is for the the loss of coolant accident for other type of accident as 10% of cladding rupture may be allowed and for secondary side brakes that could have some impact on the reactivity of the core the the the criteria is not to return the core to criticality so you have some some elements of the kind of studies that are made at the design stage to ensure the safety of the plant and that the most important accidents the one being these loss of coolant accident which served to design most of the safety system of nuclear reactor