 O tema que nós vamos hablar de agora é relacionado a a apresentación anterior. É só para... nós vamos... mas para dar unha clarificación, para elaborar o tema, na parte do escopo, o que são os requisitos. A apresentación ou este tema é also o resultado de unha obra que nós estamos acondáctados na IA e o que nos trouxe bastante debate. En realidad nós finalizamos esta obra do nosso lado mais que unha ano atrás, representamos o draft na conferencia general da IA na última ano, e nós asmos para o comentario e nós tenamos um comentario bastante tarde e tal e nós tenamos o nosso comitario envolvido e os membros estados e tal e nós tenamos tantos comentarios e nós tenamos que discutir unha obra do nosso comitario que non é útile, porque nós só discutimos estas técnicas de protección, non são técnicas de protección. Finalmente, na parte do meu comitario ha sido aprobada na semana anterior e espero que, after that, é só basicamente o processo editorial e nós podamos publicar o documento. A ideia é que, quando nós desenvolvemos estas técnicas, nós introduzimos uns novos conceptos, como o DEC, e uns novos terminólogos para o que non é útile o entendimento. As pessoas non sabem o que entendendo e não todo o mundo entendendo o mesmo sobre este concepto. Então nós tentamos proporcionar unha entendente harmoniza sobre estas técnicas e tentamos explicar unha tópica antes que nós desenvolvemos as técnicas de protección porque, se nós não sabemos exatamente o que significa, que é muito difícil, se non é impossível, nós desenvolvemos as técnicas de protección e senão serão aprobadas. Então, nós iniciamos este DEC e, para adrecer a tópica, talvez o erro é que o DEC considera o aplicación dos requerimentos para o design. Talvez este é o problema que nós chamamos o DEC Hot Topics e Coold Knowledge no DEC e as pessoas não cuidarão muito, mas agora porque nós dizemos que nós interpretamos os requerimentos no DEC e este é o que nós chamamos. Aparte de esta coisa, espero que non se registra e as pessoas passarão isto para o IA, minhas opinas. A ideia era para elaborar os tópicos. Não iremos aquí explicar os requerimentos mas para trazer unha claridade unha tópica para introducir o debate sobre o tópico. E estas são as tópicas que nós adrecemos sobre o que o plan está considerando o design, não só para o reactor mas também para o púl despejado. O que o design extenso condición sem co-degradación e cuyo image. Nós elaboramos o que é a base design do equipamento do plan. Mas algumas pessoas não têm o bom entendido nesta. E nós temos o debate sobre éxito. E o que é a base design do plan? O que é a base design do plan para nois plantas? O depenso de os níveis de base design e o co-degradación de co-degradación. E nós estamos con esta desigualdabilidade do transporte de o ultimo tópico. O que mencionaste antes que nós temos un púl despejado ou un tópico despejado. Nós hablamos sobre este design, marxins e prevención de as efexas que temos de marxins adicionas e etc. E o concepto importante que foi introduzido sobre a eliminación práctica de grandes relíxas algo externo e nós tocamos finalmente este tópico de o uso de mobile, mas não precisa ser mobile e non permanentes para poder e co-degradación. O tópico que tocamos e etc. E eu vou explicar uns dos. Eu não sei quão tempo eu tenho 1,5 horas? Ok. Vamos ver o que nós podemos achar. Eu sei que neste momento serão questiões. Eu vou te preguntar por 2 coisas porque senão nós não serão probos. O primeiro tema é que talvez alguns de vocês han co-degradado no plan nuclear antes, no seu país o rego o etc. Algunos de estes conceptos que nós temos co-degradación aquí e 100% co-degradación co-degradación e etc. Então para o momento co-degradación e se eu digo algo que é diferente para o que temos no teu corpo dê-me a oportunidade para te explicar e não dizer não, não, não, é algo assim co-degradación só co-degradación e tenta entender. Se você não entende algo tu me preguntes e eu explicaré para você. Se você desagree comigo deixe-me no final. Ok? Porque senão o outro co-degradación Allah Caramot Sol entira hele Entipos e não significa co-degradación e co-degradación e tor Glenn E e elaborado, sei lá, no dípo, no dípo. Eu explico aqui o concepto que é o ano, não coloco explícitamente o NSR-1, porque o NSR-1 era, por exemplo, requerido para disejar, também, para o accidento civil. Mas, quando ele veio a aspectos prácticos, instead, ele diría que a consideración seria dita a... e tal. E esta consideración seria dita, en realidad, e, por exemplo, ele não tradutou a requerimento específico ou de recomendación na guia de safesta. Eu ganhei a consideración completa para o que o meu son me dara, mas eu não o fiz. Eu pudei o concepto por isso, mas o que você pode pensar é o NSR-1, o requerimento previsto. Então, nós teníamos, na época, o planto de estación dividido na estación operacional e o que era claro, o que era mantido, e tal. E o accidento de condición é a operación norma. Eu explico antes que, na operación de estados, a operación norma é diferente da moda operación. É algo que definísseis a especificación técnica que te diga full power, low power, hot shutdown, hot shutdown, todo esto é a operación norma. Ou é a operación de estados. Então, nós teníamos, se nonhamos algo que não pode ser controlado por seu sistema control, unha feira, unha deviación, não pode ser arrestada, para a operación norma, nós normalmente iremos na AOO. É o que nós esperemos ver, na operación norma, na AOO. Estas são as xeques que nós pensamos considerando o seu diseño que pode acontecer durante a vida do planto. Para colocar ás xeques, marco, púten 10% e 2% por ano menos frequente. Se xeques, xeques xeques, xeques xeques. Agora, se na operación norma as xeques que têm que responda a estas AOOs, não funciona, xeques xeques xeques condición. Na SSR, na SSR 1, se veis na grafa, o ás xeques condición conveye 2 anos condiciessen sem表 rival e en interna, xeques xeques xeques operación norma na ON-AO E also go for normal operation into an accident condition. Now this is called DBA, Design Basis Accident. And for DBA you define, you design, excuse me, safety system. The small thing here is because when you look at the Design Basis Accident, the way they call it now, there are some accidents that they envelope from others. And this is what they call Design Basis Accident because these are what you take into account for the design of safety system. So we have an accident there, it can be the ejection of a control road or it can be a very small loco or something like this. Sometimes this belongs here, this is a part, it's good you take it into account, design your emergency cooling system, there is something more demanding that for establishing the basis of the safety system and this is what they call this DBA. This subdivision has disappeared currently. It's not very dramatic, I think it was okay, has disappeared. In any way you can go into an accident condition directly like a loco, a steam line break, or you can go into an accident condition because you have an AO and your system for AO fails. Like you have a turbine and reactor trip and you have to cool through the steam generator and you cannot cool. Or if it's in a boiler water reactor or CAC and then what? You have to cool the core so at the end you have to do something like phyramblit or something, you use your safety system, you enter in an accident condition. Ok, so we are now in a design basis accident and in the earlier times this was called the design basis of the plan as a whole. I should not use now this name because they are asking me to change the terminology but everybody was happy with this and this is used in many regulatory documents because this more or less covers the broad spectrum of conditions for which the plan was designed and this is how it was called the design basis of the plan. But we come to the point that this is a misleading concept because the equipment here for DBA for loco is not designed the same as the circulation water here for normal operation. So in reality the design basis is for every piece of equipment but there is an overall concept we call design basis of the plan is a bit misleading. Ok, but let it be there for the moment. Now if we fail to mitigate an accident we come here, we exceed the design basis, now it depends what is the situation. Of course if I have something like a large loco and a low head safety injection or the accumulators fail really there is no grace period. The under core is going to be uncovered and there is not much you can do but in some conditions you have some time, some grace period before experimenting a fuel degradation. So this is the situation in which you exceed the design basis but still you can do something and eventually if you don't do anything or if you fail to do something you are going to melt the core and then you are in a civil accident. Another story is when you say what is core melt and what is core damage and how you define core damage, civil core damage, we have also a debate there. So let's not discuss this for the moment and let's not take this as binary or whatever. Let's imagine that whoever regulator designer establish here what are the, what is the borderline, what are the conditions. If you cross it you are in a civil accident. Now that part was called beyond design basis and what you do here for preventing the core damage or for mitigating the core damage is called accident management. In particular this part is called civil accident management and there you use whatever you have and whatever you can. So but in principle nothing was designed for that. So the containment was designed for a DBA, the containment was not designed for a civil accident and you can use many things, even normal systems, even but it was beyond the design basis. So basically these were procedures, sanjis and so of course the plans have upgraded and have implemented some things and some people put a recombiner, some put other things but the plan is not designed for a civil accident. So this was the early concept and then let me put here, I have some errors now here in addition. Something like this that will bring you from here to there will be called a beyond design basis actually because this is something for which you don't design. I don't take credit of this, this is not going to happen and yeah, it's beyond the design basis. Why is the error there in the middle, the error stopping there? Well, this is for one reason, it is because sometimes you consider that accident a beyond design basis. Imagine that you say, I don't design for a double guillotine last break. I think this was the case of the VBRs even before and there were people who were asked that the VBRs should be designed for the last break. Is this the case or something like this or no? VBR people no? Ok, anyway, no answer, good. So, but it may be the case that you consider something a beyond design basis actually and because your safety system have a lot of margins, maybe it's still possible to stop it there. So that's why I put a double error but it's not very important. So this is the picture of the past now. Oh, another error. It's possible to go from an AO also into this situation. It should not be possible to go there but it is possible and this is why. This is because sometimes for both AOs and for accidents we use some systems or structures in common because it is not practical or possible to have independent systems. And I give you an example for reasons. You are not going to have a different scram system for an AO and for an accident. So you are not going to have two set of roads in the reactor when coming from the top and it's an AO. And when there is an accident you put an alternative shutdown that goes from the bottom or the power supply simply powers everything. There are buses and so on. So the emergency diesels that are there for lots of outside power is an AO. These emergency diesels are also for the case of an accident. So you share things and this is why for many AO you can go there. And the two corresponding examples will be something called ATWS. So an anticipated transient is here, an AO without a scram you go there. So ATWS in the old plant is beyond design basis and also SBO. Good. I think everybody has understood this thing. This is a traditional concept we are thinking and so on. Now we have the new requirements. And the new requirements become very tricky. Very, very tricky. And the first thing is the same so I am going to reproduce. But now we are already having a problem here. You don't see the problem. I have to put it here but I don't think it's actually. When you go into the definitions of the SSR2 last one, now it turns out that accident conditions means accident conditions included in the design. Before here, accident conditions was everything because these were included in the design and these were not. So now accident conditions are accident conditions included in the design. The question is, are there any other accident conditions not considered in the design? And the answer is possibly yes. And it's not going to be seen in this picture. I'll try to put it here. I'll explain. So now the change is that if you take the same as before, now we are going to design for something more. And I will say that the design basis of the plan as a whole has been extended. Well, I cannot say this officially because some countries disagree and I cannot say that. Some other countries agree but some people say no. Principal because they create problems in the regulations if I say that this thing is in the design basis for the new plan. But if you think openly and now you are going to design for something more, so you are extending the design basis. Why? Because now we introduce in the design something called design extension conditions. So you have to be very careful what is this. So in the design extension conditions, these are conditions for which you design. These are accident conditions considered in the design. And there are two types of conditions. Conditions without cormel or without significant degradation both in the reactor and in the pool. And these conditions are optional. In an optional because you design here if you think that the reliability of the safety system is insufficient and you want to add something in addition to prepare the civil accident. I don't know if I'm going to make a mistake or not but I try to write something. So imagine you have these are or be significative of a post-related initiating event and let's see the difference. This is something like 10 to the minus 2 or 10 to the minus 1. So now this is an AO and my AO system has a certain reliability. I put the system to the minus 2 and will bring them to 10 to the minus 2. And then I have a safety system should be highly reliable. And it brings me a reduction of the frequency here. Let me put the 10 to the minus 3 only. So somebody will say, OK, minus 1, minus 2, minus 3, this is 10 to the minus 5. But this is just for an AO and not for the whole plan. So if I put myself for the whole plan 10 to the minus 5, I said for each AO I want to have at least come here with 10 to the minus 6. So I put this and then I said, well, I better implement something in addition and I come up with the design feature for that will bring me there. OK, forget the numbers, but you put here another 10 to the minus 2, whatever. I said OK, it's fine. Good. But maybe the case in which is not necessary because in another AO I have something like this and I have another one that brings me there and then my safety system brings me there. I said, I don't need it. So this is something that I do, I supplement to increase the reliability of the provisions that I have before. And the question is, why is DEC? And it's called DEC because I'm allowed to design with another criteria. Because if I design DEC as a safety system with the same safety class as safety system with redundancy, that means single failure criterion needs to be met. And I have to do, I also apply conservative analysis. Somebody said, well, what you're doing, you are enlarging your safety system, put another safety system. So it will be put in the area of safety system and it will be right. So, and I put you another sample. We talked about the SBO before. So you have a plan with two diesel generators and you have a loss of offset power and they fail and then you have no power. And you know the core will not be uncovered in the next three, four hours and you know that as soon as you maintain the integrity of the seals of the pumps and so on, you have time. Ok, so now for this thing, because there is a great speed otherwise, so you put an SBO diesel to power some essential equipment. So you add the SBO diesel, this is an SBO, this diesel doesn't need to meet the same requirements as the emergency diesel generator. You don't need to have two, you have another consideration. So this is a safety feature for DEC. But imagine that there is one plant, like for instance the German plant, convoy and so on, that instead of having one diesel generator, have four emergency diesel generators with four redundancy. And they have even another four in a bunker there for case of external hazards and so on. And the question is why do I need more? I don't need more, so you design, you decide that you will not design for DEC, you will not design with anything in addition. It's an option, so I don't need it. So if it fails, that's it, I go on the third to Cormel, I buy it. So there is a number of situations that you are not expressing the safety requirements for which different designers design something in addition to prevent the Cormel. And this is technology dependent. And some people install something, and some people install not. So the regulator will decide if the reliability provided by the safety system is enough or not. So in some cases you install something, in other cases not. When you install something, it's a safety feature for DEC. But it is also a safety feature for DEC because you are allowed to design with another rules. Because if you design with the same rules, well, this is another safety system, you are enlarging the applicability of a safety system. So that's why I say that's optional. Or it is not optional, you look for it at all requirements, is now that the requirements say that you do have to postulate core damage. So now they tell you that you have to design for severe accidents. They don't tell you what are the initiating conditions here for which you have to design. This is something to discuss. I don't think it's very complicated. But you have to postulate some severe accident conditions for which you design. And what you design? You design your safety features for severe accidents. That means the safety features for the containment. The containment research, the component cooling of the containment, the core catcher and so on. Because the ultimate goal of these safety features is to prevent enlarge or release. Because we have said that this needs to be practically eliminated. So the question is this is what we now will call beyond design basis. But I said this terminology is not accepted by some of our member states. And they are asking me and I'm doing a set of calling design basis. I'm calling the plan design envelope and beyond plan design envelope. I didn't have time to change it here, but I think I changed it in a later slide. So that's the story. Now the problem is that there's still maybe some beyond design basis action. Something for which I have the, it may happen, but I have no design. You don't see this slide because accident conditions in reality means accident conditions considered in the design. There may be some that are not considering the design. And that's why I tried to put it here. Because you still may have something for which you come here. And there is no feature to mitigate this accident. So you're still doing accident management. If you come into the point in which you melt the core, then I assume that even for this beyond design basis accident, the safety features for civil actions that are mandatory will be useful. Ok. So I think you are quite confused already. I forgot the last square that comes from this need for practical elimination. So at the end you have to demonstrate that you practically eliminate this thing. But I also have been asked to remove this from my tech talk. So you can remove it from the screen you have not seen. That thing was about a confusion because people don't understand that it is different design basis from design basis accident corresponds beyond design basis accident from beyond design basis accident from beyond design basis or so on. It's for clarification. You have a question. Tell me. There is no deck there. There is no deck. Well, I think the concept match together the question because the question is that we have include this thing now here but we have not said what are the design rules to be applied and what are the codes and what are the safety class and what does it mean because I can tell you this is the safety class for, I don't know, a hydrogen recombiners. So what do you do with that because I know if you tell me a pipe safety class 2 I know what does it mean. And I go to the ask me code and I know what does it mean. Now we have introduced things but now what design rules to apply this is now this is another story. We are now at the level of the concept but you have to forget the old plans. The question is now that this is now part of the design. It is called deck because you design for that or I'm going to put you in other way. A civil accident is not necessarily a deck. A deck without cor mail is a civil accident but not vice versa because here you have a civil accident for which you have not designed. When we talk about then they also we have, I will come later, what is deck and what is not because also people have different understanding. I mean let me continue and try to see if we can bring some more clarity. That's another story. We also put it in tech talk. We are not here the regulator to say what are the acceptable criteria for AO for DBA and so on. That's another story and I understand. For everything when you design you need criteria but let me for the moment know and don't enter in which is the criteria. So this is just the definition that you can find in the requirements and the thing that I already explained to you. It's not very well articulated and so I try now not to go into the definition and try to explain what is the concept. To say something where this comes from this was first introduced by the European utility requirement to define some condition sequence by some whatever determinist and probabilistic that go beyond design. They don't call beyond design. Basically called beyond design. Basis accident but conditions include complex sequence, civil accident and so on. So this was the first time that we implemented. Then when I was not using this, when raise the Western Association of Nuclear, Western, Western European Nuclear Regulators, blah, blah, blah. So now they are also using deck and they are issue a booklet on deck. WENRA use something on deck even before they were not using now the problem is that the IA cannot be different from WENRA because WENRA already took a position that we are always waiting, waiting, waiting to meet the criteria of everybody. And then to say something that I mean it's not that we are very different from WENRA but you know they were now establish something and they want the IA not to be different. Then he something say not completely new, the concept. This SBO 80 WS rules or something like this was already some known problem and it exist for this is the 80s or something. But the question also whether this is deck or not because you can put any of these safety features in your plan but this doesn't mean that your plan is designed for design extension conditions. When you design then you have to meet this criteria that you telling me, you know, for both preventing core damage and for the other. So the fact that you put the hydrogen recombiner in your plan doesn't mean that your plan is now designed for civil action. You have something but or because you put a diesel generator. What can be the list of design extension with core damage that can be used in the design. At the IA the requirement doesn't put anything we saw what is put by WENRA, what is put by it. We came up with some list and I say generic. I mean generic means you know you choose whatever because this is design specific except for SBO. SBO by the way is where recombiner SBO was in the standard but I think everybody has agreed already in SBO. So we put this thing and then we start getting plenty of comments. We are not saying that you have designed for that but so but these are things that we see from different organizations and from designers and so on. So total loss of it what look out together with a complete loss of any CCS and so on. You have always here you see an initiating event with the failure of a whole level of defence in debt at the level 2 or with the failure of a safety system, a complete loss of one CCS system. So they are always entailing multiple failures on or steam or even some complex PIEs or a PIE leading to another thing like a main steam light break inducing a steam rupture. So what we collected we are showing the different designs or what they call what they have on something. So when you start thinking and see what these people actually do for those things and we come into another point. So this was this is just a slide I will maybe not this. We say 6, but then we said to finish 6, 5, 15, one hour. That is just to make this point between the difference of this concept of the design, the design basis of the plan as a whole concept, you know. But that in reality is not very accurate because each individual component it has its own design basis and this is clear and also in our requirements. So the design basis of each component it has a set of information or specifications that establish the needs and requirements necessarily for the design of the component in terms of the functions performed by this operational state has to work, conditions generated by standard standard has to withstand and appropriate access to criteria for reliability availability functionality and so on. So the design basis is specific for each component. The thing from the whole plan is an overall picture, but not everything is designed for the same. And here I have another slide that you have pricing from Markov and now it's animated because I do animations that is going to explain you this concept. So you have the conditions that you have seen before and now for these conditions you have equipment that operate under those conditions. So you are going to have equipment for AO and for normal operation and you will have to establish the design basis for equipment of operational states. And there's going to be equipment for DBA, these are called safety systems. So this includes the safety systems SSC that are necessary to control DBAs and I put some AO this overlapping here because as we mentioned before there is something like the reactor scan, the emergency power supply that are for both because it's not practical or possible. And then we have the safety features for deck. You define the conditions, but defining the conditions is not everything. Now you have to have systems for this condition because otherwise it's not deck. It's deck because you design for them. So when you design for them you need to have systems and components for deck and you have to establish the design basis of them. So you have design basis for equipment to prevent, core damage, as I said this can be optional, preventive part and then you have the design basis for mitigating. This is basically the design basis for the containment and the containment systems. Now of course the containment is also used for DBA, but it's designed as a safety feature for deck. So it means the design basis for this containment will come now maybe more, let me continue with the animation. So when you design any of this equipment I cannot make you know fragment the things at the time. But this means that for designing this I need to be taking into account the conditions generated by internal and external hazards. If I need them to survive. Also the same from here. And I need to take into account for each of the equipment criteria necessary for functionality, reliability and so on. Of course the criteria are not the same. The reliability for a safety system is not the same as the reliability for a normal operation. And the same also to the need to withstand external hazards. Here I don't care if it fails I have a scrum, but here I don't want a safety system to fail. And remember that some of those things we have also said that we don't we want to have even more margin. So that means that doesn't mean that these conditions apply equally to everything. So when I come something I say as the containment the containment is designed for both DBA, but it is also designed for the conditions of civil action. So it's more demanding so I cannot put everything in the same slide. It becomes very complicated. This will be called now I change not design basis anymore design plan design envelope. And this will be something beyond the envelope that I want to practically eliminate. And beyond and so on. And here the conclusion is there's nothing designed for those conditions. Because if I would design for something I will be here or there or somewhere. So here you don't design. I have been asked to remove this part. So this part will not also not be detected because some people don't want to see. Now it comes to the level of defense in depth. And I need to take some water. I explained you many people explain you the levels of defense in depth. I'm not going to explain you. This is the inside level of defense in depth. We also change a bit of the meaning because you see here for instance control systems are here. But you know this is an AOO so the control systems are necessary for the level one. Because if you plan without control system will will will not prevent an AOO. But so inside it's not perfect. There were some things here and then at the end the table put control system but it is not there. But it was used to use to establish our terminology. And this thing SSR to slash one the requirements are in spite on this but it's not the same. It cannot be the same also because now we have introduced take and so on. So in SSR one, ok, something else. INSAC does not make a direct association of the levels of defense in depth with the plan states. You can think of this because you are saying here control of accidents within the design basis. Control of civil actions. Well this looks to me you know that I am here in a civil par condición. So it doesn't make an association but you can understand this association but it is not made by INSAC. Now it's practical not totally necessary but practical to have this association. And when we make this association we run into problems because some people see different things from the others. So let me try to explain something in SSR one. There is level one associated with normal operation. And I put something there that is going to disappear because in level one it is not only. Of course if nothing fails you are in normal operation but in the level one of defense in depth. You see something like citing like high quality in the manufacturer in the fabrication in service inspection. There are a number of things there that don't only apply to equipment for normal operation. You want to have high quality in the equipment for safety. So this if you want the level one of defense in depth we have a level zero as well. This is a cross cutting thing. This is everything you do to prevent failures. But of course it's nothing fails then I'm in normal operation. Yes but so it creates a confusion but since this is not my topic now in the next thing this part disappears. But you have to understand that when you read level one of defense in depth there are some things there that apply to all the equipment. Not just to equipment for normal operation. Then we have level two is easy to associate to AOS. Then we have level three it was easy to associate in SSR one to design basis accident. This was the unknown it was beyond the design basis so it was level four either severe or not severe accident. And now we have the new situation and what we do now. And here we have a problem and so at the end we do it in one way. We were asked to do it the other way. When we did it the other way we say we go back to the first way because people changed their mind. And at the end we are presenting the two ways and say you make your own choice. I have my own opinion but I cannot give you my own opinion in the paper. So we have two options. Level one, level three, level four. They subdivide for A4B. The terminology is not in our standards. This will be the option of some countries. I can tell you this is considered by the US, Canada, Japan and so on. And this was another option that it is more used in Europe by Wenra. In which level three includes all the features to prevent core damage. If you read carefully the requirements of the IA, the level three of defense in the way it is described there, the objective is to prevent core damage. And so it looks like it was in the line of Wenra. But I cannot take part on this. So we have two options. And then the question is who cares. This is a matter of terminology. I think this option is consistent with the prevention of the barriers. Because here you have the integrity of the fuel and here not. This option is not consistent with the status of the barriers. But here it is consistent with the use of different rules for design here and then there. Because here you have to use the conservative single failure criteria and so on. Here is not. This is not the case. Here you have different rules in the same level. The important thing is not if you call 3A, 3B, 4N, 3 or 4A4B. The important thing is which rules, which acceptance criteria are you going to use for design those things. This is a problem to resolve that it is not yet resolved. So now I have a picture that looks like this. I think Marco presented to you. The difference is here. Some countries say 3A, 3B. Some of the people say 4A, 4B and 3. And as a difference with Wenra, with Wenra, excuse me, with INSAC, instead of putting all the essential means together and so on, we have a more clear specific. We put now safety features for that. And we distinguish between means for design and means for operation. Because defense in depth is not only design. And if you see also here you have for example the technical support center, which is now required for corn melt. You can use it before, but it should not be necessary for here. So now that's the thing. I don't know. OK, I'll try. We also give some consideration of what does it mean, the level of defense in depth for the spin fuel pool. Because we didn't see it somewhere else and it's interesting. So in spin fuel pool, as several designs, we try to make the same approach. And then you say, OK, normal operation is level one. This is what, like with the reactor, nothing fails. Use all this high quality conservative design and everything. In reality you use this for everything. So you try to prevent any failures. Level two, what is level two? Level two are credible failures that you expect to happen during the life of the plant. So you may think in a malfunction of the cooling system. Small leak perhaps. I don't know. The loss of offside power because so that's your level two. And what you have for the level two? Well, actually what you have is time to recover the power. You have also emergency power. Sorry, I was thinking about the level. You have emergency power that is also for level three, as we said before. And you have to lose the cooling. You have time to reinstall the cooling. There is normally not an alternative cooling for level two. You have some anti-cyfring devices, something like this. But in case to avoid that this thing is empty, this is a small leak or something. I also put a malfunction of ventilation system, forgot to say. So this is basically level two. But you don't have particular provisions there more than the power supply and so on. So normally there could be an alternative cooling. When you go to accident, then it's also the thing what is an accident in the spin fuel pool. Because we found out that for many spin fuel pool designs there is not a safety system. So for a DBA for an accident you need safety systems. So what happens here is that very often the plants design the normal operating system for level one as a safety system. It has the same safety class and it's also redundant. And it's powered by emergency diesels. So you don't have a safety system. You have a normal system that it is designed for safety system. Well, excuse me, by the way, I cannot have a document that is playing all the time with the two terminologies. So I use the first one, 3A, 3B and 4. So 3A means deck, DBA and 3B deck without core damage. So here the point is that when you have an accident it's time available to recover the cooling and so on. And if it is not possible then you may be handling this as a deck if you have something in addition to cool. So one accident that can be postulated here is the drop of a fuel element in the pool, the break of the fuel element. Because this, of course, provides, produce a release of a radioactivity. This can be a design basis accident for the design of the ventilation. So this could be a design basis accident. Now deck without core damage you can postulate the SBO. You have an SBO diesel for the plant. Normally it's the same SBO diesel for the spin fuel pool. So it will be a deck but not specific for the pool as for everything. For the loss of cooling so that the deck provisions could be an alternate cooling system or means to refill the pool. And in fact there are some designs that have the normal system and then they have another alternative just one single pump. And they say well why don't you call this pump the safety system and you call it deck. I call it deck because this pump actually is not designed with the criteria of safety system. It's curious but what is designed as a safety system or with the criteria and the quality and the norms of the safety system is the normal operating system. So if you have an alternate pump this could be deck. And the last part which is more interesting is something that this would be deck with fuel damage. This has to be practically eliminated. You don't design for that. You don't design for the melting of the fuel on the pool because it's very difficult if not impractical. So if your fuel is uncovered and start melting oxidizing the cladding have a circular fire or something like this. And so in the oxidation then then it's going to go down in the pool. It's going to penetrate the liner. The pool will disappear. You don't have something like a spin fuel catcher. So if the pool is outside the containment there is no containment on both sides. And even inside the containment you cannot imagine what does it mean. So in reality you design to prevent the spin fuel pool break. So I don't want to maybe to spend too much time here but we give consideration also to this. What is the defense in there for the spin fuel pool? So there is no level four of defense from the spin fuel pool in our understanding. No. There comes the idea of this independence of the levels of defensive depth where it has to be as independent as possible. I already mentioned that the full independence is not possible because the operator is the same. The earthquake shake the whole plan. You don't have a two scramb systems for different for AOS and DVA. The containment is for DVA and for DEC. So there are things that make this full independence impossible. So independence has to be understand as much independence as possible. But there are things you can do and it's not to share many of the systems for normal operation and for action. And this happens in all the plan and design is still in some designs. So in particular we have a requirement that for design extension condition this is something new that you are here. So what you are here is ridiculous that it is the same as from here because then there is no independence. So actually I didn't mention but we call safety features for DEC when you have something specifically designed for DEC or you upgrade some normal system to be used for DEC and then it's not any more designed as AO but as DEC. And I think maybe I finish and because there will be questions we can also discuss some of these conditions. Then so this DEC was looking up this independence of the levels and so on. Particularly there is one there are some points in which this independence is important and which is seen that sometimes is not given. One is with a cooling system. Sometimes you have systems for normal operation and for accidents being the same. Like component cooling water system in some design they are using. They are using the late long time of the CCVCS and also for the cooling of the seals of the main cooling pipes and so on. So this is non normal operation then is also for the cooling of the CCVCS and so on. And there are also sometimes other things that in the instrumentation so on. So they were focusing on those things so the important thing is to achieve this independence. I don't have time to go in this thing but in the tech doc we go in some details on the independence of the instrumentation on the IC systems. Because sometimes we want to have full independence but in reality also there are limitations. You don't want to have holes in every part in the primary systems to have individual measurements here and there for the sake of independence because they introduce some other problems. We give there some advice about sharing and not sharing. And basically so say maybe here in general that to prevent common cause failure each level has to achieve its own unnecessary level of reliability. And that you have multiple levels of the defense is not the justification to weaken the efficiency of one versus the others and so on. So we were dealing there with common cause failures. They need to be either prevented or it's not prevented to be media likely. We don't give there a recipe a prescription this is what you have to do for the common cause failure. What we basically do is there we tell you these are the ways of which two redundant equipment can fail at the same time. One thing is that you share the support systems or systems you know are affecting here and there. This should not be done. You have some sometimes common system interface. You may have components having multiple functions for different levels. I mentioned this core cooling for instance. Excuse me component cooling water. This is used in normal operations in some design and DBA and so on. Operator errors of course. And then there is something if you get rid of those things there is something that people normally call common cause failures. That it is in a more strict sense. It's also seen on the PSAs where well. We have also the impact of common external internal hazard. This is what people also think very often common cause failure. But then there's all these errors in manufacturing errors in construction or design and so on. Then also inadequate practice in maintenance all these things you know can affect redundant equipment. So what we say here is there are several root causes. You have to understand what are the root causes that can affect your redundant equipment. You have to understand also how sometimes there is a root cause but it is not evident. It doesn't lead to a potential for a failure. It's something that it is there. There's a design error and I don't know. Sometimes maybe the design error is there. The pump is not designed for I don't know. Let's say very low temperatures that you don't expect some tubing or some pump. So the error is there. But it's not going to happen unless you have a very cold weather. So you have a coupling mechanism. It's not necessary to go in the details. But when the root cause and the coupling mechanism come together. You have the potential you're going to develop a common cause failure. And at this point is where you have adequate defensive measures and the defensive measures are different and are adequate for different root causes. So you have adequate quality assurance practices proven design and construction physical separation redundancy diversity several types functional and technical diversity and so on. So automatic announcement of failures as soon as something fails you get an alarm and so on. So not all of these works for all of these. So the physical separation of course helps for a fire. But maybe doesn't help for something else for an event as error or vice versa. So the redundancy is not always the diversity is not always the solution. So what we say is you analyze the root causes and then you think of the defensive measures and you choose what you need. But there is not much science on this. Now I will skip maybe that thing to be able to come to more quickly to an end about the important thing is that to the same possible is the message. You have to preserve the independence of the levels of defense in that because otherwise they are not efficient. So you have to be looking at how to prevent this common cause failure. The most important thing maybe is not to share equipment what is not strictly necessary. The cliff edge effect is something also we will discuss. We are saying here that they should not identify issues in which we define a cliff edge effect. Well maybe this is a small cliff where you know you are here and then all this have to make a small step and this cliff is very small. But you understand was a cliff so that means is that sometimes it should not be a small deviation. A plan parameter that has unpredictable strong consequences just because so so the design says for the identification and privation of this cliff edge effects. So sometimes you cannot prevent the cliff edge effect but you can have a margin to the cliff edge effect. So this was very largely discussed after Fukushima. So we try to discuss on those things. Of course we were thinking what is a cliff edge effect. Everybody understand that if I am producing hydrogen after a civil accident and I am not in the detonation regime. There is no detonation then a bit more and the detonation regime and if the plan is detonate the containment breaks. Well it is a cliff edge effect. I can put maybe some other example. But does not always necessarily consider the cliff edge effect the break of the containment. So we said ok maybe this is a big cliff but there is a small cliff at this one that I do something more and I have a loco. So we also said have a look at exceeding some parameters that will lead to the break of one of the barriers or the loss of one important safety function. So the goal is to prove that because the cliff edge effect may be still there to make sure that you have sufficient margins. This is a guy that a consultant of the IEA very experienced in cliff edge effects and safety margins. We call him for consultation. I don't know if you know him. You know him? Ok. It's called while eco yote or something like this. I remember when I was a kid. Well the margins for that we said that we need to ensure margins. So the question is what are the margins and how we define the margins for that we also try to to establish how it is. And we are thinking that the loads that affect that could be defined in similar ways as for DBA. But the best estimate could be approached for determining the action scenario and environmental conditions. You know what happens is that also when we are dealing with civil accidents the use of conservative assumptions may be counterproductive. Because it is you can come into a non realistic observation or observation understanding of the phenomena that is going to happen in the prediction of the accident. The requirements don't make a substantial difference between deck without cor mail and with cor mail regarding the margins and regarding the uncertainties. We understand that for decks without cor mail is something that while the picture is gone but we design here in addition so we call it deck but we still have not mailed the call so the uncertainties here are comparable more o less comparable as uncertainties in DBA. When we come here we cannot say the same about the uncertainties we know the uncertainties are larger. And so we are requiring then because margins are there to compensate the uncertainties. So and we are requiring margins even now the margins are always to prevent cor mail but we want more margins to. Against external hazards against external hazards to for those equipment that ultimately prevent the last or early radioactive releases and they come to the point what are those so and changing the slides are not in the correct order. Well we were thinking of course for preventing the last release we definitely have the containment and the containment system and instrumentation system. We were thinking well you need also the control room the technical support center. We were putting the list of equipment that we understand have to have this larger margin. Some people agree with some some people not and so on. I miss one slide I don't know why because I have been putting hidden slides to make the presentation short. Maybe that's the reason I'm coming to this part of the practical elimination. We introduced this topic in this last one saying that the possibility of certain conditions people look very much at certain conditions occurring is considered to have been practically eliminated. It is physically impossible for the conditions to occur or the conditions can be considered with a high degree of confidence to be extremely unlikely to arise. It's very easy to say. The question has to do. Is this new? In reality no. This you can see already in SAC 12 in the 90s, 1990. And it was introduced in the IE safety standards for the first time at the level of the safety guides for design on the containment in 2004. Now it comes the play with the certain conditions because in reality I don't want to confuse the people. You want to practically eliminate last or early releases. When people say well for practically eliminate the last or early releases you have to eliminate the conditions that little practical releases. And we are in this thing and say well these are the conditions and these are not the conditions and the rest they call residuaries. So then we have a debate in this and next week there's going to be a meeting of Wenra. They have a working group on this. Well I don't know I try to explain you a bit what this we're talking about. These are hypothetical accident sequence that could lead to an absolute release due to containment failure that cannot be resolved or mitigated by implementations of some technical means. This is the understanding. So they are thinking about something for which I cannot design and for something I cannot design I have to practically eliminate. And then we start thinking what is this. So then also the practical elimination as a whole as a concept. It has to be also understood globally. So you want to practically eliminate the last or early release. This is a result of a whole design approach. So the practical elimination does not occur here just because I put something for the containment or the containment catcher or something like this. It is very unlikely as I said the practical elimination because of the result of everything I'm doing here. So you see the frequency and coming there and I'm making those conditions already very young. This is just the core male but the release will come later so I'm making it very practically eliminated. I don't know if I have to cross the line or not. I think just have to cross and they've not done make it so. So it is the result of everything. Good. So let me see. So these things that we practically eliminate here. These are rare because of everything I have done there before because a core male accident is rare. Even though it happened Fukushima we assume still is rare. OK now what would what to do and what are the conditions and how to evaluate. So we say is first let's identify what are the conditions to be practically eliminated. Then we identify what are the provisions for this design for this act for these conditions and then we say how you can do make the assessment. So the first thing is OK for the practical purpose we let's group the conditions in this manner and we put here the first thing is events that could lead to trón reactor damage and consequently early containment failure and here we have two categories. One is the failure of a large component reactor cooling system. Primarily the reactor vessel but also could be the pressurizer steam generator. I don't know if they will be. I'm not especially in this domain but some people say well if you really have an explosion of a pressurizer the containment will not hold. I will not enter maybe the debate but imagine the vessel. The vessel should not break. If the vessel breaks there is not much to do. Other thing will be an uncontrolled reactivity action. Of course if you have a reactivity excursion in the core you know what happened. So this is one thing so this will be a prom reactor core damage early containment failure very fast. Second thing are civil accident phenomena which could lead to early containment failure. And these are phenomena for which you cannot design basically. You have a direct containment heating as a result of high pressure core melt ejection. You have a core melt at high pressure. You have a large steam explosion. There you can debate if some containment can resist the steam explosion. Some we know it can something but how large is another topic that we put here so you try to prevent it. And then the hydrogen detonation. Is it possible? Maybe it's possible. I don't know. But it is very difficult to design a containment against hydrogen detonation. So the best thing is to practically eliminate the hydrogen detonation. And then you have another civil accident phenomena that can lead to another late containment failure. And here you have molten core concrete interaction. So if your core penetrates the vessel goes there sometimes penetrates the containment. That's it. And if you lose the containment heat removal system eventually heats up and so on. So those things you have to do. And then there is a civil accident with containment bypass. You have a different civil accident and for whatever the reason of the sequence. I don't know imagine you have a steam generator through wraps or something like this. And the containment is bypass. So then that's it is going outside. And last we put the significant few degradation in the pool. We said before we don't want to have the pool melting. So these are the things we identify. And then you for each of the things you said what I can do. And well I will not discover in the wheel. But for the vessel basically you apply the asme code in a short manner or whatever you use in your country. So the failure of the vessel evaluates the events in that concept because there is no level 2, level 3 or something. You go from level 1 to level 5 period. What you do there? Well it is about robust design. The selection of the best material suitable composition. The default free fabrication, manufacturing all these type of things. Control of the vessel, pressurized thermal shock. You have to minimize all this effect. That's why I say you apply the asme code. So this is basically a strong robust design. We are saying those things basically that you have a high confidence is not going to happen. Of course there is something sometimes some reliability fracture mechanics. There is some demonstration that you can do expensive though into the domain of the probabilistic. We don't want to call this. Some people say this is not PSA but it is kind of a probabilistic assessment. But the role of there is limited. I actually mean you can do whatever you want with the PSA. But you have to implement those things because otherwise you can decide. So here what you do you apply the adequate codes and code and all these provisions. This is the way of the justification. The next one. What is that one? Ok. So I put here. Maybe I have a problem with the order of the slides. So I'm pressing the wrong buttons. Let me see what I have here. Well whatever possible of course you use the from the two possibilities low likelihood and impossibility. You go for the impossibility but the question is not always impossibility is not always the most cannot be demonstrated. One thing is the intrinsic coefficients of the moderator fuel and so on. So there is not going to be a power score and that's good. Sometimes the hydrogen concentration and so on. So that you do it by eliminated by inner containment or by the recombiners or something or not to reach this concentration. Otherwise it has to be on base on low probability. But we call low probability online because I mean it is not impossible to say it's low probability. So for me that means probability but this for many people doesn't sound good. When you say probability in reality it's probability but associated to a strong design measure. So just to make sure that the probability is not that you pull out numbers probability based on some strong justification of deterministic of engineering the design. Let me see because I thought I have some of the yes. So I have here some in summary maybe some cases of all this other phenomena. We have the hand in the donation so you can rely on very large containment volume in the atmosphere adequate number design of recombiners. That's what you do. High pressure core male ejection direct containment heating. What you have is normally the demonstration now goes that many designs are implementing a diverse system for depressurizing the vessel. If you can't prevent the core melt before it melts depressurize the vessel you don't want to have the melting at high pressure. So there you can use the peer you have the system has to but you can use the PSA to assess the reliability of the pressurización system PSA is useful for that containment by pass. Well. All sequences with core damage in containment my past need to be eliminated so you need to pass me to identify. So what PSA PSA is something you can use to see the reliability of the isolation provisions. But it is not that you simply use the PSA you have to the requirements for isolation and you go to a country that you have to be double valve in this of this time automatic so you can use the PSA. And then containment bandering made through so we need to have some provisions to stabilize the core. If you can inside the vessel this was the first option that people attempt and if not there is a core catcher. So here I don't think you can do much with the PSA. And then if you these are what we say the practical elimination of this phenomenon now the debate we have here is that for other thing that the code. Of the containment of the story. Some people said this is not practical elimination so this is residual risk. I don't understand very much this differentiation the point to be made here is that when you do a PSA level two that has been made in many places and so on for the previous design you do a PSA for a plant in which if I can eliminate those things or imagine this does not exist. You do a PSA that goes up to here. And the PSA level two takes it to account. Once you have melt the core what can you do at the plant with whatever you have you have a containment that it is not designed for a civil accident you have a containment spray that it is designed for DBA. Not there for a civil accident you have instrumentation that are not for civil accident but nevertheless because there are margins you can do. Some things and you use this PSA with the last many uncertainties about the phenomenon is there and you come up with a number and say ok it's very low now here with those things. You can use the PSA but the PSA now is based on the use of containment features that are designed for civil accident that's the difference. I mean it is more solid demonstration and probably you can come up with the better results of the PSA by experience I think PSA level two goes with just a factor of 10 to the minus one for CDF or something like that. So that's the question. But some people don't call this practical elimination I don't want to enter this debate. In other words I mean if you by design exclude the vessel of the break of the vessel the penetration of the base mat the detonation ok very good. But still you have the phenomenon the civil accident phenomenon these people say ok this practical elimination this is residual risk. Well I don't know what you how you want to call it the ultimate goal is to prevent a large or early release. Now these people these things are deck. We are talking about the new plans now and all these are deck but apart from the progress I raised this thing we have made the requirement that the provisions for deck not only the provisions for deck. Everything in the plan at the end should lead to the practical elimination of large or early releases of course some of these things here are for deck. You have hydrogen detonation are for deck with corn metal the one you don't have the hydrogen detonation. But you don't come every day to a generation of hydrogen because you have all these things to prevent the core damage. So this at the end the contribution to safety is not just due to this part is due to the whole line of design. Oh now is the picture that the one that I was missing before so we define that time we will say what is this ultimate equipment that is there to prevent the large or early release for which you need to have more margins. And these are the ones that you put here I forgot to put the alternative power supply to mention before and so on. Then for these more margins this is also the thing some countries say well I can design for a larger earthquake or a larger external event and some of the people say no I don't do that. What I'm going to do is to use a best estimate approach to demonstrate with a high level of confidence that the values of the parameter that will bring me to this key fetch effect are not reached because of the margins that they have. So may think it's a way of cheating but so in fact they don't design for a higher level. People say I'm going to demonstrate that I still have these margins that you require to me. But this depends also on the on the nature of the hazard and you know and the functions of the SSC and so on the design of the safety authority. It's funny because you know you will think well if in Japan some people is designing for zero five years. So now we have to ask him for design for what for for zero seven you know or even for more is unbelievable for what they design but these people they do design in other countries. However for instance in the in the in the U.S. they they apply a factor of a 30th and confusion sorry now two thirds more two thirds more they apply two thirds more from the design basis but this is this is rich through demonstration. Sorry. Through the most not through harder design and then also the the friends they define this hard and safety core they define a set of equipment for which they want to have 50% in excess. I don't know how to demonstrate European utility requirements there is also a factor of 40% above. Well okay that's I think that's my last slide and then we have ten minutes for discussing because maybe many discussions and I also need to stop for my voice. The non permanent equipment. Very easy. What is not permanent and can be or cannot be at the plan for us is not part of the design no matter if it has wheels or wings or fins or whatever. That's not part of the design so we were asked to introduce now in the design after Fukushima connections to facilitate the use of these things. The connections are part of the design but the non permanent equipment that is very well welcome is not part of the design so that means that for new plans the safety features for hooking up for connecting this permanent equipment. So no be necessary for dba and deck. That means I come here to the picture like me because that here they give. If you are here and your dba fail and something and you have a portable diesel or whatever a portable I'm sure you're going to use it and I sure you're going to not let the car melt because no. You use it whenever you think is necessary is part of the accident management but this portable diesel for the new plan. Shall not be necessary for this. There shall be an SBO diesel there. There should be an SBO diesel already. Of course if the SBO diesel fails then you put the other one but shall not be necessary. In this case also a lot of confusion because also this has been used in putting many plans after Fukushima for the system plan for the first. We have all these countries with the flex approach this and that so we try to meet it maybe in the deck talk if we succeed. But the understanding is that this permanent equipment is not part of the design. This is something but not the design. We also don't want to give the same credibility to some portable pump for the five brigade to the pumps for core cooling that we have implement in the design. And you can use them and probably you don't wait for the core mail for the core to mail to use them. That's not the point but in the demonstration of the design. They shall not be necessary to prevent this. So they shall not be necessary. You can use them. So that's the thing the message that probably is not I don't know. So end of the story. Now you can ask. Don't please. So qualify. So qualify. So qualify. When that level is not triggered. That level is triggered to 3a trie b. No 3a is the same. In the 3a. What are the additional cryptic features and putting, so that that will also cover the single failure criteria and that. In this subdivision should call in this some way, the level 3a is a former level 3 so the 3a is the safety system. These are designed as safety system in this division. For the 3b the single failure criteria is not required. Yeah, who cares? If you want, instead of... We put alpha, beta, gamma, delta or 1, 2, 3, 4, 5, 6, we put an additional one and everybody is happy. The important thing is what are going to be your design rules for all those things. The thing is a matter of terminology. But my point is also if the 3B or 4A, if you design all these things in the same manner as you define the safety system, then I will say that's a safety system. Because sometimes people say, oh, if you fail a safety system and you have another safety system, this is already deck. Some people say that, okay, good. But then you go, for instance, in the boiling water reactor, like Fukushima and so on. And you have the integrated actions of the safety system. And you have first high-pressure Cormel injection, or Cormel spray or Cormel injection. And if this fails, this is automatic depressurisation system, ADS, and then you go to low pressure and you have LCS and LPCS and LPCI, whatever. And this is called the automatic integrated response of the ECCS. So when you go to low pressure, it's because the high pressure doesn't work. Either because you cannot inject or because the break is to begin is not effective. But some people don't call it deck. This is the integrated thing. So the point is all these systems are designed as safety systems. This is the integrated response of the emergency cooling. So if you now go to your plan and put something in addition and you design it in the same way as a safety system say, it's going to be with the same design rules, safety class two and you put it single failure criterion, conservative. Everything then I will tell you what this is not the additional safety system that you have put. Why you call it deck? So you call it deck because it's something that gives you some relax, gives you some opportunity to use something that is in addition. Normal, the operator, the regulator will not let you to use everything as deck. A deck is something there to complement it. The regulator will tell you no, no, no, you design as you have to design. The deck is only going to be exceptionally to cover something to give you some. But here we also enter in a domain in which so which regulator is going to be using. I miss a slide that I want to clarify because first, I want to say. When you go to places like Wendland and so on, they include also there as deck external hazards that exceed the design basis hazards or X quake or flooding, whatever. And as in the previous presentation said, no, sorry, the hazards are not PIS. A hazard is not an AO, a hazard is not an accident. So a hazard is also not a deck. So if you have a hazard that it is too high, it may lead to an accident. It should not go into an accident because you protect the earthquake so that you don't want to have an accident because of the earthquake. But of course it's too high eventually. OK, you have an accident and let's imagine it's too much. OK, you go into deck, but we say no. Call it whatever but for us we don't want to pollute our understanding of PIS with the hazard. So this is one point I wanted to make. But this one country in Europe I think is Finland and a few others that are strong in this thing. OK, OK, we call it like this. What's the one thing? Now the other point is also interesting and I forgot this. You look this type of list of deck and people say, well, a multiple steam generator true rapture. And then you say, well, OK, and what do you do for that? And then no, there is no system. What I'm doing is justifying with the best estimate analysis that if instead of one tube breaks, I break two or three, I still can cope with that. And so people call deck. So I say, well, we have something single out here because in reality you are not putting something in addition for that. But you are using a best estimate approach that your regulator lets you do. And the same has been done with the double guillotine break loco for instance in the EPR. They say, well, we now have this leak before break. We have now all the, we invest in all the support in the, you know, in supporting the pipes, minimizing the weldings, this and that. And say now we take out the double guillotine break from, I mean that means large local double guillotine break from the list of the design basis action. It's taken out. But say now we demonstrate that if it happens, sign the lower probability, we still are going to demonstrate you that the plan can do, can cope with that, but we use the best estimate approach. So the whole thing is not very clean because people start putting this in and say, ok, people are having different understandings. So what we call deck, ok, we say we have to be putting also these things where people put very rare events and use the best estimate. At least they do something different. I don't know, have to agree with everybody. We are the idea of the way we don't progress in original document. But we want to make sure that deck is deck when you put something to design for deck, you know. When you just do accident management or use portable equipment so I say no, no, that's not deck. And then also we single out this thing with the hazard because we don't want to confuse the hazards with the PAE or with deck. Ok, I don't know if there are more questions. Yes, two users per question. They have come with box, NO, AO, DBA, DEGA, DEGA. Then I have been in the slide, there is another box that is called Practical Ateignation. That is actually confusing. It shows that if there is some stage there, that like larger early release, for that you have to give the provision to compensate that, means to stop that larger early release of radioactive material. If you consider all these cases, that is taken care of. Maybe this is the reason my director asked me to remove this box. Maybe, but I can put you. Ok, you know, I mean, it's funny because you explain things in words and people agree. I put a picture to make it clear and everybody complains about the pictures. That one for instance. I have an internal flooding here. Ok, sorry, let's go to do this thing quickly. So maybe this is clear. That one, the question is, we only design here. Here we don't design anything, maybe it's confusing. The question is, if you design something, you design for something, for what you design? If you have some equipment here, for what it's going to be? Going to be for normal operation? No. Going to be for DVA? No. So it is for a civil accident? Because if it is for a civil accident, you put it there. Ok, we remove it and that's fine. So the design and here actually what we are saying in this thing is that there is nothing here. The other message is that we want these conditions, this situation, this for which we don't design, to be practically eliminated. We want to have it at a very low probability. But then we also end in this discussion what is practical elimination. If it is just the conditions to lead to that or it is just the practical elimination of large or early releases. I understand the second. So no discussion because this now has disappeared from the tech doc, from the document and this thing is put it in the text. Ok, it bothers some people and I have to understand that it is not a big deal. But we don't design. There is nothing that we design after that. Well, I will tell you, you want to prevent large or early releases. You have to meet this goal. This is what they said the requirement. The most is not my mind. You have to prevent these large or early releases. No, you design for something. Ok, so for what, if there will be something there, for what it will be designed? For what? For taxi or for what it is going to be designed? No, no, no, there is no taxi, there is a taxi. Ok, because cormel, to stop or to make? Yes, to mitigate. If cormel happens, you may be priority at this moment to preserve the containment In the long term you have to stabilize the call as well. But you design to mitigate the consequences of the severe accident. This is to prevent the containment failure, ultimately. So, and if you have a large or early release, it's because the containment has failed. No, no, the heat starts with the fuel melting, not the stops, it starts. You are waiting for asking? Ok, good. Ok, questions, more questions. People is ready and are lost, tired and they exceed 5 minutes. Ok? If not, thank you very much. I hope it was helpful.