Environnement & Safety

ILL's liquid and gaseous effluents are regulated by the decree of 3 August 2007, which authorises it to pump groundwater and release effluents for its nuclear operations in Grenoble. Besides the monitoring and analysing procedures, ILL carries out more than 2000 laboratory measurements a year. You will find the figures below, by year.

ILL particular case

We can calculate the consequences of the worst-case accident scenario, i.e. a core meltdown in air causing an immediate release of radiation, based on the reactor’s power rating and its technical characteristics. The exposure figures in this scenario would be as follows:

Cumulative dose in the first 2 hours after the accident:

• 300m from the site of the accident: 0.3 mSv 
• 500m from the site of the accident: 0.1 mSv 
• 1000m from the site of the accident: 0.3 mSv

Cumulative dose 48 hours after the accident: 

• 300m from the site of the accident: 5 mSv 
• 500m from the site of the accident: 1 mSv 
• 1000m from the site of the accident: 1 mSv

By way of comparison, the average dose received per year by a person exposed to normal natural radioactivity is 2.4 mSv.
This figure varies around the globe, rising from as little as 0.7 mSv to 50 mSv in certain mineralised areas in France, and to as much as 500 mSv in Kerala (India).

The average dose in the Grenoble basin is 2.5 mSv per year, to which you must add around 0.1 mSv for every 100 metres of altitude above Grenoble.

We may also be exposed to radioactivity at other times in our lives: 

• a chest x-ray: 0.2 mSv 
• a scan: up to 10 mSv 
• a (return) transatlantic flight = 0.04 mSv.

If you would like more information on this subject, do not hesitate to contact us.

The ILL’s high-flux reactor is devoted exclusively to research. It operates continuously during 50-day cycles.

Its core comprises a single highly enriched uranium fuel element (10 kg) that is cooled by heavy water. The reactor produces the most intense continuous neutron flux in the world, namely 1.5 x 10¹⁵ neutrons per second and per cm². Its thermal power of 58 MW is not reused and is removed by a secondary cooling system supplied with water from the river Drac.

The heavy water vessel that contains the core is situated in a pool filled with demineralised water which provides shielding from the neutron and gamma radiation produced by the core. The reactor is controlled by means of a neutron-absorbing rod, which is gradually withdrawn from the core as the uranium is burned up. It also has 5 safety rods, which are also neutron-absorbing devices and are used to shut down the reactor in the event of an emergency.

The neutrons produced in the reactor by fission are very high-energy neutrons (speed: 20 000 km/s). They are slowed down by the heavy water both to trigger further fission events in order to sustain the chain reaction (thermal neutrons with a speed of 2.2 km/s) and to supply neutrons to the scientific instruments. 

Three components located in the immediate vicinity of the core also make it possible to produce hot neutrons (10 km/s), as well as cold and ultra-cold neutrons (700 m/s and 10 m/s, respectively). These components are a hot source, comprising a graphite sphere maintained at a temperature of 2600°C, and two cold sources, the largest of which is a sphere containing 20 litres of deuterium maintained in a liquid state at -248°C, in which the neutrons are slowed down to the desired energy by a succession of collisions with the deuterium atoms. 
The neutrons are extracted from inside the reactor vessel by around twenty beamtubes, some of which are directed at the hot source or one of the cold sources. These beamtubes, which extend outside the reactor pool in the form of neutron guides, then supply neutrons to around forty experimental areas equipped with leading-edge instruments, located up to 100 m from the reactor.

No

It is true that the ILL was founded in 1967 and that the high-flux reactor went critical for the first time in 1971.
However, the lifetime of a reactor is linked to the aging of the components “bombarded” by the neutrons (the flux), in particular the reactor vessel. In power plants, this vessel cannot be replaced.

On the high-flux reactor, however, these components are all replaced regularly. The reactor vessel was replaced in its entirety at the beginning of the 1990s, and the “new” installation then restarted in 1995, the first and only time this operation has ever been performed on a reactor. This vessel has currently been in use for the equivalent of just 8 years of operation at full power.

Similarly, between 2004 and 2007, 30 million euro were invested in the seismic reinforcement of the reactor building. As a result, the building is fully compliant with the most recent seismic design regulations in France (known as the Règle Fondamentale de Sûreté or Basic Safety Rule).
All other components are maintained, upgraded and replaced in accordance with standard practice.

An earthquake with a magnitude of 5.7 occurring at a depth of 7 km right under the reactor.

When it was built in 1970, the reactor was designed to withstand an earthquake corresponding to the criteria defined in the seismic regulations in force at the time (intensity VIII, as per French Seismic Code PS 67). Since then, our knowledge of seismic hazards has evolved, as have the regulations, which have become even more stringent. 
In 2004, studies were resumed to define the earthquake characteristics to be taken into consideration and to verify the behaviour of the ILL’s installations under seismic conditions. These studies led to the carrying out of major seismic reinforcement work, which was completed in 2006 at a cost of around 30 million euro. The ILL’s reactor is now designed to withstand an earthquake with a magnitude of 5.7 occurring at a depth of 7 km right under the reactor building.

The approach used is the approach recommended in the Basic Safety Rule on seismic hazards (RFS 2001-01) issued by the French Nuclear Safety Authority (ASN) for evaluating the seismic hazard at the sites of nuclear installations. This approach is broken down into several stages:

1. Identifying the earthquakes likely to occur in the vicinity of the installation 
   This study was assigned to outside experts who used a method which basically involves defining zones in which the probability of an earthquake is identical at every point within the zone. In other words, the seismotectonic zone in which ILL is located is first of all defined, as are the adjacent zones. It is then assumed that if an earthquake has occurred anywhere in the zone, another earthquake may occur at any other place in the same zone. The study is based on knowledge of seismic faults and historical seismicity data, which goes back to the 14th century (see SisFrance database). The most powerful earthquake observed in each zone is then taken as the basis for the next stage.
2. Defining the earthquake characteristics to be taken into account for designing or reinforcing the installation
   The next stage involves “shifting” the earthquakes identified in stage 1) to the most penalising position for the site, i.e. directly under the installation in the case of the maximum earthquake identified in the zone in which the installation is located, and to the edge of the zone as close to the installation as possible in the case of the maximum earthquakes identified in the neighbouring zones. For ILL, 2 earthquakes, known as SMHV (Séismes Maximaux Historiquement Vraisemblables – Maximum Historically Probable Earthquakes), have been identified as relevant:
   a. The earthquake of Corrençon (1962) with a magnitude of 5.2 at a depth of 7 km 
   b. The earthquake of Chamonix (1905) with a magnitude of 5.7, at a distance of 15 km
   The magnitude of each SMHV is then increased by 0.5 units in order to define the Safe-Shutdown Earthquake (SSE) in each case, i.e. the maximum earthquake for which the structures, systems, and components important to safety must be designed to withstand and remain functional.
3. Calculating the ground motions corresponding to these earthquakes
   The ground motions are calculated using the method recommended by Basic Safety Rule RFS 2001-01 and taking into account “site effects”, i.e. the amplification effects on ground motions due to the different sediments that fill the Grenoble basin. These calculations produce the “acceleration response spectra” and determine the maximum acceleration generated by the earthquake depending on the ground motion frequency. This calculation demonstrates that the most penalising earthquake to be taken into account is the Corrençon earthquake. Moreover, the acceleration level of the SSE is around 1.5 times greater than that of the SMHV.   

Consequently, it was the response spectrum calculated for the Corrençon SSE, i.e. an earthquake with a magnitude of 5.7, occurring directly beneath the installation at a depth of 7 km that was used by earthquake engineers to calculate the reinforcement work needed to ensure that the reactor building can withstand the SSE, while nevertheless taking account of design margins.

After the Fukushima-Daïchi accident France's nuclear safety authorities asked nuclear operators, and reactor operators in particular (EDF, AREVA, CEA and ILL), to base the calculations on an even more serious earthquake.

The studies carried out were based on the rate of seismicity of the Alps, which is considered to be moderate on a world scale.

Scientists estimate that in south-east France:

• the frequency of earthquakes with a magnitude greater than 4 is one every 3 years, 
• the frequency of earthquakes with a magnitude greater than 5 is one every 30 years
• the frequency of earthquakes with a magnitude greater than 6 is one every 300 years 

The strongest historic earthquake occurred in Lambesc in the south of France in 1909, with a magnitude estimated at 6. It is therefore highly unlikely that an earthquake with a magnitude greater that 5.7 would ever occur directly beneath the installation.

As far as the region around Grenoble is concerned, seismologists consider that an earthquake with a magnitude of between 5.5 and 6 could occur on the Belledonne Border Fault located 15 km from the ILL. The acceleration levels at ILL would not exceed the limit values of the SSE. It is therefore extremely unlikely that the reactor will ever be subjected to more powerful seismic movements than those taken into account in its design.

It is important to note that this is the worst-case scenario. In fact, as the other big dams, such as Tignes, Roselend and Grand’maison, are located on different rivers and are much further away, it is totally impossible that the dam-break waves caused by their failure would reach Grenoble at the same time as each other and at the same time as the wave on the river Drac.

The ILL commissioned the company Artélia (ex-Sogreah, a specialist in this type of work) to carry out a specific study on the consequences of the cascade failure of all four dams on the river Drac. The study was based on worst-case modelling assumptions and concluded that a wave of almost 6 metres in height would reach the ILL site approximately 50 minutes after the breach of the Monteynard dam.

This hazard, which is assumed to be caused by an extreme earthquake, is used as the design basis for the “hardened safety core” of components of the ILL’s high-flux reactor.
New studies have been carried out on the ability of the reactor's two containment walls to withstand this level of flooding. Similarly, all the openings in the reactor walls (personnel and equipment airlocks, truck door, pipe and cable penetrations, etc.) have been checked and, if necessary, reinforced. The necessary reinforcement work was carried out between 2014 and 2017.

Yes

The reactor building is designed to mechanically withstand the pressure of the water. Even in a situation of this kind, it would remain watertight. 
The rise in water levels caused by the breach of the Monteynard dam would not therefore affect the building’s structure. On the other hand, it would lead to a total loss of electrical power, as the two 20 kV substations and the two emergency diesel generators would be under water.

The loss of these power supplies would automatically trigger the shutdown of the reactor by safety rod drop. Cooling would be adequately provided by simple natural convection using the water in the reactor pool.

No

The reactor has three sensors (3-axis accelerometers) which permanently monitor ground movements. If two of these three sensors detect an acceleration greater than 0.01 g, the safety rods automatically fall, shutting down the reactor. This acceleration corresponds to a weak earthquake with a magnitude of less than 3 close to the reactor.

Of course, this automatic shutdown takes place under the supervision and control of the reactor operator teams.

The reactor has five independent safety rods. During reactor operation, these safety rods are always in the raised position. They are held suspended in this position by means of electromagnets. The rod drop is therefore a “failsafe” mechanism: any failure, loss of power supply, cable break, etc… causes the safety rods to fall by the force of gravity due to the loss of current to the electromagnets. This automatic shutdown does not therefore require any external energy source.

To speed up the rod drop time, the safety rods are driven downwards by compressed air at a pressure of 10 bar, which is permanently available in small reservoirs located above the safety rods. Any fall in the pressure of the compressed air in these reservoirs also automatically triggers a safety rod drop.

No

After the reactor shuts down, the core can be cooled by simple natural convention, i.e. without any source of electrical energy.

Once the reactor shuts down, in other words once the fission chain reaction in the uranium fuel stops, the core nevertheless continues to release energy because of the radioactivity of the fission products it contains. This energy per unit of time is known as the residual core power. As this residual power is due to the radioactivity of the core, it therefore decreases with time as this radioactivity decreases.

After a normal operating cycle, i.e. after 46 days at full power of 57 MW, the reactor core gives off the following residual power: 

• 2 MW immediately after reactor shutdown;
• 0.55 MW after one hour;
• 0.18 MW after 24 hours;
• 0.08 MW after one week.

This residual power is not only low but also decreases very rapidly. This is due, on the one hand, to the reactor’s low operating power (57 MW) and, on the other, to its short operating cycle (46 days). The fuel element, a single fuel rod which constitutes the whole of the reactor core, must then be changed. As the reactor cycle is short, the level of radioactivity of the long-lived fission products (those with long half-lives) does not have time to accumulate.
Nevertheless, the core still has to be constantly cooled to prevent its temperature from rising and hence avoid any risk of fuel meltdown.

During a normal shutdown, the main coolant pumps are left to run for an hour, providing a water flow rate through the core of 2400 m3/h. Once these are shut off, the pumps of the shutdown cooling system continue to operate alone, providing a water flow rate through the core of 150 m3/h. The cooling water is water taken from the river Drac. The heat from the core is transferred to this water via heat exchangers, an operating mode which avoids any thermal stress on the fuel element or the reactor vessel.

In the event of the loss of external power supplies, the main pumps of the primary cooling system will stop. This triggers the automatic shutdown of the reactor but also the automatic startup of the emergency backup diesel generators. These generators make it possible to restore power to the main systems, in particular the shutdown cooling system.

Finally, even in the event of the total loss of external and emergency backup power supplies, the pumps of the shutdown cooling system continue to function for one hour, as they have batteries which guarantee autonomous operation for this length of time. If these batteries fail, cooling is no longer provided by means of forced convection but by simple natural convection, which is perfectly adequate to ensure that the reactor core is properly cooled.

No

The reactor core is situated at the centre of a heavy water vessel with a volume of around 15 m³, which itself is located at the bottom of a pool containing 450 m3 of light water. In the event of the total loss of all power supplies, both external and emergency backup supplies, the core is cooled by natural convection in the reactor vessel, during which process the water in the vessel stabilises at a temperature of around 60°C. The reactor vessel itself is cooled, again by natural convection, by the water in the reactor pool, the temperature of which stabilises at below 60°C.

No

An explosion such as the one that occurred in the n° 4 reactor of the Chernobyl power plant due to a runaway fission reaction cannot happen with the ILL’s reactor. The equivalent scenario for research reactors like ours, known as a BORAX accident, does not produce an explosion capable of damaging all the reactor’s structures, including its containment. The energy stored in the reactor core and released in the “explosion” is much too low to do such damage. Obviously, this is due to the fact that the core of the ILL’s reactor is very small (10 kg of uranium compared with the 190 tonnes contained in the core of Chernobyl's RBMK-type reactor).

The French Nuclear Safety Authority (ASN) requires that the design of experimental reactors such as the ILL’s take into account a so-called “BORAX-type accident” scenario, named after an American research facility that was deliberately destroyed in the 1950s in order to study this phenomenon.
An accident of this type did actually occur at the SL1 reactor in the United States when one of the reactor’s control rods was accidentally and extremely quickly withdrawn from the core. This led to such a rapid exponential increase in the nuclear power generated by the chain reaction that the heat produced in the fuel plates caused them to melt before it could be transferred to the cooling water. The dispersal in the cooling water of a large amount of molten aluminium in the form of very fine droplets then caused the water to vaporise suddenly and explosively. This is known as a “vapour explosion”.

To come back to the ILL’s reactor, the energy released in such a scenario would be less than 200 MJ and would cause the partial destruction of the reactor vessel. The reactor pool and its metal liner have therefore been designed to withstand this “explosion” while remaining leaktight. This phenomenon might also produce a spray of water, but this would not be very powerful and would not therefore damage the reactor containment.

It is important to note that even the most highly unlikely scenario would not create the conditions necessary to trigger a BORAX-type accident at the ILL’s reactor. In fact, this is generally true for the other comparable research reactors in the world. In most other countries, therefore, the safety authorities do not include a BORAX-type accident in the design basis of their reactors. 

Yes

We have already seen that as soon as the reactor shuts down the reactor core is adequately cooled by simple natural convection. Of course, for this to be possible there must be sufficient water in the reactor vessel. Accidents liable to result in the loss of the water in the reactor vessel can therefore lead to the meltdown of the fuel, as natural convection is no longer possible.

The reactor vessel and its associated cooling systems are designed in such a way that there must always be at least two independent failures for the water inventory of the vessel to be lost and the core to be exposed. The frequency of such an occurrence is therefore extremely low, around 10^-5 to 10^-6 per year (once every hundred thousand to a million years, on average).
This scenario was nevertheless taken into account in the most recent safety review of the installation. Following this review, an emergency water makeup system was installed. This allows water to be reinjected directly into the reactor vessel in this sort of scenario to ensure that there is always enough water in the vessel to cool the core by natural convection. Recovery pumps have been installed in the ‘crypt’ of the reactor to reinject the water that has leaked from the reactor vessel and thus re-establish a “closed” cooling system.
Finally, as part of the continuing process of safety improvement, ILL has recently proposed a new emergency core cooling system that will allow a communication passage to be opened up if necessary between the reactor vessel and the reactor pool and adjacent storage pool, providing a total volume of 1000m³ of water. Water from the reactor pool will then fill the reactor vessel by simple gravity, i.e. without the need for an external power source, allowing core cooling to continue. This new system is in place since 2012. 
With these new emergency systems the probability of a core meltdown will then be extremely low, approaching a frequency of 10^-7 per year, the value at which the risk is considered to be “residual” and no longer needs to be taken into account in the installation’s design basis. 

In the Borax-type accident automatically included in the design basis, the core also undergoes partial meltdown but remains covered by the water in the pool. Most of the radioactivity released during the meltdown is therefore retained in the pool, which acts as a filter. A small amount of the radioactivity, predominantly the noble fission gases krypton and xenon, is released immediately into the reactor containment.

The most serious accident would be a core meltdown following the loss of the water inventory.

It is on the basis of this extremely pessimistic scenario that the Institute's internal emergency plan (PUI) and the off-site emergency response plan (PPI) have been established.

In such a case, the fuel meltdown would result in: 

• the loss of the fuel cladding, which serves as the first barrier to contain the radioactive fission products;
• the release of some of the fission products normally stored in the fuel element matrix.

The radioactive fission products would therefore be released into the reactor's primary cooling system.

The worst-case scenario included in the design basis of the ILL reactor involves the extremely pessimistic assumption that the primary cooling system, which is the second barrier to contain radioactive substances, is itself damaged. In this case, the radioactive materials are released directly into the reactor containment - the third and final barrier - and not into the water of the pool surrounding the reactor vessel. This is a particularly unfavourable assumption, as the water in the pool is an extremely efficient filter for retaining a very large proportion of the radioactive fission products.

This worst-case scenario was included in the initial design of the reactor and is taken into account for the improvements made continuously to the safety of the installation. Preventive measures are in place to reduce the probability of its occurrence to as low as is reasonably achievable; damage limitation measures are also in place to reduce to the lowest level reasonably possible the severity of the accident, should it nevertheless occur.

It is on the basis of this extremely pessimistic scenario that the Institute's internal emergency plan (PUI) and the off-site emergency response plan (PPI) have been established. It is this scenario which, despite its improbability, was used to calculate the "300 m danger zone" (evacuation of personnel of companies on the site) and the "500 m danger zone" (“take cover” order for the few hundred people living in the Bastille district of Fontaine).

Yes

In the event of a core meltdown, the reactor containment is immediately isolated. In the hours following the accident, the pressure inside the containment may increase slightly. It stabilises at a maximum of around 0.1 bar, so there is no risk of damage to the containment. However, to guarantee that there are absolutely no unfiltered and unmonitored radioactive releases into the atmosphere, it is preferable to maintain the pressure inside the containment at slightly less than atmospheric pressure. This is done by regularly releasing small quantities of air from the containment via the 45m exhaust stack, through very high efficiency aerosol filters and iodine traps. As these releases are calculated, monitored and controlled, they are known as "planned releases".

In the worst-case scenario taken into account by the ILL, i.e. a core meltdown in air, a fraction of the radioactive fission products is directly released into the containment.

Levels of radioactivity in the containment are continuously monitored by three radiation detectors in the containment itself and by three others in the ventilation system. If readings from any two of three identical detectors exceed a pre-set threshold, the containment is automatically and completely isolated.
However, the total isolation of the containment involves shutting down all the ventilation systems, including the air conditioning, which keeps the air in the containment cool. The pressure in the containment will therefore rise due to the heat given off by various sources inside the containment, in particular the residual power of the fuel. The evaporation of liquid nitrogen and helium used for ILL's research experiments will also lead to a slight increase in the pressure inside the containment.

In the worst possible situation, i.e. on a very hot summer day, the pressure in the containment would rise within a few hours to stabilise at about 0.1 bar.
This explains why the ILL reactor containment is double-walled. It comprises an inner wall made of 40 cm-thick concrete and an outer shell of 11 mm steel. Between the two walls an overpressure of 0.135 bar is constantly maintained, using clean air from the outside. Given the dimensions of the building (60 m wide and 35 m high), there are inevitably some minors leaks. The double-walled containment guarantees that these leaks are from the outside to the inside, and not the other way round. It is clean air from the outside that enters the containment rather than air potentially polluted by radioactive materials that leaves the building.

It is nevertheless preferable to reduce the pressure inside the concrete containment to slightly below atmospheric pressure. This guarantees, this time with absolute certainty, that there are no unmonitored leaks, even if the systems that maintain the overpressure in the annular space between the inner and outer containment walls fail. To achieve the underpressure inside the inner concrete containment, the air to be released is analysed for radioactivity and then directed through the 45m exhaust stack, across very high efficiency filters and iodine traps. The radioactivity released is, of course, measured and monitored before it enters the stack.

The impact on people located in the vicinity of a nuclear facility where an accident has occurred is always evaluated in terms of the radiation dose received.
In the ILL’s internal emergency plan (PUI) (which is the responsibility of the nuclear operator) and the off-site emergency response plan (PPI) (which the responsibility of the public authorities and, in particular, the Prefect), there are two danger zones defined around the facility:

• An inner circle corresponding to the zone that must be evacuated. The reference dose value for defining the radius of this zone is 50 mSv. For the worst-case accident for the ILL reactor, this circle has a radius of 300 m and only concerns employees working for companies in the immediate vicinity of the ILL: the ESRF, EMBL, PSB, LPSC, ST and IBS.
• An outer circle corresponding to the zone in which “take cover” procedures apply. The reference dose value used to define the radius of this zone is 10 mSv. For the worst-case accident for the ILL reactor, this circle has a radius of 300m. It concerns a small number of the staff at the neighbouring CNRS and CEA sites. The only local people concerned are the 300 residents of the Bastille district of Fontaine on the other side of the river Drac opposite the ILL.

The values used by the ILL to define the danger zones are based on WHO recommendations and have been adopted in most countries.
The dose beyond these zones is not nil, of course (the cloud does not stop at the border), but it decreases with distance. The doses received after one week are given below. They are calculated for a person located in the radioactive plume with no protection (a person outdoors, breathing the air of the plume for a whole week).

• 3 mSv at a distance of 1 km;
• 0.9 mSv at a distance of 2 km;
• 0.15 mSv at a distance of 5 km.

For comparison:

• The statutory annual dose limit for the general public, excluding natural sources and medical procedures, is 1 mSv;
• The natural radiation dose received by those living in the Grenoble basin is 2.4 mSv per year;
• The natural radiation dose received in certain highly populated areas of India or Brazil is 30 mSv per year;
• The average annual dose received in France for medical purposes is 1.3 mSv, although there are large disparities: an abdominal scan, for example, results in a radiation dose of over 10 mSv.

Basically there are two types of exposure to radiation:

• External exposure: the radiation source is located outside the body. The radioactive substances which are the source of the radiation decay and emit particles, mainly gammas, which enter into contact with the body. It is relatively easy in this situation to protect oneself, by reducing to a minimum the time spent near the source (TIME), by moving away from the source (DISTANCE), and by placing screens (SHIELDING) between oneself and the source. A house wall, for example, will reduce the dose of radiation received by a factor of 10. For external exposure, the dose rate received per unit of time (expressed in mSv /h) is the relevant value.
• Internal exposure: the source of radiation is inside the body. This is the case if we inhale contaminated air (by breathing when inside the radioactive plume or “cloud”) or ingest contaminated foodstuffs (drinking water, milk, vegetables, meat, etc ...). The radioactive substances enter the body and are then absorbed by various body organs, depending on their physical and chemical characteristics. The calculations take into account all radionuclides released (see fission products). The organs are irradiated by the particles emitted during decay, only in this case, because the radiation is emitted directly inside the body, the beta and, in particular, alpha particles if any, contribute substantially to the dose received. Obviously, if the source of radiation is inside the body, the simple techniques described above to protect against external exposure can no longer be used. For internal exposure, the amount of radioactivity incorporated (expressed in Becquerel (Bq)) is the relevant value.

In an accident at the ILL reactor, the radiation doses received by those situated within the 300 m zone would primarily be due to external exposure; the source of the radiation would be the reactor building itself. The thickness of the reactor containment would reduce this radiation at its source by a factor of at least 100.

The maximum dose rate would be less than 1 mSv/h at 170 m from the containment, on the edge of the ILL site, and about 0.1 mSv/h at 300 m. These low dose rates would give staff time to take all the necessary action calmly and without haste. This explains why, for example, in such a scenario ILL staff would evacuate the site on foot. This is also the most efficient solution, as it solves the problem of possible traffic jams. 

For those outside the 500 m zone, the dose received would mainly be due to releases of gas from the exhaust stack. With a southerly wind, for example, as is usually the case in the morning, the inhabitants of Grenoble would not receive any dose at all. In the afternoon with a northerly wind, they might receive a fraction of the low doses mentioned above.

In an accident involving a core meltdown due to the loss of the water inventory, the kinetics are relatively slow: the number of backup systems available ensures that water levels remain sufficient for the core to continue to be properly cooled by natural convection.

The Basic Safety Rules (RFS - Règles Fondamentales de Sûreté) are based on the assumption that certain emergency backup systems fail after 24 hours of use. It is this additional failure that, in this scenario, would result in the exposure of the core and its fusion in air.
The operator and the authorities would therefore have sufficient time to implement their respective emergency response plans (PUI and PPI) before the radiation accident itself (i.e. the core meltdown) occurs.

In the Borax-type accident automatically included in the design basis the kinetics are extremely fast. A small fraction of the fission products is released immediately into the reactor containment; most of the radioactivity, however, is retained in the reactor pool. Although this type of accident comes under the so-called "reflex response phase" of the PPI, the dose rates generated around the installation would be considerably lower than those resulting from a core meltdown in air. Any measures that might need to be taken (evacuation and / or “take cover” order) to protect the populations in the 300 m and 500 m zones could therefore be carried out calmly and carefully, without haste.

Yes and no

Taking into account the nominal efficiency of the iodine traps, calculations made for the worst-case accident scenario (i.e. a core meltdown) show that the equivalent dose in the thyroid gland is about 10mSv for children (the most vulnerable group) within the 500 m zone.
In France the decree of 20 November 2009 fixes the thyroid equivalent dose above which stable iodine must be administered at 50 mSv. The administration of iodine tablets would therefore not be compulsory in our case.
The Prefect may, however, order tablets to be distributed to people in the 300 m and 500 m zones as an added precaution.

It may be useful to note that:

• Iodine tablets saturate the thyroid gland with the (non-radioactive) stable iodine they contain. If the thyroid is saturated, it cannot absorb any radioactive iodine inhaled.
• As the protection afforded lasts about 24 hours, there is no point taking the tablet too early. This is why it is important to listen to the instructions issued by the Prefect.

Find out more: www.distribution-iode.com

Yes

The pool used to store spent fuel awaiting reprocessing at La Hague is situated, like the reactor pool itself, inside the reactor containment; its design constraints (resistance to various stresses and possible damage) are exactly the same as those for the reactor pool.

As of the 242nd day after reactor shutdown, a spent fuel element can be cooled properly using only air. As the ILL operates a maximum of four 50-day cycles per year, it therefore produces four spent elements (cores) per year, of which no more than three can have a cooling period (the time that has elapsed since they stopped being used) of less than 242 days. The other fuel elements in interim storage in the pool have all been cooling for over 242 days and can therefore perfectly withstand dry conditions without being damaged or releasing their remaining radioactivity.

The consequences of a total loss of water in the storage pool, an event classed as a “residual” risk, are lower than those of the worst-case accident scenario included in the reactor design basis, namely "a core meltdown in air".

Ionising radiation has two main types of effect:

1. Deterministic effects

These are effects that occur at high doses, typically 1000 mSv and above, and are observed in anyone who receives such a dose. They have three basic characteristics:

• They are threshold effects. This is fundamental for radiation protection purposes, since it confirms that a dose below this threshold has absolutely no impact on health.
• The severity of the effect depends on the dose. The higher the dose, the more rapid and acute the clinical effects.
• They are early effects. Except in special cases such as cataracts, the effects appear rapidly, in the hours or days following exposure.

In the case of whole body exposure to radiation, the severity of the symptoms (fatigue, nausea, vomiting) increases with the dose received. At levels exceeding 2000 mSv, there is a drop in lymphocyte, red blood cell and platelet counts, which explains the haemorrhaging and infections observed.

1. Stochastic effects

These are effects that occur randomly, irrespective of the dose received, to some of the individuals in a population exposed equally to the same dose of radiation. They mainly appear in the form of so-called “radiation-induced” cancers, which in fact are absolutely identical to the various forms of cancer observed throughout the human population when there has been no exposure to anything other than natural radiation. These stochastic effects are exactly the opposite of deterministic effects:

• They are effects that have no threshold. This assumption, which is applied on the basis of the precautionary principle, is again fundamental for radiation protection purposes, since it implies that any dose, however low it may be, leads to a slight increase in the probability of an individual developing cancer and therefore to a slight increase in the frequency of occurrence of cancers in a uniformly exposed population.
• The severity of the effect does not depend on the dose. The dose received does not determine the severity of the cancer for any given part of the body.
• They are late effects. The first cancers to appear are leukaemias, typically 5 years after exposure. “Solid” cancers can take as long as several decades to appear.

These stochastic effects have been demonstrated in humans through epidemiological studies at exposure levels of over 100 mSv. The benchmark study establishing the relation between dose and effect is still the one performed on the populations exposed at Hiroshima and Nagasaki. More than 86000 individuals were or are still being studied (for those who are still alive 66 years after the explosions). These studies have not identified any significant rise in the cancer rate among subgroups with an exposure level of less than 100 mSv. This does not mean there is no effect below this dose, but simply that if such effects exist, there are too few excess cases to be statistically significant. This difficulty, and it is not the only one, is inherent in any epidemiological study, regardless of the parameter being tested. The International Commission on Radiological Protection (ICRP), whose recommendations provide the basis for all radiation protection doctrine and the resulting regulations, has therefore decided to err on the side of caution and extrapolate these dose-effect relations to low doses as a straight-line relationship without a threshold. The risk coefficient for any individual in the population is currently estimated at 0.07 per Sv received. An individual exposed to 10 mSv will therefore see his/her risk of developing a cancer increase by 0.0007 (bearing in mind that the “natural baseline” is 0.25, since one person in four develops cancer during his/her life). Finally, it should be noted that this so-called no-threshold hypothesis is currently the subject of considerable research, particularly in biology.

Many scientists believe that the hypothesis lacks credibility in molecular biology terms, given the complexity of the mechanisms involved in the cancerisation of tissue.

See also the website of the IRSN (Institut de Radioprotection et de Sûreté Nucléaire)

After the Fukushima accident, the safety authorities imposed a number of requirements on nuclear operators:

1. The case of a single extreme external event, or of a combination of extreme external events, far more severe than originally taken into account for the design of the installations, had to be considered as possible. These extreme situations are referred to as "noyau dur" situations, in other words situations that the reactor's hardened safety core of components must be able to withstand. The "noyau dur" situations for the ILL are the following: 

• An extreme earthquake with a recurrence interval of more than 20000 years, taking into account possible amplification due to the particular configuration of the Grenoble basin (or an even stronger earthquake)
• Extreme flooding following the cascade failure of the 4 dams upstream on the river Drac. The risk of scouring (excavation of the earth around and under foundations which could cause the structures or buildings affected to "tip over") around the installations due to the passage of the flood wave must be taken into account.
• A toxic cloud over the site following the earthquake and/or flooding of the Grenoble basin in the event of a dam burst, caused in particular by phosgene released by the chemical installations south of Grenoble. 

1. The creation of a small sub-assembly of "structures, systems and components" designed to resist these "noyau dur" situations and:

• prevent a serious accident and limit its escalation
• limit the massive release of radioactive substances
• enable the operator to carry out its crisis management responsibilities.

This sub-assembly is known as the "hardened safety core" of the nuclear facility.

The most serious accident likely to happen at the ILL's high-flux reactor (HFR), as at any reactor, is a core meltdown (see glossary).
The HFR's hardened safety core therefore includes systems designed to prevent a meltdown in extreme "noyau dur" conditions:

1. ARS: Seismic reactor shutdown circuit (ARS - arrêt réacteur sismique): this system guarantees that the reactor will shutdown even in the event of the extreme earthquake defined as one of "noyau dur" situations and that it will do so even in the hypothetical case where there is no "weak" phase in the seconds preceding the "strong" phase of the earthquake. Basically, when an earthquake occurs, a succession of primary (compression) waves - P waves - and secondary (shear) waves - S waves - are propagated from the epicentre. The compression waves travel faster than shear waves and would therefore be the first to reach the installations. The shear waves, however, are more destructive. Like other reactors, the HFR therefore originally had an automatic shutdown mechanism that would be triggered on detection of very low-level (0.01 g) P waves. As the shutdown would occur preventively at low levels of acceleration, the system that detected and triggered the shutdown did not itself need to be designed to withstand high levels of acceleration, i.e. to be earthquake resistant. 
   To comply with "defence in depth" requirements (a concept implemented to compensate for potential human and technical failures and comprising several levels of protection, based on the creation of multiple barriers to prevent the release of radioactive substances into the environment), the ILL has therefore installed as part of its hardened safety core of components a new system capable of shutting down the reactor completely automatically even in the extremely hypothetical case of an earthquake that does not generate P waves that are detectable on the site before the arrival of the more destructive S waves. 
   This system has been operating since 2016.
2. CRU and CEN: We have already shown (see FAQ: "Is a power supply needed …") that the reactor does not need electricity or an external cold source to cool down once it has been shut down. To cool down the core properly we only need to maintain a sufficient level of water to ensure the process of natural convection.
   There are two different systems which guarantee that the water level remains above the core in the event of a breach in the reactor vessel or reactor pool caused by an earthquake of the severity defined to be withstood by the hardened safety core: 

• The emergency core cooling (‘reflood’) system (CRU - circuit de renoyage ultime): the CRU connects the reactor vessel, which has a volume of only 12 m³, and the reactor pool (over 350 m³) and allows a passage between the two to be opened if necessary. The system was brought into manual operation in 2012. From 2018 it has been operated in automatic mode. It enables the core located inside the reactor vessel to be reflooded passively (by gravity) with water from the reactor pool. The CRU ensures that the reactor has the cooling water it needs for about one hour. 
• The groundwater supply system (CEN - circuit d'eau de nappe): The CEN is a system designed as a means of refilling the reactor pool with groundwater water taken from the underground aquifers beneath the ILL site. Together with the CRU, this second safeguard system ensures that there will always be sufficient water in the reactor pool and hence in the reactor vessel. To avoid flooding the reactor after a few hours, the system also includes a number of pumps located in the reactor basement. Once there is enough water in the reactor pool, the system automatically switches from "groundwater pumping" to "run-off water recirculation" mode. The system was brought into service early in 2018.    

It should be noted that the ILL has decided on its own initiative to require these three accident prevention systems of the hardened safety core to be fully redundant. In other words, the reactor shutdown and water makeup mechanisms can each withstand at least one system failure without themselves failing to fulfil their function. 

The reactor's hardened safety core also includes systems for limiting releases into the environment, should a core meltdown nevertheless occur following an extreme external event (despite the systems in place designed to prevent such a meltdown). This is a perfect example of our application of the principle of "defence-in-depth".

• CDS: Seismic depressurisation circuit (Circuit de Dégonflage Sismique): this automatic system makes it possible to maintain the dynamic confinement of the reactor building. It involves extracting a minimal quantity of air from the reactor building, in order to keep the building at a pressure slightly below that outside the building.
  The air extracted is filtered through an iodine trap and two sets of very high-efficiency filters, before being monitored and released via a new dedicated exhaust stack located 50 metres above ground level on the reactor dome.
  The CDS provides a means of controlling the rate and quality of releases, thus avoiding uncontrolled leaks through any fissures in the containment that may be caused by a severe earthquake. This system has been operating since 2016.
• GAS: Seismic pressurisation of the annular space (gonflage annulaire sismique): this automatic system ensures that the space between the inner and outer reactor building walls is maintained at a permanent overpressure compared to the outside. This "annular space" is filled with clean air.  It strengthens dynamic confinement considerably during transient phases when the pressure inside the reactor building could be higher than atmospheric pressure. This is because even when the interior of the reactor building is at positive pressure during these transient phases, there will still be clean outside air entering the building through any fissures in the concrete containment that may appear after a severe earthquake. This system has been operating since 2016.

As with the other accident prevention systems, these two systems designed to limit releases are fully redundant. 

The reactor's hardened safety core of components also includes a set of resources to manage a crisis triggered by an extreme external event.

1. The emergency reactor control room:
   ILL has constructed a new emergency control room designed to cope with any of the extreme external events considered to be "noyau dur" situations, including a possible combination of such events.  Previously the ILL had an underground emergency control room designed to withstand a "safe-shutdown earthquake". It was also designed to withstand the flooding liable to occur on site following a rise in the level of the river Isère or the river Drac. It would not however remain operational in the event of flooding caused by the breach of one or more of the dams upstream. 
   The new control room has been operational since the end of 2016 and is designed to:

• withstand an extreme earthquake measuring 7.3 on the Richter scale
• withstand a flood wave of 6 metres on the ILL site
• withstand the scouring liable to result from this flood wave
• protect the personnel who would have to manage such a crisis, even in a core meltdown situation (protection from direct radiation and radioactive releases, but also protection from toxic chemical hazards, including in particular from phosgene pollution from the chemical industries south of Grenoble). The control room is equipped with a ventilation system which maintains the crisis management quarters at a positive pressure and which ensures that all the outside air entering the building is filtered. The filter system consists of a very-high-efficiency filter, an iodine trap, and an NBC filter (nuclear, biological and chemical) to counter the phosgene risk. 
• The 45-metre reactor exhaust stack has been modified to ensure that it poses no risk to the new control room in the event of an extreme earthquake. 

1. Hardened safety core instrumentation and control:
   The new control room is equipped with all the I&C systems needed to be able to operate the hardened safety core components either automatically or, if so required by the reactor operators, in manual mode.  In particular, emergency electrical power is available for all the hardened safety core components (an emergency diesel generator, plus inverter and batteries ensures that the power supply is not interrupted during the transfer from the external mains network to the emergency supply). 
2. Monitoring systems
   The control room also houses all the instrumentation required to diagnose and monitor the four critical safety functions: 

• controlling the reactivity of the fuel element: ensure that the reactor is completely shut down
• controlling the cooling: check the water inventory and hence the proper cooling of the reactor by the CRU and CEN systems
• controlling confinement: monitor the dynamic confinement process (CDS and GAS)
• controlling exposure: monitor using dedicated instruments the levels of irradiation and contamination inside and outside the reactor, including the releases by the seismic depressurisation circuit. The areas inside the emergency control room are also specially monitored to ensure that the levels of radiation and radioactive or toxic contamination are acceptable for the crisis management teams. If this is not the case, there are procedures for conditioning the air and ordering the use of additional protective equipment if necessary (masks, breathing apparatus, etc.).
• Environmental monitoring: dedicated instrumentation is in place to monitor meteorological conditions (wind speed and direction, low-level or normal concentration of releases). It provides data for assessing the exposure of the population, in addition to measuring any releases. Even during or after flooding following a dam break, the operators can use drones to take air samples and bring them back to the ILL site for analysis in a special micro-laboratory designed to withstand extreme earthquake conditions.

1. Communications
   The control room has the communication equipment needed to alert the authorities in these extreme situations. In particular, ILL's access to the "Iridium" satellite communications network ensures that communication remains possible with those outside the site even if the other systems are down (landlines, GSM etc.).

Finally, the crisis management teams may need to access the reactor building during or after major flooding. This can be done via a suspended footbridge connecting the roof of the emergency control room to a new external walkway fixed to the outside of the metal reactor containment. The walkway leads to the roof of the ILL administration building (reinforced to resist earthquake and flooding) and from there to the entrance to the reactor building. 

With the exception of the building housing the emergency control room, all these systems (power supplies, air conditioning, monitoring and communication) are also fully redundant. 

The creation of these hardened safety core components, together with the reinforcement measures required to protect them from being damaged by equipment not designed to withstand an earthquake, cost some 30 million euros.  The work was completed in time for the reactor restart in early 2018.

The ILL (Institut Laue-Langevin) is an international research institute situated in Grenoble which operates a 57-MW high neutron flux reactor (HFR) – known as the Installation Nucléaire de Base n° 67. It produces extremely intense beams of neutrons for use in fundamental research, particularly in the fields of health, energy, the environment and quantum materials.  

On 3 September 2025, during monthly testing of the air conditioning system in the emergency reactor control room, the alarms that indicate insufficient overpressure between the emergency control room and the outside failed to go off. The emergency control room was built following the complementary safety assessments conducted in the wake of the Fukushima accident in Japan to ensure the management of extreme crisis situations.

Following a thorough investigation after discovery of the fault, it was established that the overpressure setpoint had not been set to the value of 0.0015 bar specified in the safety report. Under these conditions, the slight overpressure inside the emergency control room would not have been guaranteed in an extreme crisis situation, thereby compromising its habitability.

The downtime defined in the general operating rules for the emergency control room air conditioning system was exceeded. Consequently, this event has been classified at level 1 on the INES scale of nuclear events, a scale which has 8 levels from simple deviation (level 0) to major accident (level 7).

This event had no consequences for operators, the public or the environment.

The ILL (Institut Laue-Langevin) is an international research institute which houses a 57-MW high neutron flux reactor (HFR) – known as the Installation Nucléaire de Base n° 67 – designed to produce extremely intense beams of neutrons for use in a broad spectrum of fundamental research fields, including solid-state physics, neutron physics and molecular biology. 

On 28 February 2019, during a routine operation to empty the reactor pool and the adjoining storage canal, the removable gate which separates the pool and the storage canal was raised by thirty centimetres, although it did not come out of the groove which guides its movement. The operation to lift the gate, which weighs 4 tonnes, was begun using the 6-tonne hook of the overhead crane. As this manoeuvre was unsuccessful, the crane’s 20-tonne hook was then used instead, despite the fact that the pool gate’s lifting cable is not designed to be subjected to such a potential force: its WLL (Working Load Limit) is 4 tonnes [1]. Exceeding the admissible load in this way created a risk of the pool gate falling 30 centimetres and damaging its guide groove. In view of the potential consequences had the pool gate fallen, the event was initially classified as a significant event at Level 0 on the INES scale.    

Following an in-depth examination, it was concluded that the crane operators had not adopted the appropriate questioning attitude before going on with their handling operation and switching to the 20-tonne hook. Moreover, at the start of the operation it had not been planned to raise the gate between the reactor pool and the storage canal. Procedures had therefore not been properly applied.  

Consequently, the incident was reclassified to Level 1 on the INES nuclear event scale, a scale which comprises 8 levels, from deviation (Level 0) to major accident (Level 7). 

It had no consequences for the crane operators, the public or the environment.

[1] with a factor-5 margin of safety

The ILL is an international research institute operating a nuclear reactor classified as a Basic Nuclear Installation.

On 17 May 2017 a spent fuel element became lodged in its handling cask, during a transfer operation inside the cooling pool.

The aim of this operation is to deposit the spent element on the floor of the cooling pool; it is performed entirely under water. On this occasion it could not be performed correctly. The residual power of the element is low, at about 20 kW.
As the element has never left the water of the pool, there is no radiological hazard and no risk of any rise in temperature. Once it has been extracted from the cask it will be positioned on the bottom of the pool, as is usual practice.

The fuel element transfer operation is a common practice at the ILL and has already been performed nearly 200 times without incident.

As is standard practice for this type of anomaly, the incident has been classed at level 1 on the INES scale for nuclear incidents, out of 8 (from a simple deviation, level 0, to a major accident at level 7).
There was never at any point any risk for the facility, its personnel or the environment. 

The ILL is an international research institute operating high-flux reactor INB no. 67, classified as a Basic Nuclear Installation.

The facility's operating parameters are regularly controlled every twelve hours. At 9 a.m. on 9 July the reactor shift leader observed that some of the zones inside the internal containment of the reactor building were under a slight overpressure (0.5 to 1 mbar). At the previous control the pressure readings had been compliant with requirements. The anomaly had not been detected immediately because the alarm on the internal reactor containment pressure levels was disabled. It should be noted that the reactor operates within a double containment; the pressure in the external containment had remained at its nominal level of 135 mbar.

This event was of no consequence for either people or the environment. As the alarm had been disabled without formal analysis this event is classed as a level 1 event ('anomaly') on the International Nuclear Event Scale. Information on the event is therefore published for the general public. 

The Institut Laue-Langevin (ILL), which operates a high neutron flux reactor on its site in Grenoble, declared a significant radiological event to the ASN on 26 June 2015, concerning the exposure of the hand of an operator beyond the annual limit for body extremities of 500 mSv.

The exposure took place on 24 June 2014 when the operator was checking a radiation monitoring device. The check requires the use of a radioactive calibration source, which is fixed to the end of a rod in order to approach the source as close as possible to the measuring devices positioned high above.

In the course of the operation the operator grasped the rod by the wrong end, thus coming into direct contact with the source for several minutes. The operator only realised the error when putting the rod down. ILL considers that the operator had held the source for 3 to 4 minutes.

The dose received by the palm of the hand is estimated at about 250 mSv, which is half of the regulatory annual limit. The operator's passive dosimeter measured no efficient dose, given the distance from the source.

As the level of one quarter of the annual regulatory radiological limit had clearly been exceeded, the ASN has classified this significant event at level 1 on the INES scale, which is graduated from 0 to 7 in increasing order of severity.

On 15 July 2013, the Institut Laue-Langevin (ILL), which operates a high neutron flux reactor on its site in Grenoble, declared a significant radiological event relating to the presence, outside the reactor building in an area not designated for this purpose, of a beam of ionising radiation from an experimental instrument.

On Saturday, 13 July 2013 at around 23.15, two scientists who were standing close to the reactor building were alerted by their operational dosimeters to the presence of a high dose rate. Investigations by the radiation protection service made it possible to identify the cause of this anomaly and to resolve the issue. This anomaly had been present since late on Friday, 12 July. It was caused by the commissioning of an experimental instrument whose radiological shielding was not fully in place; the instrument was shut down as soon as the anomaly was discovered.

The readings from the operational dosimeters worn by the two scientists indicated that the most exposed scientist had received a maximum effective dose of 15 µSv, compared with the authorised limit of 20 mSv or 20 000 µSv per year. Further investigations were carried out involving sixteen people who may have been in the area during the period in question. These investigations did not reveal any radiation exposure above the minimum reporting thresholds.

The ASN carried out a reactive inspection at the ILL on 17 July 2013. This inspection revealed that the incident was caused, in particular, by the incorrect positioning of the ionising radiation beam stop. The inspectors also verified the measures immediately taken by the operator.

In light of the findings of the investigations carried out into those who were in the area in question, the incident had no impact on staff, the public or the environment.

However, due to the deterioration in defence-in-depth highlighted by this anomaly and the potential impact on workers’ radiation protection, this incident was classified as Level 1 on the International Nuclear Event Scale (INES), which has eight levels.