Dr Renaud Snanoudj
email: r.snanoudj@hopital-foch.com

MD PhD Nassim Kamar

PhD Elisabeth Cassuto

MD Sophie Caillard

PhD Marie Metzger

PhD Pierre Merville

PhD Antoine Thierry

PhD Isabelle Jollet

MD Philippe Grimbert

PhD Dany Anglicheau

PhD Marc Hazzan

PhD Gabriel Choukroun

PhD Bruno Hurault

De Ligny

PhD Bénedicte Janbon

MD Vincent Vuiblet

MD Anne Devys

MD Yann Le Meur

PhD Michel Delahousse

MD Emmanuel Morelon

PhD Elodie Bailly

Sophie Girerd

MD MSc Kahina Amokrane

MD Christophe Legendre

MD Alexandre Hertig

PhD Eric Rondeau

PhD Jean-Luc Taupin

PhD Pharmd

Epitope load identifies kidney transplant recipients at risk of allosensitization following minimization of immunosuppression

Keywords: Acute rejection, kidney transplantation, antibody-mediated rejection, HLA mismatching, epitopes, immunosuppression minimization

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Numerous reports have shown a significant influence of the number of HLA mismatches on kidney graft survival [START_REF] Morris | Analysis of factors that affect outcome of primary cadaveric renal transplantation in the UK. HLA Task Force of the Kidney Advisory Group of the United Kingdom Transplant Support Service Authority (UKTSSA)[END_REF][START_REF] Opelz | HLA compatibility and organ transplant survival. Collaborative Transplant Study[END_REF][START_REF] Opelz | Effect of human leukocyte antigen compatibility on kidney graft survival: comparative analysis of two decades[END_REF][START_REF] Williams | The Risk of Transplant Failure With HLA Mismatch in First Adult Kidney Allografts From Deceased Donors[END_REF] , although this concept has also been challenged [START_REF] Su | Diminishing Significance of HLA Matching in Kidney Transplantation[END_REF] .

The recent advent of solid phase assays detecting anti-HLA antibodies has shed light on how HLA matching influences the occurrence of de novo donor specific antibodies (dnDSA). Indeed, class II HLA matching and inadequate immunosuppression are two independently recognized risk factors for dnDSA development [START_REF] Wiebe | Evolution and Clinical Pathologic Correlations of De Novo Donor-Specific HLA Antibody Post Kidney Transplant[END_REF][START_REF] Wiebe | Class II Eplet Mismatch Modulates Tacrolimus Trough Levels Required to Prevent Donor-Specific Antibody Development[END_REF] . Moreover, antibodymediated rejection (ABMR) due to dnDSA is associated with a 40% reduction in 10years graft survival [START_REF] Wiebe | Evolution and Clinical Pathologic Correlations of De Novo Donor-Specific HLA Antibody Post Kidney Transplant[END_REF] and appears as a major cause of late allograft loss [START_REF] Willicombe | De Novo DQ Donor-Specific Antibodies Are Associated With a Significant Risk of Antibody-Mediated Rejection and Transplant Glomerulopathy[END_REF][START_REF] Hidalgo | De Novo Donor-Specific Antibody at the Time of Kidney Transplant Biopsy Associates with Microvascular Pathology and Late Graft Failure[END_REF][START_REF] Everly | Incidence and Impact of De Novo Donor-Specific Alloantibody in Primary Renal Allografts[END_REF][START_REF] Ginevri | Posttransplant De Novo Donor-Specific HLA Antibodies Identify Pediatric Kidney Recipients at Risk for Late Antibody-Mediated Rejection[END_REF][START_REF] Devos | Donor-specific HLA-DQ antibodies may contribute to poor graft outcome after renal transplantation[END_REF] .

Despite the worldwide use of allocation algorithms taking into account HLA matching, approximately 10-15% of patients still develop dnDSA within an average of six years post-transplant [START_REF] Wiebe | Evolution and Clinical Pathologic Correlations of De Novo Donor-Specific HLA Antibody Post Kidney Transplant[END_REF][START_REF] Yamamoto | De Novo Anti-HLA DSA Characteristics and Subclinical Antibody-Mediated Kidney Allograft Injury[END_REF][START_REF] Mao | Extremely high association between appearance of HLA antibodies and failure of kidney grafts in a five-year longitudinal study[END_REF] , questioning the reliability of current typing for minimizing the risk of allosensitization. Donor/recipient HLA compatibility has always been assessed by a simple count of HLA mismatched antigens, i.e. at the "serologic" level although typing has been more and more performed using molecular techniques for at least a decade.

Yet, anti-HLA antibodies do not recognize whole HLA antigens but rather epitopes, i.e. short polymorphic sequences of amino acids in antibody-accessible positions [START_REF] El-Awar | HLA Class I Epitopes: Recognition of Binding Sites by mAbs or Eluted Alloantibody Confirmed With Single Recombinant Antigens[END_REF][START_REF] Cai | Development of Nondonor-Specific HLA-DR Antibodies in Allograft Recipients Is Associated with Shared Epitopes with Mismatched Donor DR Antigens[END_REF] .

Two approaches are used to identify HLA allogenic epitopes. The HLAMatchmaker algorithm developed by Duquesnoy relies on how immunoglobulin paratopes bind to protein epitopes localized on the molecule surface, to identify theoretical HLA epitopes [START_REF] Duquesnoy | A structurally based approach to determine HLA compatibility at the humoral immune level[END_REF][START_REF] Duquesnoy | Clinical usefulness of HLAMatchmaker in HLA epitope matching for organ transplantation[END_REF] . The empirical approach by Terasaki verifies the existence of epitopes through the ability of antibodies to bind all alleles that share the same amino acid sequences exposed on the HLA molecule [START_REF] Cai | Development of Nondonor-Specific HLA-DR Antibodies in Allograft Recipients Is Associated with Shared Epitopes with Mismatched Donor DR Antigens[END_REF][START_REF] El-Awar | Human leukocyte antigen class I epitopes: update to 103 total epitopes, including the C locus[END_REF] . HLAMatchmaker is updated with the epitope registry (www.epregistry.com) and references those verified epitopes, referred to in this manuscript as "antibody-verified", besides the non-verified epitopes [START_REF] Duquesnoy | First report on the antibody verification of HLA-DR, HLA-DQ and HLA-DP epitopes recorded in the HLA Epitope Registry[END_REF] .

HLAMatchmaker compares donor and recipient HLA molecules at the structural level to infer the number of mismatched epitopes called the epitope load [START_REF] Duquesnoy | A structurally based approach to determine HLA compatibility at the humoral immune level[END_REF] . Using HLAMatchmaker, Wiebe et al. showed that class II epitope load was associated with the long-term risk of developing dnDSA [START_REF] Wiebe | Class II HLA Epitope Matching-A Strategy to Minimize De Novo Donor-Specific Antibody Development and Improve Outcomes: Class II Epitope Matching to Minimize De Novo DSA[END_REF] .

In our study, we hypothesized that preliminary determination of epitope load, in the daily clinical practice, could be a reliable and easy-to-use tool to identify patients at the highest risk of dnDSA development when a minimization of immunosuppression is envisioned. We tested this hypothesis in patients who were randomized for switching from cyclosporine (CsA) to everolimus three months post-transplantation [START_REF] Rostaing | Fibrosis progression according to epithelialmesenchymal transition profile: A randomized trial of everolimus versus CsA[END_REF] , a modification associated with a high incidence of early dnDSA (up to 27% at one year) and ABMR, and considered as a minimization of immunosuppression [START_REF] Liefeldt | Donor-specific HLA antibodies in a cohort comparing everolimus with cyclosporine after kidney transplantation[END_REF] . We also qualitatively determined whether some mismatched epitopes were more immunogenic than others, i.e., more prone to trigger dnDSA.

Results

Characteristics of the study population and clinical course of transplantations.

The patients who were switched at three months post-transplantation from CsA to everolimus (n=89) all received a first kidney transplant (Table1). None had DSA either at transplantation or at conversion. After a mean follow-up of 83.8 ± 27.9 months, 29 patients (32.6%: 25 before and 4 after month-12 post-transplantation) developed dnDSA, mainly against class II antigens (Figure 1). Twenty patients (22.5%) experienced a T-cell mediated rejection (TCMR) and five had a clinical episode of antibody-mediated rejection (ABMR) during the first year, all after conversion to everolimus [8 to 12 months post-transplantation]. Four other patients exhibited significant microvascular inflammation (g+ptc≥2) on the systematic month-12 biopsy. Five patients lost their graft due to TCMR, from 6 to 13 months after transplantation, with three patients presenting concomitant dnDSA and microvascular inflammation. Regarding the impact of dnDSA in the everolimus arm, patient survival was similar in patients with or without dnDSA (Figure 2A), whereas death-censored graft survival was significantly lower in patients with dnDSA: 62.5% versus 93.1% at 8 years, p=0.0005 (Figure 2B). Graft survival was similar in the two arms of treatment (Figure 2C). Renal function declined from month-3 in patients who developed dnDSA in the everolimus arm, but was similar in the two arms of treatment (Figure S1).

Evaluation of HLA compatibility with antigenic, allelic and epitopic mismatches

Table S1 shows the different levels of mismatches in the two arms of treatment, class II allelic and antibody-verified epitopic mismatches being higher in the everolimus arm.

Table 2 focuses on the distribution of the three levels of mismatches for the patients of the everolimus arm. Figure 3 shows how these values overlap, even if they are clearly correlated. The number of antigenic (Figure 3A/3B) and allelic (Figure 3D/3F) mismatches may under-or overestimate the level of epitopic incompatibility. The correlation of epitopic mismatches with allelic mismatches is not better than with antigenic mismatches. Donor/recipient pairs considered HLA identical at the antigen level may in fact present allelic (Figures 3C/3E) and epitopic (Figures 3A/3B) mismatches. Figure S2 shows that correlation with antibody-verified epitopes is even lower than with the total number of epitopes.

Figure 4A illustrates for two patients how epitope load may be more informative than antigenic mismatches. In both cases, there were one DR and one DQ mismatched antigens and four mismatched alleles (DRB1, DRB3/4/5, DQB1 and DQA1). The epitope load was low in the first case (8 DR -including one antibody-verified-and 8 DQ epitopic mismatches), but higher in the second (20 DR and 28 DQ epitopic mismatches with a high proportion of antibody-verified epitopes). Only the second patient developed DR and DQ dnDSA. Then, a given number of antigenic or allelic mismatches may underlie very different levels of epitopic mismatching.

Moreover, given antigenic mismatches may be associated with distinct epitope loads depending on structural differences between donor and recipient HLA. For example (Figure 4B), a DQ7 antigenic mismatch represents 1 epitopic mismatch for a DQ6/DQ9 recipient (panel-1), 8 mismatches for a DQ2/DQ4 recipient (panel-2), and 16 mismatches for a DQ2/DQ2 recipient (panel-3). The DQ2 homozygous patient can "see" more epitopic mismatches than the heterozygous DQ2/DQ4 recipient because the epitopes shared by DQ4 and DQ7 are not considered as "self". Regarding anti-DQ7 allosensitization, only the last two recipients developed a dnDSA.

Factors associated with the development of dnDSA

Patients with or without dnDSA had similar baseline characteristics (Table 1) except for age, and similar CsA (until month-3), everolimus (after month-3) and mycophenolic acid exposure (Table 3). Among the 89 patients, 21 experienced a premature discontinuation of everolimus (replaced by a CNI), after 1.9 ± 1.3 month of treatment but the frequency of dnDSA was similar compared with that of patients maintained on everolimus until month-12 (see Figure S3 for details on everolimus and rejections). Patients with dnDSA experienced more TCMR but the difference was not significant (Table 1). Table 4 summarizes antigenic, allelic and epitopic mismatches in relation with the occurrence of dnDSA. Whatever their class, dnDSA were more strongly associated with the number of antibody-verified epitopic mismatches than with the number of total epitopic mismatches, than with the number of antigenic mismatches. The number of allelic mismatches was only associated with class I or II DSA and with class II DSA, but at a lower level. The occurrence of DR dnDSA was only associated with the number of antibody-verified epitopes.

We performed a ROC curve analysis to determine the mismatch thresholds that best predicted the development of dnDSA for the different loci (Table 5). For class I or II, class I, class II and DQ DSA, AUC were always greater with antibody-verified and then total epitopic mismatches than with antigenic and allelic mismatches mismatches. As compared to the AUC of antigenic mismatches, statistical significance was not reached for any mismatches types. To note, the AUC of antibody-verified epitopic mismatches was nearly significant regarding the occurrence of dnDSA (class I or II) (p=0.06). The global relative risk for developing any dnDSA, regardless of class, was 2.0 for more than 6 antigenic mismatches, 8.0 for more than 15 verified epitopes and 12.2 for more than 27 total epitopic mismatches. In identifying patients who developed class I or II dnDSA, using the above-mentioned thresholds, antigenic mismatches would have missed 8 patients compared with only one for epitope load (Figure 5). The same results were obtained in the transplantations for which a donor and recipient allelic typing could be performed.

Multivariate logistic regressions (Table 6) showed that epitope load, as a continuous variable, was the only factor independently associated with the risk of developing class I or II dnDSA.

Interestingly, there was no correlation between the occurrence of ABMR or TCMR, or isolated microvascular inflammation on month-12 biopsy, and any level of mismatches (Table S2).

Regarding the influence of immunosuppression, occurrence of dnDSA was delayed and less frequent in the cyclosporine group than in the everolimus arm. Indeed, 16 patients (18.6%), 3 before and 13 after month-12, developed dnDSA whereas 29 patients (32.6%, p=0.034) developed DSA in the everolimus group. Five-year graft survival without DSA was 85% in the cyclosporine group versus 69.1% in the everolimus group (p=0.026, Figure 6). Under cyclosporine, according to ROC curve analysis, the thresholds associated with the occurrence of class I or II dnDSA were lower: 5 (antigenic mismatches), 6 (allelic mismatches), 22 (total epitopes) and 16 (antibody-verified epitopes). The antibody-verified epitope load was similar in patients in the everolimus arm not developing dnDSA and in the cyclosporine group (14.8 ± 7.0 versus 15.2 ± 6.6, p=0.7). However, the proportion of patients who developed dnDSA with an epitope load above the threshold which is similar (15 for everolimus, 16 for cyclosporine) is higher in the everolimus arm: 48.2% versus 26.1 %, p=0.02.

Identification of the most immunogenic epitopes

DQ7 was the most frequent antigenic target of dnDSA. Considering the 23 DQ7 negative patients who received a DQ7 positive graft, the number of mismatched DQ7 epitopes was significantly higher in the 11 patients (47.8 %) who developed a DQ7 dnDSA (Figure 7A and 7B). Qualitatively, several DQ7 epitopes were significantly more often mismatched when the recipients developed anti-DQ7 dnDSA (Odds-Ratio 11.6 to 23.9), such as 55PP and 77T (antibody-verified) or 37YA, 70RT and 74EL (non-verified). Others were mismatched either with a similar frequency regardless of the development of anti-DQ7 dnDSA (52PL, 140T, 182N, 56PD, 45EV, 14AM, 26Y) (Figure 7C), or in too few cases (0 to 3 cases) for a statistical comparison.

We verified that anti-DQ7 dnDSA often recognized these mismatched epitopes by analyzing serum reactivity using HLAMatchmaker (Table 7). In 6 of the 10 cases we could analyze, the targeted epitope was 55PP or 77T, two antibody-verified epitopes that were mismatched significantly more often (Figure 7).

Discussion

In this study, we took advantage of the high incidence of dnDSA after switching from CsA to everolimus to show that the epitope load was a more reliable method for assessing HLA compatibility than the mere counting of antigenic mismatches.

In two recent studies, the number of HLA antigenic mismatches was a strong predictor of long-term graft survival [START_REF] Opelz | Effect of human leukocyte antigen compatibility on kidney graft survival: comparative analysis of two decades[END_REF][START_REF] Williams | The Risk of Transplant Failure With HLA Mismatch in First Adult Kidney Allografts From Deceased Donors[END_REF] . HLA compatibility is involved in the allogenic immune response, and especially in class II dnDSA development [START_REF] Wiebe | Evolution and Clinical Pathologic Correlations of De Novo Donor-Specific HLA Antibody Post Kidney Transplant[END_REF][START_REF] Everly | Incidence and Impact of De Novo Donor-Specific Alloantibody in Primary Renal Allografts[END_REF] , critically associated with worse post-transplant outcomes [START_REF] Willicombe | De Novo DQ Donor-Specific Antibodies Are Associated With a Significant Risk of Antibody-Mediated Rejection and Transplant Glomerulopathy[END_REF][START_REF] Hidalgo | De Novo Donor-Specific Antibody at the Time of Kidney Transplant Biopsy Associates with Microvascular Pathology and Late Graft Failure[END_REF][START_REF] Everly | Incidence and Impact of De Novo Donor-Specific Alloantibody in Primary Renal Allografts[END_REF][START_REF] Ginevri | Posttransplant De Novo Donor-Specific HLA Antibodies Identify Pediatric Kidney Recipients at Risk for Late Antibody-Mediated Rejection[END_REF][START_REF] Devos | Donor-specific HLA-DQ antibodies may contribute to poor graft outcome after renal transplantation[END_REF] . Given the difficulty of controlling other factors, such as poor adherence, it is important to identify a priori the patients at the highest risk of post-transplant sensitization.

HLA matching has been traditionally based on serologically defined HLA antigens, although anti-HLA antibodies react against specific epitopes and not against the antigen as a whole [START_REF] El-Awar | HLA Class I Epitopes: Recognition of Binding Sites by mAbs or Eluted Alloantibody Confirmed With Single Recombinant Antigens[END_REF][START_REF] Cai | Development of Nondonor-Specific HLA-DR Antibodies in Allograft Recipients Is Associated with Shared Epitopes with Mismatched Donor DR Antigens[END_REF] . Epitopes in an HLA molecule can be deduced from allelic typing but not from serologic typing. Therefore, simply counting antigenic mismatches does not allow for the reliable identification of mismatched epitopes.

Molecular techniques for typing and crystallographic studies [START_REF] Saper | Refined structure of the human histocompatibility antigen HLA-A2 at 2.6 A resolution[END_REF][START_REF] Gorga | Crystallization of HLA-DR antigens[END_REF] have provided a better understanding of the central role of epitopes as the targets of alloantibodies. HLA antigens are in fact groups of close alleles with minor sequence differences resulting in the expression of mismatched epitopes that can even stimulate the synthesis of alloantibodies within the same allelic group.

We compared the predictive value of the traditional antigen-based and the new epitopebased approaches. We showed that the two approaches were correlated, but that the epitope load was more informative, as antigenic mismatches may over-or underestimate the real level of incompatibility.

Before the development of single antigen beads, Dankers et al. found a correlation between graft failure, DSA and the number of "triplet" (three amino acid epitope) mismatches [START_REF] Dankers | The number of amino acid triplet differences between patient and donor is predictive for the antibody reactivity against mismatched human leukocyte antigens[END_REF] . More recently, using the latest "eplet" version of HLAMatchmaker and single-antigen bead assays, Wiebe et al. showed that class II epitope loads, together with non-adherence and acute rejection, were independent risk factors of long-term dnDSA [START_REF] Wiebe | Class II HLA Epitope Matching-A Strategy to Minimize De Novo Donor-Specific Antibody Development and Improve Outcomes: Class II Epitope Matching to Minimize De Novo DSA[END_REF] .

We confirmed that in the context of immunosuppression minimization, epitope load is useful to identify patients at highest risk of developing dnDSA rapidly after the modification, whatever the class of these DSA. Epitope load was more strongly associated with the development of class I or II dnDSA than the number of antigenic or allelic mismatches, with a discriminative threshold of 27 class I+II epitopic mismatches.

Furthermore, the number of mismatched antibody-verified epitopes was more closely associated with dnDSA development than the total number of epitopes. It is likely that many (if not all) of the not verified epitopes, have physicochemical properties or localization that do not make them accessible to alloantibodies.

Another advantage of the epitopic approach is the ability to study the immunogenicity of epitopes. Indeed, our study, as the one by Wiebe et al [START_REF] Wiebe | Class II HLA Epitope Matching-A Strategy to Minimize De Novo Donor-Specific Antibody Development and Improve Outcomes: Class II Epitope Matching to Minimize De Novo DSA[END_REF] , suggests that some mismatched antibody-verified epitopes are more frequently associated with the development of dnDSA than others and, thus, are more immunogenic, which is possibly based on their exposed position. Pre-transplant identification of mismatched or targeted epitopes (for immunized patients) could be a new tool for assessing immunological risk. One could hypothesize that the greater the epitope load, the higher the probability that the recipient's immune system will respond to at least one immunogenic epitope.

A limitation of our study is the small cohort size and the lack of power that prevented us to show a significantly higher discriminative value of epitope loads in ROC curve analysis, despite the positive result of logistic regression. Thus, the relative role of epitope load should be explored in larger populations. Moreover, for one third of patients, epitope load was calculated with allelic typing deduced from generic typing using the HaploStats application [START_REF] Gragert | Six-locus high resolution HLA haplotype frequencies derived from mixed-resolution DNA typing for the entire US donor registry[END_REF] , because DNA was not available anymore; this may increase the uncertainty of the data. Nevertheless, we confirmed the accuracy of HaploStats for the French Caucasian population [START_REF] Pedron | Listing of Common HLA Alleles and Haplotypes Based on the Study of 356 Families Residing in the Paris, France, Area: Implications for Unrelated Hematopoietic Stem Cell Donor Selection[END_REF] (Table S3). Moreover, DRB3/4/5 and DQA1 typing were rarely performed because of their strong linkage disequilibrium with DRB1 and DQB1 alleles [START_REF] Klitz | New HLA haplotype frequency reference standards: high-resolution and large sample typing of HLA DR-DQ haplotypes in a sample of European Americans[END_REF][START_REF] Knipper | HLA-DRB1,3,4,5 and -DQB1 allele frequencies and HLA-DR/DQ linkage disequilibrium of 231 German caucasoid patients and their corresponding 821 potential unrelated stem cell transplants[END_REF] . We have shown in Table S4 and S5 that the potential errors would have a weak impact on epitope load calculation. Eventually, we did not study DQA1, DPB1 and DPA1 epitope loads in relation with dnDSA because only two patients developed DQA1 and two others DPB1 dnDSA, and always in association with other DSA.

Moreover, these DSA are not consensually recognized as pathogenic as those targeting other HLA loci molecules.

We did not identify any association between epitope load and TCMR or ABMR. TCMR involves T-cell epitopes that are different from B-cell epitopes, although they may be involved in dnDSA generation [START_REF] Lachmann | Donor-Recipient Matching Based on Predicted Indirectly Recognizable HLA Epitopes Independently Predicts the Incidence of De Novo Donor-Specific HLA Antibodies Following Renal Transplantation[END_REF] Sapir-Pichhadze et al. described an association between transplant glomerulopathy and the DR+DQ eplet load in kidney transplant recipients [START_REF] Sapir-Pichhadze | HLA-DR and -DQ Eplet Mismatches and Transplant Glomerulopathy: A Nested Case-Control Study: HLA-DR + DQ Eplet Mismatches and TG[END_REF] . Using an electronic system of adherence monitoring, Wiebe et al. found that the combination of poor adherence and higher epitope load acted synergistically, but not separately, to determine the risk of ABMR (DQ) or graft loss (DR and DQ) [START_REF] Wiebe | The Synergistic Effect of Class II HLA Epitope-Mismatch and Nonadherence on Acute Rejection and Graft Survival[END_REF] . In our study, the adherence was not specifically studied, but the close follow-up during the first posttransplantation year and the context of a clinical trial [START_REF] Rostaing | Fibrosis progression according to epithelialmesenchymal transition profile: A randomized trial of everolimus versus CsA[END_REF] make the probability of poor adherence low. Moreover, the similar exposure to everolimus in patients who developed or not DSA, suggests that it did not play a major role in DSA occurrence. Interestingly, we found a lower epitope load threshold for the development of DQ dnDSA than Wiebe et al [START_REF] Wiebe | Class II HLA Epitope Matching-A Strategy to Minimize De Novo Donor-Specific Antibody Development and Improve Outcomes: Class II Epitope Matching to Minimize De Novo DSA[END_REF] (8 versus 17), possibly because we did not take into account DQA epitopes.

In our study, conversion to everolimus may have played a critical role in the development of dnDSA and therefore cannot be advocated, even if patients at risk may be identified. Given that antibody-verified epitope load was higher in the everolimus arm, we cannot rule out that patients under everolimus would have eventually developed dnDSA while remaining on cyclosporine. However, dnDSA appeared more frequently and earlier after conversion to everolimus. Moreover, even if TCMR was observed in 34.5% of patients who developed dnDSA, most of the patients (19/29) who developed dnDSA did not experience TCMR. This was confirmed in the multivariate analysis that found that epitope load was the only independent factor associated with dnDSA. Our study was similar to the one by Hricik et al. [START_REF] Hricik | Clinical Trials in Organ Transplantation-09 Consortium. Adverse Outcomes of Tacrolimus Withdrawal in Immune-Quiescent Kidney Transplant Recipients[END_REF] but we benefited of a larger cohort. They showed retrospectively in 14 kidney transplant recipients randomized to wean off tacrolimus that the 5 patients who developed anti-DQ dnDSA had an epitope load above the threshold of 16 epitopic mismatches [START_REF] Hricik | Clinical Trials in Organ Transplantation-09 Consortium. Adverse Outcomes of Tacrolimus Withdrawal in Immune-Quiescent Kidney Transplant Recipients[END_REF] .

In conclusion, our study revealed that epitope load is a more informative and predictive tool than the number of antigenic or allelic mismatches for determining the risk of posttransplant allosensitization, particularly the short-term risk following minimization of immunosuppression. We think that in a daily practice, when reduction of immunosuppression is discussed, clinicians could right now implement epitope load for the identification of patients for whom such a minimization may be hazardous. If epitope load is above the threshold, minimization should only be performed in case of clinical indication and with a strict follow up of dnDSA. We think that epitope load, and not solely antigenic mismatches, should also be calculated and provided in published clinical studies to compare the level of incompatibility of two groups of patients, particularly in clinical trials assessing a modification of immunosuppression. This study provides a basis for large-scale studies and for the use of epitope load in allocation policies.

Methods

Patient population

The patients included in our study had been previously randomized in a controlled trial for conversion from CsA to everolimus three months post-transplantation [START_REF] Rostaing | Fibrosis progression according to epithelialmesenchymal transition profile: A randomized trial of everolimus versus CsA[END_REF] . In brief, kidney transplant recipients were randomized into two treatment groups corresponding to maintenance on CsA or conversion to everolimus, both in conjunction with mycophenolic acid and steroid treatment. Patients were excluded if they had experienced TCMR prior to randomization, or were positive for DSA. Patients randomized to CsA withdrawal received everolimus adjusted to target a C0 concentration of 6-10 ng/mL. Mycophenolic acid was started at 720 mg b.i.d and decreased at 360 mg b.i.d. after month-3 only in the everolimus arm. The diagnosis of ABMR was made according to the 09' update of the Banff 97 classification [START_REF] Sis | Banff '09 meeting report: antibody mediated graft deterioration and implementation of Banff working groups[END_REF] .

Determination of HLA allelic typing

DNA was available for retrospective complete allelic typing (A,B,C,DRB1,DQB1) for 68 recipients and 62 donors in the everolimus arm. This retrospective typing was performed at the laboratory of Immunology of Saint-Louis Hospital, with next generation sequencing (Reagents : GenDX company, analyzed on a Illumina MiSeq sequencer with the NGSEngine software) (Bedia, Chavenay, France) or high resolution PCR-specific sequence oligonucleotides (HD-SSO LabType, One Lambda, Ingen, Chatenay-Malabry, France), the latter when only two loci or less were to be analyzed.

For the remaining cases, only the initial typing locally performed by lymphocytotoxicity, sequence-specific PCR primers (SSP) or low-resolution SSO, was available. DQA typing was only available for 27 donors and 14 recipients. For the remaining patients, DQA1 typing was inferred from the well-described tight linkage disequilibrium with DRB1 and DQB1 alleles [START_REF] Klitz | New HLA haplotype frequency reference standards: high-resolution and large sample typing of HLA DR-DQ haplotypes in a sample of European Americans[END_REF] . DRB3/4/5 typing is not performed in France but is also inferred from the well-known associations with DRB1 genes [START_REF] Knipper | HLA-DRB1,3,4,5 and -DQB1 allele frequencies and HLA-DR/DQ linkage disequilibrium of 231 German caucasoid patients and their corresponding 821 potential unrelated stem cell transplants[END_REF] . DPB and DPA typing were not performed.

The missing allelles were inferred from their haplotype associations with HaploStats, a modified expectation-maximization algorithm provided by the National Marrow Donor Program [START_REF] Gragert | Six-locus high resolution HLA haplotype frequencies derived from mixed-resolution DNA typing for the entire US donor registry[END_REF] . The frequency of haplotypes was questioned for Caucasian populations(including Middle East and Africa's North Coast). HaploStats outputs the list of all possible unphased allelic typings for HLA A, B, C, DRB1, DRB3/4/5, and DQB1 loci and the likelihood for each pair of haplotypes. These typing were confirmed when possible with the list of common French HLA haplotypes [START_REF] Pedron | Listing of Common HLA Alleles and Haplotypes Based on the Study of 356 Families Residing in the Paris, France, Area: Implications for Unrelated Hematopoietic Stem Cell Donor Selection[END_REF] , which may lead to some infrequent errors (Table S3).

Determination of epitope load with HLAMatchmaker software

Once computed, allelic donor and recipient HLA typings were entered into HLAMatchmaker [START_REF] Duquesnoy | Clinical usefulness of HLAMatchmaker in HLA epitope matching for organ transplantation[END_REF] , a Microsoft Excel-based software (ABCepletmatching Vs1 for class I and DRDQDPepletmatching Vs1 for class II). This algorithm applies two principles: (1) each HLA antigen is represented as a distinct string of structurally defined epitopes that correspond to many potential immunogens that can induce specific antibodies, and (2) patients cannot make antibodies against epitopes expressed by their own HLA molecules. It assesses donor-recipient compatibility through intra-locus and inter-locus comparisons. Class I and II epitope loads are the number of epitopes expressed by the donor but not by the recipient.

Identification of DSA and of targeted epitopes

To rule out the presence of DSA before transplantation, all centers conducted pretransplant systematic Luminex single antigen (SA) or Luminex screenings (every 3 to 6 months). A Luminex SA test was performed if the screening became positive.

During the post-transplantation period, all patients underwent Luminex screening at month-3 (randomization), month-12 (end of the study) and then annually. A Luminex SA test was performed if the screening became positive. Luminex assays were performed using One Lambda kits (Canoga Park, CA) except for three patients tested using Lifecodes kits (Immucor, Norcross, GA).

In DQ7 negative patients who received a DQ7 positive graft and developed anti-DQ7 dnDSA, we used the HLAMatchmaker DRDQDP software to determine which DQ7 epitopes were targeted by serum antibodies. Briefly, we entered the MFI of the class II Luminex single antigen beads into HLAMatchmaker ("DRDQDP antibody analysis V01"). The DQ epitopes of the recipient and of the negative beads were excluded as potential candidates for targeted epitopes. We examined the positive beads and determined which epitopes shared across these positive alleles could explain the reactivity pattern.

Statistical analysis

The results are expressed as the mean ± SD for continuous variables or percentages for categorical data. Comparisons were based on Student's t tests for normally distributed continuous data or Wilcoxon Rank Sums tests for nonparametric univariate analysis, and on χ 2 tests or exact Fisher's tests for categorical data. Receiver operating characteristic (ROC) curve analysis was performed with the pROC package [START_REF] Robin | pROC: an open-source package for R and S+ to analyze and compare ROC curves[END_REF] to determine the optimal epitopic mismatch threshold that best predicted dnDSA development. This value was associated with the highest true positive rate and the lowest false positive rate. A two-sided p-value of 0.05 was considered statistically significant. AUC corresponding to the different types of mismatches were compared using the Delong method. Crude and adjusted odds ratio of graft loss according to number of epitopic mismatches were estimated using logistic regression. Potential adjustment covariates were antigenic mismatches, mean everolimus level, recipient and donor ages, and TCMR. Only covariates associated with a p-value < 0.1 were included in the final model using stepwise forward selection. Statistical analyses were performed using R software. R: A language and environment for statistical computing. R Foundation for Statistical Computing, Vienna, Austria. In patients from the cyclosporine arm (red line) or everolimus (black line). p-value corresponds to log-rank test

Disclosures None

Figure 1 .Figure 2 .

 12 Figure 1. Number of patients with occurrence of de novo DSA in the study population. Patients were included in the trial before transplantation, received a treatment based on cyclosporine and were randomized at three months posttransplantation to be maintained on cyclosporine or switched to everolimus. Abbreviations: MPA mycophenolic acid

Figure 3 .

 3 Figure 3. Comparison of the numbers of antigenic, allelic and epitopic mismatches in the study population. A and B) Comparison of class I (A) and class II (B) antigenic and epitope mismatches. For example, patients with a maximal value of 6 class I antigenic mismatches actually displayed an epitope load ranging from 13 to 36. Conversely, patients with the median value (n=15) of class I epitopic mismatches displayed 2 to 6 antigenic mismatches. The maximal number of antigenic mismatches is 6 for class I (2 for each locus HLA-A, B and Cw) and 4 for class II (2 for DR and DQB locus). C and D) Comparison of class II antigenic and allelic mismatches including DQA alleles (C), and of class II allelic and epitopic mismatches including DQA alleles (D). Patients with 3, 4, 5, 6 and, to a lesser degree, 7/8 class II allelic mismatches had very similar distributions of epitope load, although all these patients would be considered as having a growing level of incompatibility. Conversely, patients with a given number of allelic mismatches, for example 6, may have many epitopic mismatches ranging from 10 to 51. E and F) Comparison of class II antigenic and allelic mismatches excluding DQA alleles (E) and class II allelic and epitope mismatches excluding DQA alleles (F). Each floating bar represents the minimum and maximum values, and the line corresponds to the median value. The maximal number of allelic mismatches is 8 (Panels C/D: 2 for each locus HLA-DRB1, DRBW, DQB, DQA) or 6 without DQA (Panels E/F).

Figure 4 .

 4 Figure 4. Evaluation of HLA compatibility with antigenic, allelic and epitope mismatches. A) An example of two patients with the same number of class II antigenic (n=2) and allelic (n=4) mismatches but with different epitope loads (11 and 48), including DQA epitopes. The second patient developed de novo class II DSA. B) An example of three DQ7-negative recipients who received a DQ7-positive transplant. The same DQ7 antigenic mismatch was associated with different DQ7 specific epitope loads according to the recipient's DQB typing. Alpha chains are shown in pink, beta chains are in blue, and peptides are in brown. Mismatched epitopes are in yellow (beta chain epitopes are shown in normal font, and alpha chain epitopes are shown in italic font).

Figure 5 .

 5 Figure 5. Distribution of patients who developed or not dnDSA, according to antigenic and epitopic mismatches. Patients with (black dots) or without (empty dots) class I or II dnDSA, according to the total number of antigenic (A+B+C+DR+DQB1) and epitopic (A+B+C+DR+DQB1) mismatches. Horizontal dashed/dotted line corresponds to the threshold of 27 epitopic mismatches and vertical line to the threshold of 6 antigenic mismatches (see Table5).

  ).

Figure 6 .

 6 Figure 6. Survival without de novo DSA.

Figure 7 .

 7 Figure 7. Comparison of specific DQ7 epitopic mismatches in patients who developed or did not develop DQ7 DSA. DQ7 specific epitope load including all DQ7 epitopes (A) or only antibody-verified epitopes (B) in DQ7-negative patients who received a DQ7-positive transplant and did or did not develop a DQ7 dnDSA after transplantation. C) Frequency of mismatched DQ7 epitopes in DQ7-negative patients who received a DQ7-positive transplant and did or did not develop a DQ7 dnDSA. *p<0.05. RR: relative risk of DQ7 dnDSA in cases of mismatched epitopes.

Table 1 : Characteristics of the study population

 1

		Whole	dnDSA	no dnDSA p
	Recipients	group
	N	89	29	60
	Age, yrs (mean ± SD)	48.2 ± 12.5 42.9 ± 14.0 50.8 ± 10.9 0.005
	Sex, N (%) of males	59 (66.3)	22 (75.9)	37 (61.7)	0.18
	Nephropathy, N (%)				0.80
	Diabetes	9 (10.1)	4 (13.8)	5 (8.3)
	Glomerular disease	28 (31.5)	9 (31.0)	19 (31.7)
	Nephroangiosclerosis	5 (5.6)	2 (6.9)	3 (5.0)
	Interstitial nephritis	12 (13.5)	5 (17.2)	7 (11.7)
	Polycystic disease	16 (18.0)	4 (13.8)	12 (20.0)
	Other	11 (12.4)	4 (13.8)	7 (11.7)
	Unknown	8 (9.0)	1 (3.4)	7 (11.7)
	No dialysis before transplantation,
	N (%)	6 (6.7)	1 (3.4)	5 (8,3)	0.66
	Positive PRA, N a (%)	5 (6.5)	0 (0)	5 (10)	0.16
	Mean PRA (%)	0.8 ± 3.8	0	1.2 ± 4.7	0.09
	Donors
	Age, yrs (mean ± SD)	47.5 ± 14.9 43.4 ± 14.8 49.4 ± 14.6 0.07
	Deceased donor / living donor (%)	92.1 / 7.9	93.1 / 6.9	91.7 / 8.3	1.0
	Cerebrovascular death, N b (%)	46 (56.8)	13 (50.0)	33 (60.0)	0.47
	Delayed graft function, N (%)	16 (18.0)	7 (24.1)	9(15.0)	0.38
	T-cell Mediated Rejection, N(%)	20 (22.5)	10 (34.5)	10 (16.7)	0.10
	a: information available for 77 patients
	b: information available for 81 patients
	Abbreviations. dnDSA: de novo donor-specific antibody; SD: standard deviation;
	PRA: panel reactive antibody

Table 3 : Exposure to imunosuppressive drugs and de novo DSA

 3

	De novo DSA	No de novo DSA	p

Table 4 : Relationship between the occurrence of de novo DSA and antigenic, allelic and epitopic mismatches

 4

	N.	N. of Antigenic	N. of Allelic	N. of Epitope	N. of abv Epitope
	patients	mismatches	mismatches	mismatches	mismatches
	(DSA+ /	(DSA+ vs		(DSA+		(DSA+ vs		(DSA+ vs
	DSA-)	DSA-)	p	vs DSA-)	p	DSA-)	p	DSA-)	p
	Class I or II DSA
	6.5 ± 1.8 vs		8.2 ± 2.1 vs		44.5 ± 11.6 vs		21.6 ± 6.3 vs
	29 / 60	5.4 ± 1.8	0.015	7.1 ± 2.1	0.026	32.0 ± 14.2	<0.0005	14.8 ± 7.0	5.7 e-5
	Class I DSA
	4.8 ± 0.8 vs		5.0 ± 0.7 vs		23.2 ± 7.0 vs		13.2 ± 3.1 vs
	5/ 84	3.7 ± 1.4	0.07	4.1 ± 1.3	0.11	14.7 ± 6.1	0.014	8.2 ± 3.9	0.009
	Class II DSA *
	2.5 ± 0.9 vs		3.8 ± 1.4 vs		27.6 ± 9.9 vs		12.1 ± 5.4 vs
	28 / 61	1.7 ± 1.2	0.003	3.0 ± 1.3	0.024	17.9 ± 12.4	0.0003	6.8 ± 6.1	4.8 e-5
	DR DSA
	1.2 ± 0.4 vs		1.2 ± 0.4 vs		16.8 ± 8.2 vs		7.0 ± 4.5 vs
	6 / 83	1.0 ± 0.6	0.45	1.3 ± 0.6	0.41	10.4 ± 7.8	0.07	3.5 ± 3.5	0.04
	DQ DSA *
	1.3 ± 0.5 vs		1.4 ± 0.5 vs		13.5 ± 5.2 vs		6.8 ± 3.3 vs
	25 / 64	0.9 ± 0.7	0.006	1.2 ± 0.6	0.18	8.7 ± 8.2	0.0005	3.9 ± 4.8	<0.0005
	Abbreviations: N number, abv: antibody-verified, * DQ and Class II mismatches do not
	include DQA

Table 5 . Thresholds of antigenic, allelic and epitope mismatches predictive of the occurrence of dnDSA

 5 Abbreviations. MM: mismatch, AUC: Area Under the Curve, exc: excluding, N: Number, RR: Relative Risk, CI: Confidence Interval, NA: not applicable, Freq: Frequency, a: the first pvalue corresponds to the comparison with the AUC of antigenic mismatches with the De Long methods. The second p value corresponds to the Fisher test performed to compare the proportion of patients with dnDSA in patients with a number of mismatches above the threshold and in patients with a number of mismatches below the threshold, c: DQ and Class II mismatches do not include DQA

		Antigenic MM	Allelic MM	Epitopic MM	Abv Epitopic MM
	DSA I or II
	AUC	0.658	0.645	0.749	0.764
	P a (comparison with antigenic MM)	--	0.71	0.10	0.06
	Threshold	6	7	27	15
	N patients(%) above the threshold	50(56.2%)	60(67.4)	62 (69.7)	56(62.9)
	Freq of DSA (above vs below,%), p b 42.0 vs 20.5, p=0.03	41.7 vs 13.8, p=0.009	45.2 vs 3.7 p=0.0001	48.2 vs 6.1 p=4.2 e-5
	RR 95CI	2.05 [1.02-4.12]	3.02 [1.2-7.9]	12.2 [1.7 -85.1]	8.0 [2.0-31.3]
	DSA CLASS I
	AUC	0.738	0.710	0.830	0.849
	p a (comparison with antigenic MM) --	0.59	0.36	0.16
	Threshold	4	5	19	10
	N patients(%) above the threshold	55 (61.8)	37 (41.6)	26(29.2)	35(39.3)
	Freq of DSA (above vs below,%), p b 9.1 vs 0.0, p=0.07	10.8 vs 1.9 p=0.16	15.4 vs 1.6, p=0.025	14.3 vs 0.0, p=0.008
	RR 95CI	NA	5.6 [0.7-48.3]	9.7 [1.1-82.6]	NA
	Class II DSA c
	AUC	0.684	0.644	0.738	0.769
	p a (comparison with antigenic MM) --	0.40	0.34	0.15
	Threshold	2	3	18	10
	N patients(%) above the threshold	64(71.9)	67(75.3)	50(56.2)	61(68.5)
	Freq of DSA (above vs below,%), p b 39.1 vs 0.0, p=0.002	32.8 vs 13.6, p=0.08	44.0 vs 7.7, p=1.10-4	39.3 vs 3.6, p<5.10-4
	RR 95CI	NA	2.4 [0.8-7.3]	5.7 [1.8-17.7]	11.0 [1.6-77.4]
	DQ DSA c
	AUC	0.667	0.577	0.737	0.741
	p a (comparison with antigenic MM) --	0.02	0.23	0.22
	Threshold	1	2	8	2
	N patients(%) above the threshold	69(77.5)	26(29.2)	56(62.9)	57(64.0)
	Freq of DSA (above vs below,%), p b 34.8 vs 0.0, p=0.002	34.6 vs 23.8, p=0.30	41.1 vs 3.0, p<1.10-4	40.4 vs 3.1, p=1.10-4
	RR 95CI	NA	1.5 [0.7-2.9]	13.6 [1.9-95.8]	12.9 [1.8-91.2]

Acknowledgments

The authors would like thank Dr Vincent Elsermans (Lille), Dr Nicolas Congy (Toulouse), Dr Anne Parissiadis (Strasbourg), Dr Alice Aarnink (Nancy), Dr Valérie Dubois (Lyon), Dr Abdelhamid Assaqa (Tours), Dr Nicolas Guillaume (Amiens), Dr Olivier Toutirais (Caen) Dr Dominique Masson (Grenoble), Dr Thierry Tabary (Reims), M. Fabien Duthe for providing the HLA data.

Supplementary Materials

'Supplementary information is available at Kidney International's website' Supplementary Table 1: HLA matching of the two arms of the randomized trial Supplementary Table 2 HLA mismatches according to the occurrence of TCMR or ABMR and the occurrence of dnDSA in patients with rejection Supplementary Table 3


Delphine Gérardin
email: gerardin@lpsc.in2p3.fr

Anna Chiara Uggenti
email: anna.uggenti@polito.it

Stéphane Beils
email: stephane.beils@framatome.com

Andrea Carpignano
email: andrea.carpignano@polito.it

Sandra Dulla
email: sandra.dulla@polito.it

Elsa Merle
email: merle@lpsc.in2p3.fr

Daniel Heuer
email: daniel.heuer@lpsc.in2p3.fr

Axel Laureau
email: laureau.axel@gmail.com

Michel Allibert
email: mallibert@orange.fr

Anna Chiara Uggenti

A methodology for the identification of the postulated initiating events of the Molten Salt Fast Reactor

Keywords: Molten Salt Fast Reactor, risk analysis, initiating events, MLD, FFMEA

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The Generation IV International Forum (GIF) has established a set of goals as research directions for future nuclear systems, which are sustainability, safety and reliability, economic competitiveness, proliferation resistance and physical protection [START_REF] Gif | Technology Roadmap Update for Generation IV Nuclear Energy Systems[END_REF]. These goals provided the basis for selecting six nuclear energy systems for further development. Among them, the Molten Salt Fast Reactor (MSFR) was retained in 2008 for its promising design and safety characteristics [START_REF] Serp | The molten salt reactor (MSR) in generation IV: Overview and Perspectives[END_REF] and is currently studied in the frame of the Horizon2020 program SAMOFAR (Safety Assessment of the Molten Salt Fast Reactor). The objective of SAMOFAR is to prove the innovative safety concepts of the MSFR by advanced experimental and numerical techniques and to deliver a breakthrough in nuclear safety. Improved safety being recognized as a priority in the development and operation of nuclear systems, the development of a safety approach suitable for the MSFR and its application to the reactor is one of the main tasks of the SAMOFAR project. Indeed, because of its unique characteristics (e.g. the liquid circulating fuel playing also the role of coolant), the MSFR calls for a new safety approach based on technological neutral methodologies and relying on the fundamental safety principles [START_REF] Iaea | IAEA Safety Standard for protecting people and environment, Fundamental Safety Principles[END_REF]. In addition, the analysis tools selected have to be adapted to the MSFR early design phases. Moreover, the safety assessment should be performed in parallel to the design studies allowing to influence the direction of the concept and the design development since its earliest stages by giving useful feedbacks and guidance to the designer in order to achieve a safety that is "built in" rather than "added on" [START_REF] Gif Rswg | Basis for the Safety Approach for Design and Assessment of Generation IV Nuclear Systems Revision 1[END_REF]. To fulfil these objectives, an integral safety assessment methodology for MSFRs has been proposed in the frame of the SAMOFAR project [START_REF] Carpignano | Development on an integral safety assessment methodology for MSFRs[END_REF] and is based on the GIF Integrated Safety Assessment Methodology (ISAM) [START_REF] Gif Rswg | An Integrated Safety Assessment Methodology (ISAM) for Generation IV Nuclear Systems[END_REF] and the methodology developed in the framework of the SARGENIV [START_REF] Wattelle | Proposal for a harmonized European methodology for the safety assessment of innovative reactors with fast neutron spectrum to be built in Europe[END_REF]. These methodologies are selected as conceptual methodologies by the partners of the SAMOFAR project and successively adapted to the peculiar case of the MSFR through the addition of suitable safety analysis tools to the methodology. A point of strength of ISAM is the direct link with the different levels of Defence-in-Depth (DiD): these levels, as well as the entire methodology, depends on the definition of the severe accident, risk metrics and physical barriers that represent still an argument of discussion for the MSFR. Therefore, the direct implementation of some of the tools of the ISAM to the MSFR resulted in being difficult, given the preliminary stage of the safety analysis and design of this concept. To overcome these difficulties, it has been chosen to rather use the ISAM as a guideline to formalize the objectives to be achieved.

The first step of the ISAM, the Qualitative Safety Features Review (QSR), has been partly applied to the MSFR [START_REF] Brovchenko | Etudes préliminaires de sûreté du réacteur à sels fondus MSFR[END_REF] and has pointed out the risk of fuel leak as a potential weak point of the design. This analysis has led to an evolution of the MSFR fuel circuit design in order to better cope with the risk of leak [START_REF] Gérardin | Design Evolutions of the Molten Salt Fast Reactor[END_REF]. In a second step, the identification of the MSFR hazards has been undertaken. In this phase of risk assessment, it has been chosen to perform the identification of the hazards without defining the DiD levels concerned, whereas in a later stage, the completion with the DiD level identification could be of help to ensure that the safety architecture is well balanced, consistently with the Objective Provision Tree analytical tool reckoned in the ISAM. This paper focuses on the identification of the potential hazards likely to challenge the MSFR safety and the elaboration of a list Postulated Initiating Events (PIEs), which is a core part of the global assessment methodology. To fulfil this task, the Functional Failure Mode and Effect Analysis (FFMEA) [START_REF] Pinna | Functional Failure Mode and Effect Analysis (FFMEA) for the DEMO cooling systems of the WCLL blanket model[END_REF], which is suggested as complementary tool to fulfil this objective in the ISAM presentation, see [START_REF] Gif Rswg | An Integrated Safety Assessment Methodology (ISAM) for Generation IV Nuclear Systems[END_REF], and the Master Logic Diagram (MLD) [START_REF] Papazoglou | Master Logic Diagram: method for hazard and initiating event identification in process plants[END_REF], which is a top-down method with a tree structure (mentioned for initiating events identification in one of the presented option in the guidance document for the application of the ISAM, see [START_REF] Gif Rswg | Guidance Document for Integrated Safety Assessment Methodology (ISAM) -(GDI)[END_REF]), are selected and employed separately in order to be as exhaustive as possible in the identification of initiating events. Moreover, the members of the team performing the analysis have expertise in the implementation of these tools. Then, the PIEs are selected as the most representative events resulting from the implementation of both methods. The final list of PIEs will be a major input for the later steps of the global safety assessment methodology as the Deterministic Safety Analysis or the Probabilistic Safety Analysis. One main objective of the safety assessment methodology is to give feedbacks on the design, and the methods proposed in this paper also participate to this purpose by highlighting some open options in the design and giving some indications on their potential impact from the safety point of view.

In section 2 the MSFR reference design used for the SAMOFAR project is presented, defining the studied system and its peculiarities; moreover some open points of the design are highlighted and the need for using technological neutral methodologies such as the ISAM is clarified. Afterwards, in section 3 the methodology chosen to compile the PIEs list of the MSFR is introduced, including the description of the FFMEA and MLD tools and the method of PIEs selection. Section 4 presents a preliminary list of the identified PIEs and the outcomes of the methods are finally compared in order to highlight symbioses and differences between the MLD and the FFMEA.

Description of the MSFR system

General description

The main characteristic of the MSFR is to use a fuel in the form of a molten salt. This fuel salt circulates in the fuel circuit where it is cooled down and plays therefore the role of coolant as well. The reference reactor, as defined at the beginning of the SAMOFAR project, is a 3 GW thermal power reactor with a thermodynamic efficiency of about 45 %, a fast neutron spectrum and a breeding ratio of 1.1 [START_REF] Heuer | Towards the Thorium Fuel Cycle with Molten Salt Fast Reactors[END_REF]. The MSFR includes three main closed circuits for heat extraction from the fuel during power operation (the fuel circuit, the intermediate circuit and the power conversion circuit) and an open circuit acting as heat sink.

The selected fuel salt is a molten binary fluoride salt with 77.5 mol% of lithium fluoride, the remaining 22.5 mol% being a mix of heavy nuclei fluorides including the fissile and the fertile matter [START_REF] Heuer | Towards the Thorium Fuel Cycle with Molten Salt Fast Reactors[END_REF]. The fluids of the intermediate and conversion circuits have not been selected yet and constitute one of the open points of the system, however several options are proposed and will be studied in the frame of the SAMOFAR project. Other design open points will be described in paragraph 2.3.

Fuel circuit description

The fuel circuit is defined as the circuit containing the fuel salt during power operation and includes the core cavity and the cooling sectors allowing the heat extraction. Its specificities are summarized in Table 1.

The core shape is a hyperboloid resulting from previous optimization studies to improve the fuel flow in the core and limit the recirculation zones [START_REF] Rouch | Preliminary thermal-hydraulic core design of the Molten Salt Fast Reactor (MSFR)[END_REF]. In addition, an integrated geometry of the fuel circuit (Fig. 1) was proposed in the frame of the SAMOFAR project in order to prevent the risk of fuel leakages highlighted by preliminary safety studies [START_REF] Brovchenko | Design-related Studies for the Preliminary Safety Assessment of the Molten Salt Fast Reactor[END_REF]. This solution foresees a vessel (Fig. 1 Top right) used as container for the fuel salt, vessel in which the 16 cooling sectors are disposed circumferentially (Fig. 1 Bottom right). Each sector (Fig. 1 Bottom left) comprises a heat exchanger, a circulation pump, a gas processing system, and a fertile blanket tank. A neutron shielding in B4C is positioned between the blanket and the heat exchangers to protect the heat exchangers from the neutron flux and to increase the breeding ratio. In addition, thick reflectors made of nickel-based alloys are located at the bottom and the top of the vessel to protect the structures located outside the core [9] [16]. The fuel circulation drifts the delayed neutron precursors in low importance areas, reducing the effective fraction of delayed neutrons and contributing to the reactor fast behaviour. The reactivity being mainly controlled by the neutronic feedback reactions (e.g. no control rods are foreseen in the core), the fast response is not problematic for the reactor operation. The reactor feedback coefficients (density effect and Doppler Effect) are all negative, acting rapidly since the heat is produced directly in the coolant. The density effect comes from the fuel dilation that is possible thanks to an expansion vessel, which is a tank located at the top of the fuel circuit. Therefore, the core presents a very intrinsically stable behaviour to reactivity insertions [START_REF] Laureau | Transient coupled calculations of the Molten Salt Fast Reactor using the Transient Fission Matrix approach[END_REF].

Systems in interaction with the fuel circuit and open points on the design

Several sub-systems are connected to the fuel circuit, in particular, the fertile blanket and its cooling circuit, the fuel circuit walls cooling, the intermediate circuit, the Emergency Draining System (EDS), the fuel storage tanks, the gas bubbling system and the sampling for fuel processing. The objective of this section is to highlight their interactions and the possible impact on the subsequent safety analyses. In addition, special attention is paid

on the design open points and on the possible improvements that were identified thanks to the safety analysis.

Firstly, the fertile blanket allows the breeding ratio of the reactor to increase and participates to the radial neutron shielding. The system comprises a blanket tank filled with fertile salt at liquid state, which is an integral part of the sector and is located in the circumference of the core. The fertile salt is heated up by the neutrons coming from the core losing their energy by scattering or being trapped (mainly by thorium) and by the fission of U233 which is produced by capture on the thorium; therefore it needs to be cooled down. Several design options are foreseen for the fertile salt cooling: an internal cooling option where the intermediate salt directly cools down the blanket tank or an external cooling option, in which the blanket tank is connected to a fertile circuit with a pump and a heat exchanger where the fertile salt is cooled down by the intermediate salt.

Then, the fuel circuit is connected to the intermediate circuit through the heat exchangers, which are designed to ensure the leak-tightness of the zones where the intermediate fluid circulates. Furthermore, the pressure of the intermediate circuit is higher than the one of the fuel circuit in order to prevent fuel leakage in case of a heat exchanger leak. The study of the intermediate circuit is to be led, keeping in mind that the reactor is mainly driven by heat extraction (e.g. there are no control rods in the core) [START_REF] Laureau | Transient coupled calculations of the Molten Salt Fast Reactor using the Transient Fission Matrix approach[END_REF]. Four intermediate circuits are considered, each of them feeding four cooling sectors in order to ensure the core cooling even if one circuit fails.

The intermediate salt is also used to cool down the fertile blanket and the core walls in order to prevent their thermal degradation due to possible hot spots. However it should be determined whether this function is achieved by a unique intermediate circuit or if a dedicated cooling circuit has to be used for the walls and the fertile blanket. The application of the proposed safety analysis method and the reflection on the confinement barrier definition also highlighted the need to provide sufficient valves to isolate systems in case of malfunction or leakage.

In case of incident/accident during power production, the fuel can be drained gravitationally toward an emergency draining tank designed to passively remove the residual heat over a long period of time [START_REF] Gérardin | Design Evolutions of the Molten Salt Fast Reactor[END_REF]. The residual heat associated to the fuel salt represents around 3.8% of the nominal power at the moment t=0s where reactor shuts down; thus this value corresponds to the maximum of the residual power of the salt in time [START_REF] Brovchenko | Etudes préliminaires de sûreté du réacteur à sels fondus MSFR[END_REF]. The fuel circuit is connected to this Emergency Draining System (EDS) through active and passive gates or plugs located in the bottom reflector (Fig. 1.Top left). A gas connection between the fuel circuit and the EDS allows a fast draining (around 100S). In addition to the emergency draining, a routine draining system, triggered only by active means, is used to transfer the fuel to storage areas for maintenance operations. The siphons for routine core draining and filling are placed on the sides of the core vessel. The calculations to design of the EDS are ongoing; it constitutes one of the tasks of the SAMOFAR project.

An in-core gas bubbling system is used to clean the salt from gaseous fission products and metallic particles.

The gas is injected at the bottom of the core and recovered at the top to be cleaned up from a part of the fission products in the gas processing unit (Fig. 1. Bottom left) before being re-injected in the core. The gas processing unit requires a dedicated cooling system as the residual heat, at reactor shutdown, in this location represents around 1.4% of the nominal power [START_REF] Brovchenko | Etudes préliminaires de sûreté du réacteur à sels fondus MSFR[END_REF]. The specific components of the bubbling system constitute one of the open points of the design to be defined.

Finally, the fuel processing is done/performed through online fuel punctures and the loading is done by fluid transfer during reactor operation. Thus, fuel salt and fertile salt samplings are regularly performed to control and adjust their chemical composition and inventory. The frequent adjustment of the fuel composition allows low reactivity reserves in core. Nevertheless, it involves a risk of reactivity insertion due to incorrect fuel composition at loading and of leak during the transfer to the processing unit. However, since the amount of daily-injected fuel is quite small (10 to 40 litres per day), the associated consequences are limited. In the reference design of SAMOFAR, the salt puncture is done at the top of the core, through a lid over the fuel circuit expansion vessel; the safety analysis helped identifying this lid as a potential weak point and other options are currently under study.

A more complete description of the fuel circuit and the systems connected to the fuel circuit is in SAMOFAR deliverable 1.1 [START_REF] Allibert | Description of initial reference design and identification of safety aspects of the MSFR[END_REF].

The peculiarities of the MSFR, summarized in this paragraph, and the preliminary stage of its design call for use of technological neutral methodologies such as the ISAM in support of the safety assessment, as reckoned by the GIF. Such methodologies should help, as they are being deployed, to catch and address the specificities of the MSFR concept. Indeed, current nuclear safety requirements and methodologies applicable to solid-fuel reactor concepts, in particular LWRs technology, may not be fully relevant in the MSFR context: for example, some LWR risk metrics (such as the Core Damage Frequency -CDF) are not significant for the MSFR.

Additionally, the severe accident, traditionally coincident with the core melting, needs an updated and more general definition. Moreover, the physical barriers for the containment of radionuclides suited to the MSFRs needs, due to the liquid and circulating nature of the fuel, necessitate to be defined [START_REF] Company | Modernization Non -Light Water Reactors Probabilistic Risk Assessment Approach[END_REF]. These examples clarify the need of a technologically neutral methodology, applicable to the new generation concepts, especially when it comes to MSFR development. Of course, such methodology should always represent a practical declination of the IAEA Fundamental Safety Principles [START_REF] Iaea | IAEA Safety Standard for protecting people and environment, Fundamental Safety Principles[END_REF].

Description of the methodology

In order to be as exhaustive as possible, it is proposed for the MSFR to use two different approaches for identifying potential accident initiating events (IEs). In addition, the design of the MSFR being still in development and the operating procedures (start-up, shutdown and maintenance) under definition [START_REF] Heuer | A starting procedure for the MSFR: approach to criticality and incident analysis[END_REF], the safety approach has to include appropriate methods, usable despite the lack of knowledge on components, systems or procedures. For this purpose, the Master Logic Diagram (top down approach) and the FFMEA (functional bottom up approach) have been selected. Both methods and their applications to the MSFR are described in the following paragraphs. These methods aim at being coherent with the ISAM. The MLD contributes to the preparation of the Objective Provision Tree (OPT), one of the tools proposed in the ISAM, whose objective is to help identifying all provisions needed to sketch the design safety architecture in order to guarantee the safety functions. In that respect, the MLD contribution is to provide a systematic identification of hazards that could affect the plant, through a top down approach with an event tree structure. The FFMEA aims at systematically investigating the hazards that could affect the MSFR functionality and allows also to recognize critical components, lack of information and/or criticalities of the design and necessity of supplementary provisions. In this optics, the outputs of the FFMEA can give insights to other ISAM tools, such as the OPT and the PIRT, the Phenomena and Identification Ranking Table, whose objective is to identify plausible phenomena significantly contributing to risk. Due to the very preliminary stage of MSFR design, the identification of the hazardous events is not arranged according to the DiD levels, which could be done in a later stage together with identification of the associated layers of provisions, as reckoned for a full deployment of the OPT tool.

The work has been performed by a team composed by design expert, safety experts and industrial experts, several of them having previous experiences in the use of FFMEA and MLD tools. Moreover, experts' judgement and experience feedback, e.g. from the ORNL MSRE [START_REF] Haubenreich | Safety analysis of operation with 233 U[END_REF], have been taken into account for the sake of exhaustiveness. The IEs identified here correspond to internal events that may lead to radioactive releases, due to an abnormal operating conditions of the fuel circuit. Then, from the complete list of IEs, a set of postulated initiating events (PIEs) is selected as the most representative in terms of challenging conditions for the safety of the plant. In such a way, it is possible to focus safety studies on the most relevant initiating events. In paragraph 3.3, the process of PIEs selection is described, as it was applied to the FFMEA and to the MLD.

Functional Failure Modes and Effects Analysis

The Functional Failure Mode and Effect Analysis (FFMEA) is a suitable qualitative methodology to define possible incident and accident initiators when a sufficient design detail is not available to allow more specific evaluations at component level, by investigating systematically components failures that could affect system functionality [START_REF] Carpignano | Safety Issues related to the Intermediate Heat Storage for the EU DEMO[END_REF]. The main functions of the plant (process functions, safety functions, investment protection functions, etc.) are defined at first through the Functional Breakdown Structure (FBS) and specified in subfunctions. Moreover, the available design information and design intents (defined in the FBS) are collected and all the systems and components of the plant are listed in order to define the Plant Breakdown Structure (PBS).

Then, each main function can be correlated to one or more than one of the components. Subsequently, the FFMEA table is compiled, postulating the loss of the functions rather than the specific failures of systems and components: in this way, it is possible to overcome the lack of information of systems design. Nonetheless, reference to systems/components is always highlighted, as much as possible, in order to investigate causes and safety consequences. Furthermore, possible improvements, prevention and mitigation actions are recommended.

The objective of the FFMEA is to provide a complete list of potential initiating events (IEs) and give suggestions in order to improve the overall safety of the system/reactor [START_REF] Pinna | Functional Failure Mode and Effect Analysis (FFMEA) for the DEMO cooling systems of the WCLL blanket model[END_REF].

The FFMEA allows performing MSFR safety assessment, notwithstanding its very preliminary state of design, in order to identify functional deviations able to compromise system safety, to list Postulated Initiating Events (PIEs) and to recognize critical components, lack of information and/or criticalities of the design and necessity of supplementary safety provisions. 2 shows an extract of the FFMEA table compiled for the process functions of the MSFR in normal operation conditions during power production. The analysis focuses on the fuel circuit and the systems in direct interaction with it, e.g. the fertile blanket, the intermediate circuit, the wall cooling system, the gas bubbling system and the sampling system. A first application of the FFMEA to the MSFR is available on [START_REF] Uggenti | Preliminary functional safety assessment for molten salt fast reactors in the framework of the SAMOFAR project[END_REF] with more details on each step of the methodology.

Master Logic Diagram

The Master Logic Diagram (MLD) is a qualitative risk analysis method whose purpose is to identify the hazards and possible initiating events of a system, through a deductive and structured approach. This "top-down" approach is particularly well suited for projects in early design phases as the analysis is based on physical phenomena and general considerations rather than specific components of the design. It also proves to be helpful to highlight the correlations between different functions/phenomena and can therefore be an asset in the study of complex systems such as nuclear power plants. It has been widely used in nuclear industry as well as in other engineering fields such as chemical plants and processes [START_REF] Papazoglou | Master Logic Diagram: method for hazard and initiating event identification in process plants[END_REF].

The main steps of the method can be summarized as follow:

-Identification of the top event, which is the undesired situation to be prevented.

-Decomposition of the top-event into detailed sub-events, each sub-event being a possible cause of the considered top-event. The development continues until a sufficient level of details is reached and events directly challenging the safety functions are identified. In this step, the consideration of all physically possible phenomena is crucial for the completeness of the approach.

-Identification of the initiating events as the basic events that cannot be further divided into sub-events.

The diagram is usually presented in the form of a qualitative fault tree based on Boolean logic beginning with the top event and where the lower levels of the tree show the elementary failures.

The MLD method has been applied to the MSFR for the normal operation state of power production, similarly to the FFMEA application. In this mode, the fuel circuit constitutes the first confinement barrier.

down in order to remove residual heat;

Etc.

Therefore, the fuel circuit degradation or fuel circuit failure is selected as top event in the current study. An extract of the compiled tree, produced with the Arbre-Analyste software [START_REF] Clement | Arbre Analyste[END_REF], is presented in Fig. 2 where the top event is decomposed according to the phenomena involved (thermal, chemical, mechanical, etc.).

Fig.2. Extract of the MSFR MLD

Identification and discussion of the PIEs

In order to identify the PIEs, all the elementary IEs are listed in a unique document and are grouped into families, depending on their potential effects on the reactor.

The grouping of IEs in a family is usually done according to criteria of similarity of the consequences associated to the single IE and of plant response.

The common practice is then to define incident and accident categories with associated occurrence frequency ranges. For a given family, PIE are then identified as envelope cases in a given category (i.e., in a given occurrence frequency range). Therefore, not only the low probability cases with potentially severe consequences should be identified, but also the "not so low probability events" for which criteria will be more stringent. The evaluation of the expected frequency for each PIE should be performed preliminary in a first time given the premature state of the current design (at least distinguishing frequent events, rare events, and very rare events), based on engineering judgement. Low probability events may also be postulated, based on the defencein-depth principle.

For the objective of this analysis, only the most severe events of a family in terms of consequences are selected as PIEs [START_REF] Pinna | Functional Failure Mode and Effect Analysis (FFMEA) for the DEMO cooling systems of the WCLL blanket model[END_REF], with no consideration for their occurrence frequency in a first time, which should be done in a later stage (at least with occurrence frequency ranges or expected orders of magnitude). At this stage, it is not always obvious to identify the most severe events: therefore, it has sometimes been chosen to maintain a significant number of IEs as PIEs, which could be optimized in a later stage. As final result of the work, each identified PIE has to be discussed outlining the possible accidental sequences and deterministic analyses shall be performed to verify the plant capacity to mitigate the consequences, to check the compliance with safety limits and to drive the choices for the selection of the reference design [START_REF] Pinna | Identification of accident sequences for the DEMO plant[END_REF]. It is besides reminded that the DiD principle is the fundamental principle to use for the safety analysis. In that respect, it is also underlined that some PIEs have been selected independently of their likelihood at this stage, with the goal to drive the analysis towards the consideration of all phenomena of potential interest (for example: fuel salt freezing scenario, postulated prompt critical power excursion with induced shockwave…): some of them may be later found not to be possible in the future MSFR studies and thus withdrawn from the PIEs list.

If events are estimated not to lead to any safety relevant disturbance, they can be classified as not relevant from the safety point of view (N/S). These events will not be analysed from the safety issue, nevertheless they can be important in the future when Reliability, Availability, Maintainability and Inspectability (RAMI) analysis will be performed [START_REF] Pinna | Functional Failure Mode and Effect Analysis (FFMEA) for the DEMO cooling systems of the WCLL blanket model[END_REF].

This methodology should be iteratively applied, following the design development; similarly, the list of the PIEs evolves with the detail of the design and the investigation of the physical phenomena governing the behaviour of the system, through deterministic analyses. Therefore, this methodology aims at influencing the direction of the concept and design development from its earliest stages.

Results

PIEs list

As stated/explained above, PIEs are generally determined by looking at the set of elementary failures that compromise process functions and induce consequences of safety concern, grouping events that induce similar consequences in the plant into families and selecting, as representative, the most severe elementary failure of the group of events. The families of events identified for the MSFR are:

• F1: Reactivity insertion Since the conceptual phase of the design and the iterative nature of the methodology, this list will be updated following the evolution of the available information (in terms of design detail, reactor transients, experimental analyses, etc). The most severe Initiating Events of each family is selected as Postulated Initiating event. Table 3 presents an extract from the PIEs list obtained by the FFMEA and the MLD, with a selection of PIEs assumed to be representative accident initiators. These representative accident initiators are assumed to envelope all the IEs in terms of radiological consequences. As an illustration of the plant behaviour in some events, the case of loss of liquid fuel flow family is preliminary described hereafter. In the event "complete rupture or blockage of all the fuel circuit pumps", the loss of flow is assumed to be relatively fast as the components improving the inertia (e.g., pump flywheels) are unavailable. Moreover, in case of pump rupture, broken parts of the pump could enter the fuel flow. In the event "blockage of all sectors of fuel salt circuit", the rapidity of the loss of flow depends on the nature of the blockage which can be caused by the presence of external elements in the fuel circuit, the presence of broken components of the fuel circuit, the precipitation or the solidification of the fuel in the heat exchanger. In the events "complete rupture or blockage of all the fuel circuit pumps" and "blockage of all sectors of fuel salt circuit", the complete loss of fuel flow causes the increase of the temperature in the core and thus the shutdown of the chain reaction because of the negative feedback. After the shutdown of the chain reaction, the temperature of the fuel in the core and in the part of the fuel circuit that are not cooled continues to increase because of the residual heat. The major risk associated to these events is the degradation of the fuel circuit components due to the high temperature achieved. To prevent this risk, some provisions are implemented in the design, such as the emergency draining of the fuel salt. The "fuel salt freezing scenario" is characterized by the solidification of the fuel salt in a large part of the fuel circuit. No exact cause of this scenario has been identified until now. However, it has been kept in the list of events to be studied in order to test the limits of the design.

Comparison of MLD and FFMEA

The FFMEA and the MLD methods are based on different approaches: with the FFMEA the user is led to reason from a functional point of view by looking for the possible causes of the loss of the functions and their consequences; while the MLD approach is more phenomenological and the user identifies the causes of phenomena that can lead to the physical degradation of the system. Both methods have proved to be relevant for the purpose despite some lacks of precise data on MSFR components, systems or procedures. Indeed, in both methods the link with the component arrives only in a second time, making them more suitable to an application at early design phase.

The results agreed well and many events were found independently with both methods. However, few events appeared only in one of the two analyses. For the application of the MLD to the MSFR, risks have been differentiated according to the physical phenomena involved and the method also revealed risks caused by external hazards or by the action of other systems of the plant. For instance, the events "Loss of Chemical Control: Chemical reaction between different fluids" or "Mechanical Degradation: Ejection of a power conversion system component in direction of the fuel circuit" only appeared through the MLD analysis. On the other hand, the FFMEA brought more details on the failure modes thanks to the effort to link the loss of each function to a component or system failure. For instance, even if the breach in the upper reflector was well identified with the MLD, the FFMEA highlighted the fact that the breach could involve the rupture of the wall cooling systems and/or the expansion vessel system.

The FFMEA has the advantage to provide additional information on the systems or procedures used for detection, prevention and mitigation, in a very preliminary approach to the defence in depth, while the MLD offers a good graphical tool to present the hazards and helps understand the logical connections between them.

In conclusion, the combined use of the FFMEA and the MLD methods proved to be useful to ensure a more complete identification of the hazards and initiating events of the MSFR. In addition, as a complementary result, both the methods helped to highlight the open points of the project, which could be taken into account during next steps of the design.

Critical analysis

In a solid-fuelled reactor, the accident initiators are traditionally classified in the following families (list "a minima"): LOCA (Loss of Coolant Accident), LOF (Loss of Flow), LOHS (Loss of Heat Sink), TOP (Transient OverPower), TLOP (Total Loss Of Power) and OVC (Overcooling) [START_REF]Uncertainty in unprotected loss-of-heat-sink, loss-of-flow, and transientoverpower accidents[END_REF]. Moreover, in the IRSN report [START_REF] Irsn | Research and development with regard to severe accidents in pressurized water reactors: Summary and outlook[END_REF], for PWRs the term "severe accident" refers to an event causing significant damage to reactor fuel and resulting from more or less complete core meltdown".

From the list of accident initiators, it can be noticed that a direct transposition of these categories to the MSFR is not possible and the biggest differences between the liquid-fuelled reactors and the solid-fuelled reactors are linked to peculiar characteristics of the latter: the liquid nature of the fuel makes necessary a new definition of severe accident detached from the concept of core melting and at the same time introduces new accident initiators such as the "Loss of fuel flow", which was not conceived in the LWRs.

The safety analysis of the PIE should also take into account the particular arrangement of safety systems.

The reactivity control systems deserve a special mention since the control rods are substituted by a bubbling control system for the reactivity management in normal operation conditions in the current MSFR design and the EDS for the geometrical subcritical redistribution of the core in case of emergency. The design and the operation of the EDS represent one of the major safety issues of this reactor. The concept and the dimension of the system constitute an open point of the project, as well as the Decay Heat Removal systems for long term accident management should be more precisely designed and tested. As regard radiological containment, barriers must also be defined with due account for the liquid nature of the fuel. Then, in a later stage, the safety architecture will have to be consolidated, notably ensuring proper implementation of the defence-in-depth in the design.

Along with the implementation of the tools, some open points on the design, the systems, the phenomena and procedures of the MSFR are highlighted with their advantages and drawbacks, to give inputs for the evolution of the concept in the optic of a safety-driven design.

Conclusion

A list of Postulated Initiating Events is produced, as reference accidents for the successive deterministic analyses that will be performed to assess the severity of the involved phenomena and transients. The list of PIEs will evolve as the design is refined step by step and the deterministic analysis on components and transients are performed. The outputs of this work represent a common starting point to be refined: it is plausible that some of the hazardous events will be removed of the list because successive analyses could show their inconsistency. On the other hand this analysis may lead the designers to provide design modifications such that some events are no longer to be considered (if they are physically impossible for example). Nevertheless, the list will likely include new events that are not highlighted yet.

Successively each accident scenario has to be classified into frequencies and consequences macro-categories (in terms of damages to the asset and environmental releases) and one or more risk matrices will be built using consistent definitions of technological inclusive risk metrics and severe accidents: based on the risk level of each accidental sequence, a number of lines of defence (e.g. provisions, protection systems, etc.) is under definition for the unprotected sequences therefore the final objective of this methodology is to help sketching the architecture of the system.

In the current study, the state of normal operation during power production is analysed. The same analysis will be conducted for maintenance as well as start-up and shut-down procedures. Similarly, the scope of the analysis is limited to the fuel circuit and the systems directly connected and interacting with the fuel circuit. A wider study should be performed to include other systems such as the routine draining tanks and the processing units.

This first implementation of the methodology presented here is not exhaustive nonetheless it has been useful not only to highlight missing information, lack of provisions and criticalities of the system but also to define a procedure that can be applied iteratively with the evolution of the design and the knowledge of the transient behaviours.

•

  F2: Loss of fuel flow • F3: Increase of heat extraction/over-cooling • F4: Decrease of heat extraction • F5: Loss of fuel circuit tightness • F6: Loss of fuel composition/chemistry control • F7: Fuel circuit structures over-heating • F8: Loss of cooling of other systems containing radioactive materials • F9: Loss of containment of radioactive materials in other systems • F10: Mechanical degradation of the fuel circuit • F11: Loss of pressure control in fuel circuit • F12: Conversion circuit leak • F13: Loss of electric power supply

FFMEA and the MLDF1: 16 F6:

 16 Bulk precipitation of fissile matter (e.g because of an inlet of water) F1: Accidental insertion of fuel F1: Important deformation of the fuel circuit possibly leading to an increased core volume (e.g. the welded joints taking the recirculation sectors in the correct position collapse) F1: Fertile blanket loading with fuel salt F1 & F2: Fuel salt freezing scenario F1 & F6: Rupture/obstruction of reactivity bubble injector F2: Blockage of all sectors of fuel salt circuit F2: Complete rupture or blockage of all the fuel circuit pumps F3: Overworking of all the fuel circuit pumps F3: conversion circuit pumps overworking F3: Over-working of the pumps of the intermediate circuit F4: Obstruction/blockage of the intermediate circuit F4: complete loss of intermediate salt F4: Rupture/blockage of all intermediate circuit pumps F5: Breach in the core vessel F5: Breach in the lower reflector (with rupture of the structure cooling system) F5: Breach in the upper reflector with rupture of the structure cooling system and/or with damages to the expansion vessel system F5: Breach of a heat exchanger plate/channel F5: Rupture of blanket tank wall between fuel and fertile salt with rupture of the fuel circuit walls cooling circuit F5: Rupture of a pipe of the reactivity control system F5 & F11: Rupture of the connection between the free surface of the fuel storage tank and the free surface of the core for the gas in the part between the core cavity and the valve F6: Rupture of horizontal bubble injector for salt cleaning F6: Rupture of the gas separation chamber Undetected deviation of the chemical composition F6: Rupture of the gas processing unit (with possible leak of processing fluid) F6: Chemical reaction between different fluids (e.g. hot part of intermediate circuit and water) F6 & F11: Inlet of water F7: Detachment of the wall thermal protection F9: Complete rupture of the pressurised sampling device F10: Prompt critical power excursion with induced shockwave F11: Obstruction of all free levels (including the vertical inlet pipe from the core to the expansion vessel) F12: Ejection of a conversion system component F13: Total loss of electric power

Table 1

 1 Characteristics of the MSFR fuel circuit

	Mean fuel salt temperature in fuel circuit (°C)	725
	Fuel salt temperature rise in the core (°C)	100
	Total fuel salt volume (m 3 )	18 (half in the core and half in the cooling
		sectors)
	Total fuel salt cycle in the fuel circuit (s)	3.9
	Fuel salt dilation coefficient (g.cm -3 .K -1 )	8.82.10 -4
	Total feedback coefficient (pcm.K -1 )	-8
	Hyperboloid core dimensions (m)	Radius: 1.06 to 1.41
		Height: 1.6 to 2.26
	Fuel salt density (g.cm -3 )	4.1

Table 2

 2 Extract from the FFMEA MSFR table

	Process function	PBS	Op.	Failure	Cause	Consequences	PIE
		elements	Md.	mode
	P1 To generate
	electricity
	P1.1 To generate
	heat by realizing
	fissions in core

Table 3

 3 Extract of assumed representative events from the list of Postulated Initiating Events obtained by the

Acknowledgments

This project has received funding from the Euratom research and training programme 2014-2018 under grant agreement No 661891. The authors also wish to thank the NEEDS (Nucléaire: Energie, Environnement, Déchets, Société) French program, the IN2P3 department of the National Centre for Scientific Research (CNRS) and Grenoble Institute of Technology for their support.

The content of this article does not reflect the official opinion of the European Union. Responsibility for the information and/or views expressed therein lies entirely with the author(s).