**5.3. Identification of SSCs for safe shutdown – Seismic classification**

The procedure for the safe shutdown, cool-down and long-term heat removal of the reactors has been elaborated in two versions (Katona, 2003).

The first version was developed before 1995, when a very conservative guess of the DBE (with PGA 0.35g) was available. For this high demand, a safe shutdown technology was selected that could be realised by the upgrading of the minimum number of systems. It was advisable to select systems for the safe shutdown and cool-down, which are situated in the reinforced concrete containment part of the main building because only this part of the building seemed to sustain the loads. The upgraded and not upgraded systems or parts of systems should be separated in case of earthquake by fast closing valves. The control rods, and boron system would ensure shutdown of the reactor, and the stable subcritical conditions. The reactor should have been cooled-down by the secondary bleed and feed. The long-term heat removal would have been executed through the heat exchangers of the low-pressure emergency core cooling system that should have been modified for the execution of this function. This concept would require modifications in the safety systems and the installation of the great number of valves. Analysing the feasibility issues, it has to be recognised that the implementation of the concept is not only very expensive but it can reduce safety in all other cases than an earthquake because of the modification of the low pressure emergency core cooling system.

Performing the analyses for main building complex, it was recognised that the most critical structure is the gallery building that gives place to several vital systems and I&C equipment. This part of the main building should have been upgraded. Developing the possible technical solution for upgrading the longitudinal gallery building, it turned out that it can be best performed, if the steel frames of the turbine hall and the reactor hall are also fixed. This solution allows the application of structural upgrades that do not require fixes in the over-crowded by equipment and piping gallery building. If it the case, the systems for regular heat removal placed in the turbine hall would be available for heat removal after an earthquake, if their re-qualification is performed. Meantime, in 1995 the site seismic hazard evaluation has been completed which resulted in the DBE with 0.25g PGA. Response and stress calculations made for the newly defined DBE have shown that essential part of the mechanical equipment and pipelines can sustain the DBE demand and the reinforcement of the systems and structures necessary for seismic safety is feasible with reasonable effort.

108 Nuclear Power – Practical Aspects

much larger margins (Győri et al, 2002).

Depending on the method used the value of safety factor varies in rather wide range. The methodologies (Seed & Idriss, 1971, 1982; Tokimatsu & Yoshimi, 1983) used for Paks site resulted in a relative low margin, while the analysis via effective stress method provides

The building settlement caused by earthquake can affect the underground communications (service water piping and emergency power supply cables) due to relative displacements. This effect will be amplified if liquefaction occurs. The dominant failure mode in the acceleration ranges higher than the design basis is due to the relative building caused by the soil liquefaction. This makes it necessary to re-qualify the underground lines and connections jeopardized by the settlement of the main building or, if it is necessary, to modify them to make their relative movement unimpeded. An advanced probabilistic liquefaction and relative building settlement analysis is going on using an amended soil parameter database in relation to the investigation of beyond design base vulnerabilities

performed for severe accident management reasons (Győri et al, 2011).

has been elaborated in two versions (Katona, 2003).

pressure emergency core cooling system.

**5.3. Identification of SSCs for safe shutdown – Seismic classification** 

The procedure for the safe shutdown, cool-down and long-term heat removal of the reactors

The first version was developed before 1995, when a very conservative guess of the DBE (with PGA 0.35g) was available. For this high demand, a safe shutdown technology was selected that could be realised by the upgrading of the minimum number of systems. It was advisable to select systems for the safe shutdown and cool-down, which are situated in the reinforced concrete containment part of the main building because only this part of the building seemed to sustain the loads. The upgraded and not upgraded systems or parts of systems should be separated in case of earthquake by fast closing valves. The control rods, and boron system would ensure shutdown of the reactor, and the stable subcritical conditions. The reactor should have been cooled-down by the secondary bleed and feed. The long-term heat removal would have been executed through the heat exchangers of the low-pressure emergency core cooling system that should have been modified for the execution of this function. This concept would require modifications in the safety systems and the installation of the great number of valves. Analysing the feasibility issues, it has to be recognised that the implementation of the concept is not only very expensive but it can reduce safety in all other cases than an earthquake because of the modification of the low

Performing the analyses for main building complex, it was recognised that the most critical structure is the gallery building that gives place to several vital systems and I&C equipment. This part of the main building should have been upgraded. Developing the possible technical solution for upgrading the longitudinal gallery building, it turned out that it can be best performed, if the steel frames of the turbine hall and the reactor hall are also fixed. This solution allows the application of structural upgrades that do not require Theoretical considerations have been made for the evaluation of upgrading effort required for fixing the pipelines and components required for heat removal via systems "as usual", i.e. systems dedicated for emergency cases. It has been assumed that the "as is" seismic capacity of the pipe segments can be treated as a random variable; its value can be expressed by total design capacity multiplied by several factors representing the randomness of the actual design features, floor-response, etc. If it is the case, the calculated "as is" HCLPF values of pipe segments have to be lognormal distributed. If the distribution is known, the parameters of the distribution can be defined on the basis of HCLPF calculations for "as is" conditions and the number of pipe segments requiring fixes can be evaluated. The distributions of "as is" HCLPF values of pipe segments presented in Figure 5 justified the assumptions and made possible the evaluation of upgrading needs.

**Figure 5.** Distribution of "as is" HCLPF values of pipe segments (units 1-4 and units 3-4)

Based on the assessment of fixes of the piping and components, the cost of these fixes turned to be cheaper than the (automatic) isolation of the unreinforced parts of the systems by a great number (more than 100/unit) of fast closing valves.

Consequently, instead of a success path and backup for heat removal, the concept has been chosen that is based on the use of systems devoted for heat removal as per design, taking into account the design philosophy of the VVER-440/213 and widely using the synergy between structural and component fixes.

Seismic Safety Analysis and Upgrading of Operating Nuclear Power Plants 111

The SSCs have been formally classified: Seismic Class 1 – active systems and components, Seismic Class 2 – passive structures and components (thereafter SCs) needed for ensuring the basic safety functions during and after DBE; Seismic Class 3 – SSCs are those, failure of which may inhibit the safety functions (interacting SCs, falling-on, casing fire or flooding, etc.). Seismic Class 4 – no safety functions and no interaction. Obviously, the scope of seismic safety programme at Paks NPP envelops the scope defined in the international practice for the operating nuclear power plants. Chapter 5 of NS-G-2.13 (IAEA, 2009) only prescribes the re-qualification of the minimal number of SSCs necessary for the implementation of safety functions during and after the earthquake. In case of Paks NPP this concept could not been applied since the design basis had to be reconstructed. Thus the requirements of the IAEA NS-R-1 and NS-G-1.6 were applied. The rational for seismic classification is rather questionable. If the safety related safety classified SSCs have to be designed for the design base external hazards, the basic safety functions would be ensured by these SSCs in case of earthquake too, i.e. no need of the

**5.4. Response and strength analysis of structures and components** 

Two approaches can be accepted for analysis of the soil-structure interaction:

In case of the rigid boundary method, the modal damping was limited according to international standards (e.g. KTA 2201.3: 15% for horizontal, 30% for vertical motion). Although the uncertainty of the geotechnical data had been extensively studied, three values of the soil share modulus Gmin, Gav and Gmax, have to be considered for handling the uncertainty of soil parameters, where Gmin = 0.5 Gav and Gmax = 2.0 Gav (according to ASCE-4

The analysis of the structural response and capacity of the structures graded approach have been applied, i.e. the modelling and the analysis method have been selected according to the

The most important building complex is the VVER-440/V213 main reactor building that consists of the reinforced concrete confinement with the localization tower and the attached longitudinal and transversal gallery buildings, as well as the reactor and turbine hall. The most critical parts of the complex structure are the longitudinal and transversal gallery buildings. A method with solution of the equations of motion in frequency domain has been

The secondary buildings are box-shaped structures composed of reinforced concrete prefabricated elements or structures composed of foundation and an upper steel structure. Because of the structural complexity of these buildings, an up-to-date 3D modelling was


(ASCE, 1998), 1.5 Gav is acceptable as minimum value).

seismic and safety classification.

safety relevance of the structure.

applied for analysis (Katona et al, 1995a).

Meantime, the new nuclear regulation issued in 1997 required the upgrading and qualification of the SSCs enrolled into seismic classes. Moreover, the regulation requested to ensure the adequate capacity of the safety classified SSCs for hazards. Consequently, the scope of the seismic safety evaluation and upgrades was set as for re-design, covering not only the seismic safety classified SSCs (including interacting items), but the whole scope of safety classified SSCs with three times full redundancy, with application of the single failure criterion. The stable and unlimited in time cold shutdown condition have to be ensured after the design base earthquake.

According to the selected concept the sub-criticality is maintained by the shutdown and boron control systems. The cool-down is ensured by secondary-side bleed and feed. The continuous cooling is maintained by the heat removal system. In all redundant trains, the SSCs needed for ensuring these safety functions are fixed and qualified for DBE.

Certain modifications have been implemented for making possible the required functioning, e.g. modification of the venting of the tubes of control assemblies on the reactor pressure vessel head. The systems not required for the safety functions are isolated automatically from the seismically qualified one. The procedure was developed assuming that the plant is in normal operational condition; the outside energy supply (grid) and make-up water source is not available for 72 hours.

Loss of coolant accident is not assumed in consequence of the earthquake; hence, the primary system piping is fixed for DBE according to the design rules. Nevertheless, all redundant safety trains including emergency core cooling systems have been upgraded and qualified for DBE. Consequently the sequences with loss-of-coolant can also be managed, although these are already beyond design base sequences according to the safety philosophy.

On the other hand, the consequences of the small breaks (impulse pipes, drains, air vents) shall be examined from the aspect of the dose limits and containment integrity. The break of small-bore pipes shall be considered in connection with the passive single failures (see article 5.3 of NS-G-2.13). The degree of passive single failures is limited to the break of small-bore pipes (<DN50) and to the leakage of the sealing of pumps or valves.

Those non-safety-classified SSCs have to be also fixed for DBE, failure of which may endanger the integrity or functioning of the safety systems. The possibility of fires and flooding induced by earthquake is also avoided via modification and fixing of the relevant systems, and installing letdown systems for lubricant and Hydrogen.

The systems for the heat removal of the spent fuel and refuelling pools are also fixed and qualified for DBE.

The SSCs have been formally classified: Seismic Class 1 – active systems and components, Seismic Class 2 – passive structures and components (thereafter SCs) needed for ensuring the basic safety functions during and after DBE; Seismic Class 3 – SSCs are those, failure of which may inhibit the safety functions (interacting SCs, falling-on, casing fire or flooding, etc.). Seismic Class 4 – no safety functions and no interaction. Obviously, the scope of seismic safety programme at Paks NPP envelops the scope defined in the international practice for the operating nuclear power plants. Chapter 5 of NS-G-2.13 (IAEA, 2009) only prescribes the re-qualification of the minimal number of SSCs necessary for the implementation of safety functions during and after the earthquake. In case of Paks NPP this concept could not been applied since the design basis had to be reconstructed. Thus the requirements of the IAEA NS-R-1 and NS-G-1.6 were applied. The rational for seismic classification is rather questionable. If the safety related safety classified SSCs have to be designed for the design base external hazards, the basic safety functions would be ensured by these SSCs in case of earthquake too, i.e. no need of the seismic and safety classification.

#### **5.4. Response and strength analysis of structures and components**

Two approaches can be accepted for analysis of the soil-structure interaction:


110 Nuclear Power – Practical Aspects

the design base earthquake.

source is not available for 72 hours.

safety philosophy.

qualified for DBE.

between structural and component fixes.

Consequently, instead of a success path and backup for heat removal, the concept has been chosen that is based on the use of systems devoted for heat removal as per design, taking into account the design philosophy of the VVER-440/213 and widely using the synergy

Meantime, the new nuclear regulation issued in 1997 required the upgrading and qualification of the SSCs enrolled into seismic classes. Moreover, the regulation requested to ensure the adequate capacity of the safety classified SSCs for hazards. Consequently, the scope of the seismic safety evaluation and upgrades was set as for re-design, covering not only the seismic safety classified SSCs (including interacting items), but the whole scope of safety classified SSCs with three times full redundancy, with application of the single failure criterion. The stable and unlimited in time cold shutdown condition have to be ensured after

According to the selected concept the sub-criticality is maintained by the shutdown and boron control systems. The cool-down is ensured by secondary-side bleed and feed. The continuous cooling is maintained by the heat removal system. In all redundant trains, the

Certain modifications have been implemented for making possible the required functioning, e.g. modification of the venting of the tubes of control assemblies on the reactor pressure vessel head. The systems not required for the safety functions are isolated automatically from the seismically qualified one. The procedure was developed assuming that the plant is in normal operational condition; the outside energy supply (grid) and make-up water

Loss of coolant accident is not assumed in consequence of the earthquake; hence, the primary system piping is fixed for DBE according to the design rules. Nevertheless, all redundant safety trains including emergency core cooling systems have been upgraded and qualified for DBE. Consequently the sequences with loss-of-coolant can also be managed, although these are already beyond design base sequences according to the

On the other hand, the consequences of the small breaks (impulse pipes, drains, air vents) shall be examined from the aspect of the dose limits and containment integrity. The break of small-bore pipes shall be considered in connection with the passive single failures (see article 5.3 of NS-G-2.13). The degree of passive single failures is limited to the break of

Those non-safety-classified SSCs have to be also fixed for DBE, failure of which may endanger the integrity or functioning of the safety systems. The possibility of fires and flooding induced by earthquake is also avoided via modification and fixing of the relevant

The systems for the heat removal of the spent fuel and refuelling pools are also fixed and

small-bore pipes (<DN50) and to the leakage of the sealing of pumps or valves.

systems, and installing letdown systems for lubricant and Hydrogen.

SSCs needed for ensuring these safety functions are fixed and qualified for DBE.

In case of the rigid boundary method, the modal damping was limited according to international standards (e.g. KTA 2201.3: 15% for horizontal, 30% for vertical motion). Although the uncertainty of the geotechnical data had been extensively studied, three values of the soil share modulus Gmin, Gav and Gmax, have to be considered for handling the uncertainty of soil parameters, where Gmin = 0.5 Gav and Gmax = 2.0 Gav (according to ASCE-4 (ASCE, 1998), 1.5 Gav is acceptable as minimum value).

The analysis of the structural response and capacity of the structures graded approach have been applied, i.e. the modelling and the analysis method have been selected according to the safety relevance of the structure.

The most important building complex is the VVER-440/V213 main reactor building that consists of the reinforced concrete confinement with the localization tower and the attached longitudinal and transversal gallery buildings, as well as the reactor and turbine hall. The most critical parts of the complex structure are the longitudinal and transversal gallery buildings. A method with solution of the equations of motion in frequency domain has been applied for analysis (Katona et al, 1995a).

The secondary buildings are box-shaped structures composed of reinforced concrete prefabricated elements or structures composed of foundation and an upper steel structure. Because of the structural complexity of these buildings, an up-to-date 3D modelling was

required. The soil-structure interaction was be modelled by frequency independent soil springs and dampers.

Seismic Safety Analysis and Upgrading of Operating Nuclear Power Plants 113




For example, the relays have been qualified by replacing the not to be qualified by new one, shaking table testing of samples for in-rack response spectra (Katona et al, 1995b),

Since the GIP database does not specifically include all the equipment of Paks NPP (manufactured in the Soviet Union or Eastern European countries), it was necessary to apply GIP-VVER (Masopust, 2003) incorporating the knowledge and experience gained during the

The comparison of 1.5 times bounding spectra (BS) to the floor response spectra is always recommended instead of the comparison of bounding spectra to the ground motion

The assumptions accepted for the re-evaluation are summarised in the Table 4. The

The mixed use of the codes was excluded by careful definition of the evaluation packages.

The operability of active technological components should be qualified by empirical requalification procedures or test. The equipment classes and applied empirical qualification methods for active and certain passive components are summarised in the

The assumptions, allowable stresses, etc. of the KTA and ASME have been compared.

complies with the requirements of the standard;

**5.5. Qualification of active components** 


evaluation of VVER type power plants.

Table 6.

experience based method, where it was applicable.


response spectra even below the 12 m level of the building.

applicable codes and methods are summarised in the Table 5.

**5.6. Summary of assumptions, codes and standards and methods** 

related to DBE.

response spectra.


The qualification of active components has been made by several methods:

Unique blast tests have been performed for empirical modal analysis of the dynamic behaviour of the main building structures and for the verification of the models developed (Katona et al, 1992, 1993a; Halbritter at al, 1993a). These tests provide good information regarding soil-structure interaction under small-strain excitation.

For optimal modelling of primary system responses, a coupled mechanical and structural model has been developed (Halbritter et al, 1993b; Katona et al, 1993b, 1994, 1999).

The selection of upgrading concept for buildings has been made iteratively. For all options of upgrading, the response and resistance of modified structure has been made and the optimal solution selected via comparison of response and strength achieved. After selection of final upgrading solution the dynamic calculations have been repeated for the modified configuration for justification of the adequacy of the upgrades and development of the floor response spectra. Latter has little importance for the reinforced concrete containment part of the main building complex, but it was essential, e.g. in the gallery buildings. The same iterative procedure has been applied in case of Reactor Coolant System upgrade, and the fixed configuration has been re-calculated for the justification of code compliance of the integrity (Katona et al, 1999).

The methods for evaluation of as-built capacity of structures and components (passive SCs) have been selected in accordance of safety and seismic class, as follows:


The floor response spectra used for the component capacity evaluation was defined according to the design codes (see e.g. ASCE-4-86). However, in case of Class 3 SCs that failed when conservative floor response was used, the calculation was performed for the best estimate floor response spectra (FRS). The best estimate FRS has been obtained either via probabilistic method, or taking into account the inelastic energy absorption, or accounting the equipment-structure mass ratio.

In those cases when the existing supports of pipelines are modified in order to provide adequate seismic capacity, e.g. when the number or type of the supports is changed, it shall be demonstrated on the basis of the relevant nuclear standards (ASME BPVC Section III (ANSI ANS N690) or KTA 3201, 3211, 3205) that the upgraded high energy pipelines and their supports comply with the following criteria:

