**3.1. Objective and scope of the seismic safety programmes**

Generic objective of the seismic safety programmes is to ensure the basic nuclear safety functions, i.e.


The functions have to be maintained for the earthquakes within the design basis envelope and with some extent for the earthquakes with parameters exceeding the design basis one.

The basic concept of the seismic safety re-evaluation and of the operating nuclear power plants, and the selection of the methods and criteria is different from that are required in case of the design of new power plants; see the *INSAG-8* document "*A Common Basis for Judging the Safety of Nuclear Power Plants Built to Earlier Standards"* (IAEA, 1995).

Seismic Safety Analysis and Upgrading of Operating Nuclear Power Plants 85

scope of the programme was limited to the equipment needed for the safe shutdown of the reactor after a design basis earthquake and bringing the plant to a stable hot or cold shutdown condition for as minimum 72 hours of time. A single shutdown path and a backup for decay heat removal were defined. The seismic input used for the qualification was set to the SSE and the design floor response spectra. The core of the GIP is the empirical qualification method and

It is important to demonstrate on one hand that the nuclear power plant will remain safe in case of an earthquake that exceeds the design base level, whether the basic safety functions can be lost due to sudden failure (i.e. 'cliff-edge' effect). On the other hand it is important to know the contribution of the seismic hazard to the plant core damage frequency. Example for margin assessment and quantification of the seismic safety in terms of core damage frequency is the NRC initiated Individual Plant Examination of External Events, thereafter IPEEE in the U.S. (NRC, 1991). There are three methods for the margin assessment: the seismic PSA, and margin assessment using either the deterministic method developed by EPRI or the probabilistic method developed by the NRC. In this case of deterministic method a reference level earthquake is selected for which – under certain assumptions – the capacity has to be demonstrated. The scope of SSCs considered in the margin assessment depends on the method selected, e.g. in case of seismic PSA the scope of SSCs is identical to

The most demanding programmes were those for ensuring the compliance with newly

1. Evaluation of the seismic hazard of the site that includes the associated with earthquake

3. Identification of the structures, systems and equipment, which are needed for ensuring

8. Evaluation of the safety, i.e. quantification of the core damage frequency due to

Depending on the case and the national regulation, the scope of the design base reconstitution programme can cover either all SSCs classified into seismic and safety classes as per new design, or the scope is limited to the SSCs required for safe shutdown and

4. Evaluation of the seismic capacity of SSCs and identification of the upgrading;

7. Development of pre-earthquake preparedness and post-earthquake measures;

database. The GIP was applied in several countries, e.g. U.K. and Belgium.

*3.1.2. Seismic margin programmes* 

the Level 1 PSA plus the containment.

*3.1.3. Reconstituting the design basis* 

events, e.g. liquefaction;

that basic safety functions;

6. Installation of seismic instrumentation;

These programmes include the following tasks:

2. Development of the design basis earthquake characteristics;

earthquake, quantification of the safety margins.

5. Design and implementation of the necessary corrective measures;

defined design basis.

The graded approach is used while ensuring the seismic safety of NPPs, i.e. the safety importance of the SSCs is considered and according to this the SSCs are classified into seismic safety classes, which define the requirements assigned to the design, qualification and operation of the SSCs. Well-defined set of plant systems and structures and components are required to be functional during and after the earthquake for bringing the plant in-to stable shutdown condition. Some of those SSCs are passive, e.g. the pressure retaining boundaries or the containment. They shall sustain the vibratory load remaining leak-tight; however some plastic deformation, ductile behaviour might be allowed. In some cases the deformation has to be limited to the elastic for ensuring some active functions. Building structures and equipment supporting structures might be also loaded to plastic region up-to the level, which does not impair the intended safety functions. The active systems functionality requires qualification for the vibratory motion as well as availability of supporting functions, e.g. electrical power supply.

Practically, a conscious and careful evaluation and utilisation of the built-in margins provide the possibility for achieving the target safety level at operating plants by feasible amount of modifications and re-qualifications.

The scope and the methodology of the seismic safety programmes vary with the motivation of the particular project. Practically there have been three different objectives of the past seismic safety programmes:


The objective and scope of recent seismic safety re-evaluation programmes is to demonstrate the plant safety for the design base extension, to justify the re-start after strong earthquake, and to identify the plant vulnerability in case of severe event and develop adequate accident management provisions.

### *3.1.1. Resolving the inadequacy issues*

Example for the first type of seismic safety programme is the resolution of USI A-46 seismic issues of older, operating nuclear power plants in the U.S. (NRC, 1987). This programme was aimed to demonstrate the seismic adequacy of essential equipment at older operating plants by the use of available seismic experience data for similar equipment. The rules for the resolution of the USI A-46 issues are defined in the Generic Implementation Procedure, thereafter GIP, developed for Seismic Qualification Utility Group [SQUG] (SQUG, 1992). The scope of the programme was limited to the equipment needed for the safe shutdown of the reactor after a design basis earthquake and bringing the plant to a stable hot or cold shutdown condition for as minimum 72 hours of time. A single shutdown path and a backup for decay heat removal were defined. The seismic input used for the qualification was set to the SSE and the design floor response spectra. The core of the GIP is the empirical qualification method and database. The GIP was applied in several countries, e.g. U.K. and Belgium.

### *3.1.2. Seismic margin programmes*

84 Nuclear Power – Practical Aspects

modifications and re-qualifications.

seismic safety programmes:

regulations);

management provisions.

*3.1.1. Resolving the inadequacy issues* 

The basic concept of the seismic safety re-evaluation and of the operating nuclear power plants, and the selection of the methods and criteria is different from that are required in case of the design of new power plants; see the *INSAG-8* document "*A Common Basis for* 

The graded approach is used while ensuring the seismic safety of NPPs, i.e. the safety importance of the SSCs is considered and according to this the SSCs are classified into seismic safety classes, which define the requirements assigned to the design, qualification and operation of the SSCs. Well-defined set of plant systems and structures and components are required to be functional during and after the earthquake for bringing the plant in-to stable shutdown condition. Some of those SSCs are passive, e.g. the pressure retaining boundaries or the containment. They shall sustain the vibratory load remaining leak-tight; however some plastic deformation, ductile behaviour might be allowed. In some cases the deformation has to be limited to the elastic for ensuring some active functions. Building structures and equipment supporting structures might be also loaded to plastic region up-to the level, which does not impair the intended safety functions. The active systems functionality requires qualification for the vibratory motion as well as availability of supporting functions, e.g. electrical power supply. Practically, a conscious and careful evaluation and utilisation of the built-in margins provide the possibility for achieving the target safety level at operating plants by feasible amount of

The scope and the methodology of the seismic safety programmes vary with the motivation of the particular project. Practically there have been three different objectives of the past

1. to resolve the inadequacy of the design and qualification while the seismic design basis

2. to comply with newly defined seismic design basis (modification of design basis either because of new scientific evidences regarding seismic hazard or because of changing

The objective and scope of recent seismic safety re-evaluation programmes is to demonstrate the plant safety for the design base extension, to justify the re-start after strong earthquake, and to identify the plant vulnerability in case of severe event and develop adequate accident

Example for the first type of seismic safety programme is the resolution of USI A-46 seismic issues of older, operating nuclear power plants in the U.S. (NRC, 1987). This programme was aimed to demonstrate the seismic adequacy of essential equipment at older operating plants by the use of available seismic experience data for similar equipment. The rules for the resolution of the USI A-46 issues are defined in the Generic Implementation Procedure, thereafter GIP, developed for Seismic Qualification Utility Group [SQUG] (SQUG, 1992). The

remains unchanged, i.e. to comply with the current licensing basis;

3. to evaluate and demonstrate the seismic margin.

*Judging the Safety of Nuclear Power Plants Built to Earlier Standards"* (IAEA, 1995).

It is important to demonstrate on one hand that the nuclear power plant will remain safe in case of an earthquake that exceeds the design base level, whether the basic safety functions can be lost due to sudden failure (i.e. 'cliff-edge' effect). On the other hand it is important to know the contribution of the seismic hazard to the plant core damage frequency. Example for margin assessment and quantification of the seismic safety in terms of core damage frequency is the NRC initiated Individual Plant Examination of External Events, thereafter IPEEE in the U.S. (NRC, 1991). There are three methods for the margin assessment: the seismic PSA, and margin assessment using either the deterministic method developed by EPRI or the probabilistic method developed by the NRC. In this case of deterministic method a reference level earthquake is selected for which – under certain assumptions – the capacity has to be demonstrated. The scope of SSCs considered in the margin assessment depends on the method selected, e.g. in case of seismic PSA the scope of SSCs is identical to the Level 1 PSA plus the containment.

## *3.1.3. Reconstituting the design basis*

The most demanding programmes were those for ensuring the compliance with newly defined design basis.

These programmes include the following tasks:


Depending on the case and the national regulation, the scope of the design base reconstitution programme can cover either all SSCs classified into seismic and safety classes as per new design, or the scope is limited to the SSCs required for safe shutdown and bringing the reactor into stable (hot or cold) shutdown condition. Those non-safety classified SSCs have to be also considered damage/failure of which can disable certain safety functions due to seismic interactions (falling down, flooding, fire).

Seismic Safety Analysis and Upgrading of Operating Nuclear Power Plants 87

**3.2. Methodologies for re-evaluation of seismic safety** 

a. Seismic Probabilistic Safety Assessment (NRC, 1983)

similar to GIP that also covers pipelines and ventilation ducts (DoE, 1997).

The steps of the Generic Implementation Procedure are as follows (SQUG, 1992):

1. Qualification by empirical methods

3. Design methods – justification by analysis

the Safety Guides NS-G-1.6 as well as NS-G-2.13.




was the case at Paks NPP.

calculated for the newly defined DBE).



*3.2.1. Qualification by empirical method* 

2. Quantification of margins:

The methodologies for the seismic re-evaluation and re-qualification are as follows:

b. NRC Seismic Margins Method (Budnitz et al., 1985; Prassinos et al., 1986) c. Electric Power Research Institute Seismic Margins Method (EPRI, 1988)

Empirical qualification of the plant equipment is a powerful tool for seismic re-qualification of operating NPPs. The empirical qualification methods have been recognised by IAEA in

The empirical qualification database developed for SQUG covers twenty classes of equipment, e.g. active equipment as well as cable raceways, tanks and heat exchangers (SQUG, 1992; Starck&Thomas, 1990), except of pipelines and structures. As an alternative solution, the U.S. Department of Energy [DoE] has developed the Seismic Evaluation Procedures, a procedure

The methodology and the database (the so called SQUG-database) can be adapted to the needs of different programmes for the resolution of design/qualification inadequacy issues. Generally the process has to be started with development of the list of SSCs requiring requalification for a given level of earthquake. The basis of the identification of the scope can be the list of SSCs for safe shutdown or the seismic and/or safety classification database as it

Four criteria are used for the verification of seismic capacity: (1) Comparison of the seismic demand to the SQUG bounding spectrum; (2) Checking in the experience database (caveats and inclusion rules); (3) Checking the anchorage; (4) Evaluation of the seismic interactions.

The seismic demand can be defined either by design floor response spectra, or by scaling-up the design floor response spectra to the required level, or by completely new response calculation for the required input (e.g. at Paks NPP the floor response spectra have been

## *3.1.4. Recent beyond design base studies*

The quantification of the margins has three aspects:


According to the IAEA design requirements NS-R-1 (IAEA, 2000), *the seismic design of the plant shall provide for a sufficient safety margin to protect against seismic events.* This means that the abrupt lost of function has to be excluded by the design even if the earthquake demand exceed the design base one (see also NS-R-1.6 paragraph 2.39 regarding 'cliff-edge' effect).

According to the novel requirements, the capability of the new plants to withstand the loads and conditions of the design basis extension has to be ensured by the design provisions. In case of new plants, a minimum configuration of SSCs for ensuring the shutdown and subcriticality of the reactor, heat removal to the ultimate heat sink and the containment have to remain functional for the accident management purposes. A margin type evaluation has to be performed for demonstration the beyond design base capabilities of the new plants (1.4 times the SSE loads as per EUR requirements and 1.67 times of the SSE loads in the U.S. practice). Best estimate methods can be used for the justification beyond design base capabilities.

The plant safety re-assessment after a strong earthquake requires an overall checking the post-event condition of all SSCs, even those non-safety classified SSCs, since both the safety and operability have to be demonstrated. The possible analysis and testing/inspection methods should be selected and applied in accordance with safety relevance and impact on the operation (Nomoto, 2000). According to (Kassawara, 2008), the probabilistic margin analysis can also be effective in this case.

Recently, the availability of severe accident management provisions become of great importance. The scope of stress tests covers review of compliance with design base requirements, demonstration of beyond design base capacity (avoidance of the cliff-edge effect) and identification of plant vulnerability/damage state and development of severe accident management measures and guidelines. Generally, some margin type analyses have been performed in the participating countries for the possible minimum configurations needed for shutdown and heat removal of the reactor and spent fuel and protection of the containment. Identification of seismic interactions (fires, flooding, logistical obstacles) became important since these can affect the function of the SSCs within the minimum configuration, inhibit the connections of provisory power and cooling lines, impeding the implementation of Severe Accident Management/mitigation measures as it is to see in the country reports at the European Nuclear Safety Regulators Group site (ENSREG, 2012).
