**6.1 Justification for possibility protection by the experiences of NPPs**

## *6.1.1 Earthquakes: vibratory ground motion*

There are plenty of examples demonstrating that the codes and standards accepted in the nuclear praxis ensure sufficient capacity of SSCs to withstand the ground vibratory effects of earthquakes.

Although the recorded ground motions exceeded those values for what the plants were designed, the safety consequences of the earthquakes were negligible. That was the case of Miyagi earthquake (August 2005) at the Onagawa NPP and the Chūetsu offshore earthquake (July 2007) at the site of the Kashiwazaki-Kariwa NPP [42]. In case of the Great Tohoku earthquake, the behavior of 13 nuclear units in the impacted area on the East shore of the Honshu Island demonstrated high resistance against ground vibrations due to earthquake. Even the Fukushima Dai-ichi plant survived the strong motion period of the earthquake. In August 2011 the North Anna plant in Virginia, USA, also survived a beyond-design-basis earthquake thanks to the designed and built margins. The North Anna case demonstrated also the adequacy of definition of damage criteria formulated in terms of cumulative absolute velocity and justified the correctness of predefined measure of margin. Although the ground motion experienced at the site exceeded the design-basis level, the damaging effect of the earthquake was found below the margin evaluated, and the damages were really negligible [43].

Sufficient capability of plants to withstand beyond-design-basis vibratory motion of earthquakes has been demonstrated by the stress tests performed in the European Union and by focused reviews implemented in other countries. The stress tests have been aimed to the review of seismic hazard assessments for sites of nuclear power plants and to the verification of the design bases, as well as to the evaluation of margins against external hazard (mainly earthquakes and floods) effects, whether the beyond-design-basis hazard effects can cause cliff-edge effect, that is, sudden loss of safety functions due to effects exceeding the design-basis one. Information on these programs in the European Union is provided at http://www. ensreg.eu/EU-Stress-Tests. Information regarding post-Fukushima measures in the USA are available at http://www.nrc.gov/reactors/operating/ops-experience/japandashboard.html and for Japan at https://www.nsr.go.jp/english/library/index.html, respectively.

#### *6.1.2 Flooding*

Food safety can be ensured by combination of technical and procedural measures, reducing the power generation or shutting down the reactors. The protection of plants against floods is feasible even at rather unfortunate sites like the Tricastin one [21]. In spite of this, floods at some sites caused safety issues. For example, at Fort Calhoun site in 2011 [41], the plant should be protected by extraordinary temporary measures. The flood and fire resulted in a 3-year shutdown of the plant. At Blayais Nuclear Power Plant in 1999 [44], the high tide and storm flooded the plant and caused an event Level 2 according to the International Nuclear Event Scale. Safety upgrading measures and improved procedures have been developed and implemented to achieve the required safety level. The case turned the attention to event combinations that are capable to cause extreme flood event. Both cases reveal the importance of design-basis definition, regular review of the hazard characterization, and checking the protection capabilities and upgrading if necessary.

The NPPs can be protected from the flooding due to tsunamis, assuming that the design-basis wave height is adequately defined and the uncertainties of the tsunami characterization is properly compensated by the conservative design. The case of Onagawa NPP demonstrates that the proper definition of the design-basis tsunami height is an essential precondition of the safety. On the 11th of March 2011 at Onagawa plant, all safety systems functioned as designed, the reactors automatically were shut down, and no damage of safety related systems, structures, and components (SSCs) occurred [31]. The Madras NPP also survived the December 2004 tsunami. Although the fatal underestimation of the design-basis tsunami wave height at the Fukushima Dai-ichi site cannot be compensated simply by designed margins, even in this case, a conscious layout of emergency diesel generator would save the plant.

### *6.1.3 Meteorological extremes*

The extreme cold and heat should not cause design difficulties that is justified by Kola and Bilibino NPPs in subpolar region of Russia and Bushehr NPP in Iran and Madras and Kudankulam NPP in Tamil Nadu, India.

The real experiences demonstrate that the NPPs can be protected from extreme storms and hurricanes [41]. There are proven solutions to protect the NPPs against extreme winds. In August 1992 the Turkey Point NPP survived the Andrew hurricane with 230 km/h wind speed (280 km/h gusts). The Sandy hurricane in October 2012 hit 34 US plants that survived the storm. Turkey Point and St. Lucie NPPs survived the Irma hurricane in 2017.

Considering the consequences of meteorological extremes, the transmission system also can interrupt the operation, especially the combination of extremes, for example, wet snow plus wind and freezing rain plus wind. Since the hydroclimatic hazards are relatively slow and predictable phenomena, safety is also ensured by reducing the power generation or shutting down the reactors.

A design principle can be mentioned here. Considering the same safetyrelated structures, the impact of aircraft crash is covering the impact effects of other phenomena, for example, the tornado missiles. The latter is covering the impact of hail whatever the size of the hail is. Obviously, the design is made for the largest effect.

#### **6.2 Indirect justification for possibility protection of NPPs**

As it has been summarized above, experiences demonstrated that the plants designed in compliance with nuclear standards can survive the effects of the vibratory ground motion even due to disastrous earthquake. However, severe accidents can be caused by phenomena accompanying or generated by the earthquakes. The severe accident of the Fukushima Dai-ichi plant was caused by tsunami. Other earthquake-related damaging phenomena can be the surface faulting and the soil liquefaction.

#### *6.2.1 Liquefaction*

In case of new plant, if the potential for soil liquefaction is recognized, the site shall be qualified as unacceptable, unless proven engineering solutions are available for the soil improvement [8]. For screening out the hazard, the factor of safety to liquefaction should be calculated by conservative deterministic method, or a probabilistic liquefaction hazard analysis should be performed. In case of operating NPPs, the liquefaction hazard and its safety relevance have been recognized either by periodic

**43**

*Natural Hazards and Nuclear Power Plant Safety DOI: http://dx.doi.org/10.5772/intechopen.83492*

*6.2.2 Surface displacement*

or focused safety reviews. Typical failure modes due to liquefaction are the tilting due to differential settlement, structural failures caused by tilting, and damages of lifeline connection to different buildings. The basic finding of 41 operating NPPs at soil sites in the USA [45] revealed that the liquefaction is generally not a safety issue. However, if it is the case, liquefaction could be an essential contributor to the core damage. Similar conclusion was made on the basis of seismic PSA for Paks NPP, Hungary. In this case, a justification of sufficient margin against liquefaction consequences should be made applying state-of-the-art techniques and best-estimate methodologies as for beyond-design-basis effects. Example for the sophisticated numerical analysis of

According to earlier regulatory approach, the existence of surface rupture and fault displacement hazard at a site was an exclusion criterion for the site [8, 15]. As a consequence of this, the detailed evaluation of hazard and the engineering treatment of consequences for nuclear power plants remained for long time an early stage of development. The post-Fukushima hazard reviews revealed the issue (a summary description of the issue and relevant publications is given, for example, in [28]). It's trivial, an earthquake happens when two blocks of the earth suddenly slip past one another, and the energy stored up in the block is released in the form of seismic waves. Surface faulting is a displacement that reaches the earth's surface during slip along a fault. However, the manifestation and the measure of the displacement depend on the magnitude and local geology. The surface rupture/ fault displacement causes mechanical effects completely differing from the effects of vibratory ground motion. That is the reason why a specific term "capable fault" has been introduced for this type of faults that is based not on seismological but on the engineering considerations. If the fault movement happens just below the plant, the consequences could be tilting, foundation and structural failures, and damages of lifelines due to differential displacements. However, the safety significance of displacement depends on the measure and type of displacement. There are sufficient engineering knowledge and analytical tools to evaluate the consequences of

liquefaction hazard and its consequences has been made for Paks NPP [46].

surface displacements as it is stated in [15, 28, 47, 48].

period or 475 years as per EUROCODE 8.

**7. Operability of nuclear power plants during and after the events**

The operability of the plant is defined by the weakest link, that is, by those non-safety-related SSCs designed/qualified to withstand low-magnitude effects of natural phenomena according to building code or conventional industrial standards (e.g., EUROCODE 8 for earthquakes). These magnitudes usually correspond to the 100 years of return period events. In case of earthquakes, the limit of continuous operation is the operation-based earthquake with approximately 100 years of return

If the return period, T, of the lower magnitude hazard effects is 100 years, the probability of exceeding the corresponding magnitude of hazard for the entire operational lifetime (60 years) is *PE*<sup>60</sup> ≥0.4528. This is the probability of the shutdown and related economic losses caused by exceedance of magnitude of the operational level. The relevant hazards limiting the operation for the inland freshwater-cooled plants like the Paks NPP in Hungary are the low flow rate in river and high water temperature. Controlling parameter for freshwater cooled plants is defined in terms of river water temperature measured at some distance from the hot cooling water outflow. In these cases, for safety and environmental protection, the power

*Natural Hazards and Nuclear Power Plant Safety DOI: http://dx.doi.org/10.5772/intechopen.83492*

or focused safety reviews. Typical failure modes due to liquefaction are the tilting due to differential settlement, structural failures caused by tilting, and damages of lifeline connection to different buildings. The basic finding of 41 operating NPPs at soil sites in the USA [45] revealed that the liquefaction is generally not a safety issue. However, if it is the case, liquefaction could be an essential contributor to the core damage. Similar conclusion was made on the basis of seismic PSA for Paks NPP, Hungary. In this case, a justification of sufficient margin against liquefaction consequences should be made applying state-of-the-art techniques and best-estimate methodologies as for beyond-design-basis effects. Example for the sophisticated numerical analysis of liquefaction hazard and its consequences has been made for Paks NPP [46].

#### *6.2.2 Surface displacement*

*Natural Hazards - Risk, Exposure, Response, and Resilience*

Madras and Kudankulam NPP in Tamil Nadu, India.

reducing the power generation or shutting down the reactors.

**6.2 Indirect justification for possibility protection of NPPs**

save the plant.

the largest effect.

liquefaction.

*6.2.1 Liquefaction*

*6.1.3 Meteorological extremes*

survived the Irma hurricane in 2017.

The NPPs can be protected from the flooding due to tsunamis, assuming that the design-basis wave height is adequately defined and the uncertainties of the tsunami characterization is properly compensated by the conservative design. The case of Onagawa NPP demonstrates that the proper definition of the design-basis tsunami height is an essential precondition of the safety. On the 11th of March 2011 at Onagawa plant, all safety systems functioned as designed, the reactors automatically were shut down, and no damage of safety related systems, structures, and components (SSCs) occurred [31]. The Madras NPP also survived the December 2004 tsunami. Although the fatal underestimation of the design-basis tsunami wave height at the Fukushima Dai-ichi site cannot be compensated simply by designed margins, even in this case, a conscious layout of emergency diesel generator would

The extreme cold and heat should not cause design difficulties that is justified by Kola and Bilibino NPPs in subpolar region of Russia and Bushehr NPP in Iran and

The real experiences demonstrate that the NPPs can be protected from extreme storms and hurricanes [41]. There are proven solutions to protect the NPPs against extreme winds. In August 1992 the Turkey Point NPP survived the Andrew hurricane with 230 km/h wind speed (280 km/h gusts). The Sandy hurricane in October 2012 hit 34 US plants that survived the storm. Turkey Point and St. Lucie NPPs

Considering the consequences of meteorological extremes, the transmission system also can interrupt the operation, especially the combination of extremes, for example, wet snow plus wind and freezing rain plus wind. Since the hydroclimatic hazards are relatively slow and predictable phenomena, safety is also ensured by

A design principle can be mentioned here. Considering the same safetyrelated structures, the impact of aircraft crash is covering the impact effects of other phenomena, for example, the tornado missiles. The latter is covering the impact of hail whatever the size of the hail is. Obviously, the design is made for

As it has been summarized above, experiences demonstrated that the plants designed in compliance with nuclear standards can survive the effects of the vibratory ground motion even due to disastrous earthquake. However, severe accidents can be caused by phenomena accompanying or generated by the earthquakes. The severe accident of the Fukushima Dai-ichi plant was caused by tsunami. Other earthquake-related damaging phenomena can be the surface faulting and the soil

In case of new plant, if the potential for soil liquefaction is recognized, the site shall be qualified as unacceptable, unless proven engineering solutions are available for the soil improvement [8]. For screening out the hazard, the factor of safety to liquefaction should be calculated by conservative deterministic method, or a probabilistic liquefaction hazard analysis should be performed. In case of operating NPPs, the liquefaction hazard and its safety relevance have been recognized either by periodic

**42**

According to earlier regulatory approach, the existence of surface rupture and fault displacement hazard at a site was an exclusion criterion for the site [8, 15]. As a consequence of this, the detailed evaluation of hazard and the engineering treatment of consequences for nuclear power plants remained for long time an early stage of development. The post-Fukushima hazard reviews revealed the issue (a summary description of the issue and relevant publications is given, for example, in [28]). It's trivial, an earthquake happens when two blocks of the earth suddenly slip past one another, and the energy stored up in the block is released in the form of seismic waves. Surface faulting is a displacement that reaches the earth's surface during slip along a fault. However, the manifestation and the measure of the displacement depend on the magnitude and local geology. The surface rupture/ fault displacement causes mechanical effects completely differing from the effects of vibratory ground motion. That is the reason why a specific term "capable fault" has been introduced for this type of faults that is based not on seismological but on the engineering considerations. If the fault movement happens just below the plant, the consequences could be tilting, foundation and structural failures, and damages of lifelines due to differential displacements. However, the safety significance of displacement depends on the measure and type of displacement. There are sufficient engineering knowledge and analytical tools to evaluate the consequences of surface displacements as it is stated in [15, 28, 47, 48].
