external hazards, new insights into old issues

7/31/2019 External Hazards, New Insights Into Old Issues

1/32

E U R O S A F E T R I B U N ETOPICAL

Published jointly by GRS and IRSN as a contribution to the EUROSAFE approach

Chang ing hazardsR isk assessmentPro tect ion measuresNew fac i l i ty des ignRetro f i t t ing

EXTERNAL HAZARDS

NEW INSIGHTS INTO OLD ISSUES


2/32

EXTERNAL HAZARDSIN A CHANGING ENVIRONMENT 4External hazards: Taking upnew challenges

DESIGN CONCEPTS AND

HAZARD ASSESSMENT 8

Design load case: From deterministicto probabilistic assessment

SEISMOLOGY 11From earthquakes to seismic hazard

SEISMIC DESIGNOF NPP BUILDINGS 14

Taming the Namazu

REASSESSMENT OFFLOOD PROTECTION MEASURES 17An overview of Belgianand Dutch experience

Tsunamis: A (not so) new threat

FROM GLOBAL CLIMATE CHANGETO LOCAL CLIMATE IMPACT 23Global warming, a fairly local issue

NEW DESIGN REQUIREMENTS 25New challenges in NPP design

due to climate change

EVOLUTION OF SITING ANDRETROFITTING METHODS 28Coping with external hazardsin the future

CONTENTS


3/32

Winter1999: A powerful storm named Lothar sweeps througof France, causing significant flooding at Le Blayais NPP, safety-related buildings. Summer2007: The strongest earthquaan NPP occurs near Kashiwazaki-Kariwa, the worlds largesplant, located in western Japan. Though the reactors and theequipment perform satisfactorily, the quake damages non

equipment, and four of the seven units are still shut down. Sunprecedented heat wave hits several parts of Russia, lightinfires. Working day and night, the fire squadrons succeed in coonly four kilometres away from the Novovoronezh NPP. Thnever out of control in any of these three cases, and yetThis issue of the EUROSAFE Tribune, devoted to externalwitness to the increasing awareness of the uncertainty aphenomena such as floods, earthquakes, tsunamis, extreme

sandstorms, and airplane crashes. It provides an overviewlearned from each event and of the knowledge gained from aimed at making nuclear facilities less vulnerable to externalstage of the lifecycle, from design through siting, constructionWe invite you to draw your own conclusions on these issues, apleasant reading.

Jacques Repussard and Heinz Liemersdorf

Jacques Repussard (IRSN) and Heinz Liemersdorf (GRS).

T O O U R R E


4/32

Jean-Christophe Gariel and Tiberiu Mateescu, IRSN (France)

Ever since the inception of the nuclear power industry, increased awareness of the risks oevents, combined with greater consideration of the risks associated with climate change anhave prompted the evolution of safety design and assessments methods with respect to eHow are these methods impacted? How should the design and operation of nuclear faciliti

maintain safety levels? A French perspective.

Risks relating to external hazards,whether natural or man-made, aretaken into consideration in the designof nuclear facilities (power reactors,nuclear fuel cycle plants, research

reactors, laboratories, etc.) and areregularly reviewed during periodicsafety reviews (PSRs). These risksmust be studied to guarantee safetyfunctions which, in the case of powerreactors, include shutdown, main-taining the reactor in a safe shutdownstate, residual heat removal and con-tainment of radioactive products.

Collecting exhaustive, quality data:A challenging prerequisite

With a view to design protectionagainst risks related to externalhazards, the hazards to be taken into

bilistic or determinused is always relian(recorded in meteoearthquake catalogsures) that are proc

maximum event forThe definition of thfore highly dependeand exhaustivenessThe environment facilities changes, fsons: climatic and gchange on a global oglobal warming or

or changes in infincreased air traffland use). Prospectiareas provide valuabut contain even grwhen we focus on e

External hazards:Taking up new challenges

EXTERNAL HAZARDS IN A CHANGING ENVIRONMENT


5/32

applied to assessment of the robust-

ness of methods used to characteriseexternal hazards. Two major ques-tions emerge from this operatingexperience: have any extreme eventsoccurred in recent years and, if so,have they called hazards definitioninto question? Has any new technicaland scientific knowledge been

acquired and, if so, has it led to theneed to change methods used toassess external hazards? A coupleof cases offering answers to thesequestions follow.

Flooding: Partial flooding ofLe Blayais nuclear power plant in 1999

In December 1999, an exceptionally

violent storm struck most of Europe.It led to the partial flooding of LeBlayais nuclear power plant, locatedalong the Gironde estuary in south-western France, and a partial loss ofoffsite power. Analysis showed thatthe exceptionally high water levelsobserved during the storm were due

to the combined effects of high tide,storm surge and waves driven by verystrong wind. The partial flooding ofthe site was due to the fact that thelast of these factors was not taken intoconsideration when the height of thedike that protects the site was calcu-lated. The feedback from this situa-tion led to the re-assessment of flood

protection for all nuclear facilitiesand to improved characterisation ofthe flood risk by taking additionalphenomena and combinations ofphenomena into account, such as theimpact of wind on wave height and

Heat waves: The summers of 2003

and 2006During these two summers, meandaily temperatures were well abovemean values observed over the previ-ous thirty years. In addition to highair temperatures, these extreme cli-matic events resulted in a steep risein river water temperatures. In 2003,

in particular, water temperatures inseveral rivers rose five degrees abovethe mean historical temperature andexceeded maximum historical values.This led the regulators to issue a tem-porary discharge permit based exclu-sively on the relative increase in watertemperature rather than on obser-vance of an absolute temperature

threshold. Since the 2003 heat wave,forecast calculations based on climaticchange models were performed show-ing that, by2020-2035, extreme tem-peratures could largely exceed thoserecorded in 2003 and 2006. In light ofthese observations and forecasts, EDFdecided to increase the capacity of

some of its heat exchangers.

Earthquakes: Lessons learned fromKashiwazaki-Kariwa

The most severe earthquake everrecorded at a nuclear facility occurredat the Kashiwazaki-Kariwa nuclearpower plant, located in Niigata Pre-fecture, 250 km northwest of Tokyo,

Japan. The 6.6 magnitude earthquakethat struck the seven-reactor powerplant occurred along a fault in whichthe seismogenic potential (i.e. themost powerful earthquake likely tooccur at this spot) had been signifi-

E X T E R N A L H A Z A R D S I N A C H A N G I


6/32

Aircraft crashes: Fa

changing aircraft tyThe method used boperators to assess craft crash for theion the applicationRules i.1.a and i.2ASN. A probabil iadopted first. For e

the annual probabtended aircraft craeach target facility. Tperformed for eachcategories: general weighing less thanmercial aviation andThe assessment is bstatistics and reco

involving each catemetropolitan Franctic objective of the Bis that the overallfacility being the soceptable release ofstances should no

year, expressed as an

tude. In practical teprobability of a crsafety function for aaircraft exceeds antude of10-7, the radquences are then deterministic appconsequences are utarget facilities wh

safety function muwithstand a crash isentative aircraft iconsidered.The aircraft crash reviewed during t

ena into consideration, the seismic

hazard for sensitive facilities can stillbe largely underestimated.In France, the Basic Safety Rule con-cerning seismic hazard assessmentwas revised in light of fresh seismo-logical knowledge. The 2001 revisionintroduced two new concepts. Firstly,consideration was given to paleoseis-

mology, the study of earthquakeswith very long return periods (severaltens of thousands of years), far longerthan the period considered in histor-ical seismology, which is about onethousand years in France. Secondly,the effects of local amplificationinduced by the presence of softgeological layers at the surface were

taken into account, as these layersamplify seismic motion.

Aircraft crash test in the USA.

E X T E R N A L H A Z A R D S I N A C H A N G I N G E N V I R O N M E N T


7/32

used in fighting forest fires, especially

in the south of France) and air trafficin each category, as well as the growingamount of statistical data availableto refine approaches.With regard to intentional aircraftcrashes, nuclear facilities are underconstant surveillance and a variety ofmeasures were implemented in the

wake of the9/11

terrorist attacks in2001

.External hazards: New types ofphenomena to be factored in

All of the above examples show thatclose attention must be paid to assess-ing risks relating to external hazards.There are several situations wherethe intensity of expected events has

been underestimated or inadequatelyassessed owing to the failure to consider

certain phenomena or combinations

will have to be addressed when

defining the risks relating to externalhazards. In some of these countries,for example, the new facilities willbe located in regions with conditions weather conditions in particular that have never been encountered bythe facilities currently in operationaround the world. These conditions

include the regular occurrence ofextremely high air temperatures(above 40C) and high cooling watertemperatures (above 30C). Suchproblems will need to be taken intoaccount. Other climatic phenomena,such as sandstorms, which have notpreviously received much attention,will now have to be considered.

Sand stor

E X T E R N A L H A Z A R D S I N A C H A N G I


8/32

The spectrum of hazards to be con-

sidered, the different design provi-sions, and the type and extent of theprotection measures required accord-ing to the standards and regulationshave changed over time. This isreflected most notably in the GermanNPP fleet, comprising four design gen-erations of pressurised water reactorsand two construction lines for boiling

water reactors. Despite all the differ-ences in the design, one similarity isnoticeable: all design concepts werebased on deterministic considerations.Up to now, regulations and standardsrefer to probabilistic methods, mainly

wind and snow pa

standards and regulaAccording to the tedocument on PSA menting the Germperiodic safety revianalyses are requirgories of externalquakes, flooding, praircraft crashes.

From design earthquearthquaketo design

Seismic hazards areGerman Nuclear KTA 2201, Design o

Design load case: Fromdeterministic to probabilist

assessmentHeinz Liemersdorf, GRS (Germany) | Heinz-Peter Berg, BfS (Germany) | Dietmar Hosser,

External hazards have the potential to affect a nuclear power plant (NPP) as a whole, and

induce initiating events (e.g. loss-of-coolant accidents or transients) and impair the safety syto limit the consequences of these events. This is why German NPPs have been designedimpact of external hazards such as aircraft crashes, pressure waves, earthquakes and flooddraws increasingly upon probabilistic safety assessments (PSAs).

DESIGN CONCEPTS AND HAZARD ASSESSMENT


9/32

operation basis earthquake), repre-

senting a lower intensity earthquakefor which continued plant operationshould be feasible, and the safetyearthquake(similar to a safe shut-down earthquake), which determinesthe ultimate safety-related designrequirements. In the revised versionof KTA 2201, published in 1990, thedesign basis earthquake replaced thistwo-level concept. Based on scientificknowledge, this designates the mostsevere earthquake that could poten-tially affect the plant site. Its determi-nation is essentially based on thedefinition of seismic source zonesand observed historic seismicity.Although a target exceedance proba-

bility of 10-4 per year together withan 84-percentile design spectrum isapplied, this is not specified in thecurrent standard. In the ongoingrevision of KTA 2201, an exceedanceprobability of10-5 per year togetherwith a median design spectrum andthe additional application of proba-

bilistic methods will be introduced.

The value of experience feedback insafety standard revisions

Other, more specific KTA safety stan-dards, which have also been revisedtwice, are dedicated to protectionagainst flooding (KTA 2207) andlightning (KTA 2206). KTA 2207,

issued in 1982, was revised in 1992 and2004. The last amendment of thisstandard was a direct consequence ofoperating experience: In 1999, theLe Blayais site in the southwest ofFrance was affected by the winter

basis flood was set at 10-4 per year. As

stipulated in the previous version ofthe standard, permanent protectionmeasures are required for floodevents with exceedance probabilitiesof up to 10-2 per year, whereas tempo-rary measures are allowed for proba-bilities from 10-2 to 10-4 per year.The standard on lightning protection,KTA 2206, was first published in 1992as a consequence of operating experi-ence in the eighties. The revisionsin 2000 and 2009 incorporate newscientific and technical findings.

Increasing awareness of man-madehazards

While no KTA standards for man-

made hazards exist so far, guidelinesare available for protection againstpressure waves from chemical explo-sions and aircraft crashes. A guidelineon pressure waves focusing on appro-priate site selection and on structuraldesign measures i.e. on the designagainst a pre-defined pressure curve

was issued in1976

, whereas a specificsection on aircraft crashes supple-mented the RSK Guidelines for Pres-surised Water Reactors in 1974.Originally, the aircraft crash hazardscovered only military jets, not civilaircraft. Design analyses for GermanNPPs in the early seventies werealready based on the characteristics of

Starfighter-type military aircraft(mass and velocity at time of impact).But since the typical NATO jet inoperation over Germany at that timewas the Phantom, a load functioncompatible with the impact of that

Views of tthe 2007 t

Kariwa NP

D E S I G N C O N C E P T S A N D H A Z


10/32

cannot be screened

ards, strong winds, and human-inducedter cover off-site exppipeline accident), stance releases andaircraft crash.

PSAs: An integral paprojects

For new NPP prosignificant improverequirement for PSstage, reduction inconsequences of eand crash protectisize civil aircraft.The current revisio

technical PSA documwill adopt experienPSAs for external hfrom progress in metdata, but also froas the increasing nover Germany, whbroadening of prev

air routes.

Incorporating PSAs in internationalsafety documents: A slow but steadytrend

Over the last thirty years, probabilis-tic risk assessment has supplementeddeterministic hazard assessmentmore and more. As operating experi-

ence at several NPP sites, mainly inthe USA and Japan, revealed non-negligible frequencies of specific haz-ards such as earthquakes, hurricanes,tornadoes and flooding, it was recog-nised that nature-induced hazardsmight impair NPP safety signifi-cantly. There were therefore somefirst attempts to incorporate external

hazards in probabilistic assessment.Due to difficulties in determiningexceedance probabilities for this typeof hazard and in incorporating theirimpact in the plant model, it tooknearly fifteen years until the first

Subsidence of refilled soil after

the 2007 tremor at Kashiwazaki-

Kariwa NPP (western Japan).

D E S I G N C O N C E P T S A N D H A Z A R D A S S E S S M E N T


11/32

Because earthquakes are potentially highly damaging, NPP site studies include assessmentshazard inherent in each candidate site. Similar studies are performed in Germany for operatinof periodic safety reviews. From the observation of earthquakes to the calculation of the seismarticle provides an overview of scientific advances and limitations.

Timo Schmitt, SDA-engineering GmbH (Germany)

evaluation is based firstly on historicaland recent seismicity data collectedin earthquake catalogues, and secondlyon knowledge about geology andtectonics, such as source regions andactive faults.

Estimating the seismic hazard for dif-ferent probabilities of exceedance

The first seismic hazard assessmentsfor nuclear power plants were carriedout in the late 60s following deter-ministic procedures. At that time,guidelines were developed to providea framework and basic requirements

for performing seismic hazardassessments (see Table). The deter-ministic seismic hazard assessment(DSHA) considers case scenarios andevaluates the strongest credible vibra-tions at the site, based on historical

As we were reminded by the Haititremor in January2010, earthquakesare among the most destructive nat-ural disasters in the world, producingsignificant accelerations at frequen-cies to which buildings are vulnera-

ble. To avoid damage, the first stepshould therefore be evaluation of theseismic hazard based on target safetylevels. For standard civil engineeringcalculations, seismic loads are speci-fied in national building codes bystandard response spectra. Usually,the seismic hazard is calculated for aprobability of10% in 50years, i.e. a

return period of475years. For facili-ties with high secondary risk, such asnuclear power plants, radioactivewaste deposits or large dams, longerreturn periods are required. Thisis the case for nuclear power plants

SEISMOLOGY

From earthquakes to seismichazard


12/32

(see box). Part of this work is the total

probability theorem, where the proba-bility that the expected earthquakeparameter at the site will be reachedor exceeded is dependent on earth-quake strength, distance and thecumulative distribution functions ofthese two characteristics. Computerprogrammes were developed in the70 s based on this theory, the best-known being EQRISK, which made itpossible to perform a PSHA withnumerical procedures. It took a fewmore years for probabilistic methodsto disseminate and be used by NPPowners. Nowadays, the PSHA is thestandard procedure for seismic hazardassessment, and PSHA methodolo-

gies were made mandatory for NPPcodes (although most of the codesstill prescribe a deterministic proce-dure as the basic requirement).

The significance of uncertaintiesDeterministic and probabilistic meth-ods are basically the same, except thatthe PSHA evaluates the earthquakesstatistically and provides design accel-erations for different probabilities ofexceedance, thereby making it possibleto define safety or design levels. Overtime, the PSHA became more sophisti-cated and the importance of uncertain-ties was identified. Uncertainties weredivided into mathematical uncertainties

(aleatory) and model uncertainties(epistemic). Although all uncertaintiesare theoretically epistemic, the differ-entiation is useful for consideration inthe hazard calculation. Aleatory uncer-tainties such as attenuation of ground

The seismic hazard

periodsGenerally, the grearelate to ground moand local soil conditof soil dynamics canestimate the effects on the local site. Tare already standardtant to determine icarefully. This is dments of shear wavsite in addition to bgive the stratigraphdensity. The trend toan increasing numties leads to hazard rcomprehensible any

studies are performresults of the PSHAIn these studies, the hgated to analyse thegle hazard parametestudies consider thesource characterismagnitudes, attenetc. on the aggregasite. The informatsource regions are soverall hazard is owhen earthquake sin design calculatioAlthough there arseismic hazard assesa particular site som

nificantly among esurprise in the casfor which we havecenturies of obserrequired return periof NPPs are very lon

S E I S M O L O G Y


13/32

that different experts represent a

community of opinion. Project man-agement plays an important role inthis approach. The question thenarises as to whether a hazard studydesigned to factor in all eventualitiesand include several different expertgroups really meets the goal of a moreprecise hazard assessment, or if it justproduces more data and a broaderdistribution of uncertainty. However,the PSHA is not a standard procedureand it is therefore important to docu-ment all input data and to describeand explain all methodologies anddecisions in order to make the calcu-lations reproducible.How will the PSHA evolve in the

future? Are we taking a step back tosmaller and more efficient expertgroups, concentrating on the mostsignificant parameters? Is a scenario-based approach thinkable? In practice,a hazard assessment for the licensingprocess might be carried out either bysetting up workshops with experts,advisors and reviewers, or through astudy performed by an expert workinggroup and reviewed by another inde-pendent group. However, benchmarktests are often neglected.

Checking the reliability of resultsMathematically, we can calculate theseismic hazard to infinitely small

probabilities, resulting in accelera-tions that are physically impossibledue to the implied Gaussian distribu-tion in the hazard formulation. It istherefore essential to have toolsaimed at checking the reliability of

First, it is assumed that earthquakes are Poisson-distributstatistically independent events. Therefore, it is important aftershocks before calculating the regression parameterdistribution of the source regions. PSHA programmes calca site as follows: The area around the site is divided into smregion, the frequency distribution and the activity rate of eartThe hazard at the site can therefore be calculated for a gi

attenuation function. The sum of all contributions from all sa hazard curve for the site. The hazard curve gives the earterms of spectral accelerations, peak ground accelerations

Principle of a probabilistic seismic hazard calculation

Basic Data

Earthquake catalogues, Geology and (Neo-)Tectonics, local soil

Basic Model Parameters

Seismic source regions Ground motion attenuation functions Local soil conditions For each source region: Depth distribution

Maximum credible earthquake strength Frequency distribution of earthquakes (only PSHA)

Hazard Calculation

Probabilistic

Probability of excedifferent site inten

response spectra

Soil dynamic calculations

Deterministic

Maximum credible site intensityresponse spectra acceleration


14/32

The regulatory basis of seismic designIn Europe, seismic design of civilstructures is based on a standardcalled Eurocode8(EC8), whose mainobjective is to protect human life,limit damage and ensure that infra-structure important to public safety(e.g. hospitals) remains operational.The EC8 seismic design load for nor-mal and important buildings is basedon return periods of475 years and2,500years respectively.NPPs are designed to withstand muchstronger earthquakes, with returnperiods of 10,000 to 100,000 years

(see Fig. 1). The basic approach forensuring their seismic safety is for-mulated in national (e.g. KTA-2201 inGermany) as well as international(e.g. IAEA) standards and safetyguides, which define the safety objec-

Earthquakes: A comhazard

According to the standard NPP muswithstand the Design(DBE), defined in Edesign acceleration aspectra reflecting lBased on the seismof the site and its suthe plant owner parameters of the Shutdown Earthquthe vendor must estandard design is s

checked against thisThe plant owner mOperating Basis Eaunder which no spwould be required tation. Experience h

Rdiger Danisch and Peter Rangelow, AREVA NP GmbH (Germany)

It is estimated that 20% of the worlds nuclear reactors are operating in areas of significaity. In all cases, nuclear power plants (NPPs) are designed to withstand much stronger aearthquakes (see box) than ordinary building structures. Moreover, in Germany, seismic esidered in the design are combined with other events in operating and accidental conditioaccount the probability of simultaneous occurrence. Based on the mathematical models useffects of earthquakes on structures, systems and components, mechanical isolation offetages over conventional methods in areas of significant seismic activity.

Taming the Namazu(1)

SEISMIC DESIGN OF NPP BUILDINGS

(1) In Japanese mythology,Namazu is a giant catfish thatcauses earthquakes.Namazu lives in the mudbeneath the earth and is guardedby the god Kashima, whorestrains the fish with a stone.When Kashima lets his guardfall, Namazu thrashes about,causing violent earthquakes.


15/32

margins exist in the seismic design of

the main structures and componentsbeyond the design basis conditions.According to the EUR, the designmust withstand a Seismic MarginAssessment Review Level Earthquake(SMA-RLE) with a margin of 40%on the horizontal peak ground accel-eration above the design SSE level.Seismic loads to be considered in thedesign of the structures and equipmentare combined with other loads foroperating and accidental conditions.Such combinations are based on thepartial load factor approach, whichtakes into account the probability ofsimultaneous occurrence of the loads.

Procedure for modelling and analysisMathematical models are used toanalyse the response of nuclear build-ing structures to seismic action. Severalmodels of the structure are createddue to its complexity and the resultingneed for division into several subsys-tems. The response of the primarystructure model provides the seismicexcitation input to the substructuremodels for subsequent analysis.The seismic analysis procedure consistsof the following main steps: Depending on the type of analysis

selected, definition of the SSE bytime histories, ground response spec-tra and/or power spectral density;

Generation of the structural model,taking into account the effects ofsoil-structure interaction;

Response analysis of the model; Evaluation of floor time histories

and floor response spectra (FRS);

The largest earthquake ever to affect an NPP occurred on Juworlds largest nuclear power facility in Japan. The Kashiwaa seven-unit facility on the northern Japanese coast. The st(moment magnitude, Mw = 6.6) killed a dozen people in nflattened nearly 350 structures, and its force significantly for which the NPP was originally designed. It caused the15 km away from the epicentre, to safely shut down. Thou

all their safety-related SSCs performed very well, the quake drelated SSCs and four out of the seven units are still shut d

The case of the Kashiwazaki-Kariwa NPP

EC8 Earthqua

Acceleration (m/s2)

EUR DBE

7

6

5

4

3

2

1

0

0.1 1 1

Hospital Manpower

D=5%

S E I S M I C D E S I G N O


16/32

Designing plants for high seismic areas

There are two principal methods toprotect a reactors structural integrityduring a strong earthquake: the con-ventional one is to design the struc-tures and foundations with sufficientstrength to cope with the inducedseismic forces, while the second one isto reduce the forces transmitted tothe structure by isolating the buildingfrom its foundation. In order toincrease the global stability of thereactor building against a strongearthquake or the crash of a large

commercial aircraft,

are available: increabase mat, as showbine several buildinbase mat, as shownembed the buildingor fix the base mawith anchors for taThe smartest protconsist of reducing transmitted to the isolation, as implemon the four units oin the south of two units of the KSouth Africa.The main advantaisolation method a

of inertial forces andfrom the reduction ition levels, the reduof plant equipmenof equal performasite seismic condstandardisation of improved plant sThe main disadvanisolation method an additional fousupport the isolatexistence of a gap aing to allow for seithe need for expapiping between the and the ground, and

tenance costs.

In conclusion, it is isolation is a very efor protection againvibration. In area

Figure 2AREVAs KERENATM boilingwater reactor building with alarger base mat (update status:December 2009).

S E I S M I C D E S I G N O F N P P B U I L D I N G S


17/32

In the light of new data and modellingtechniques

For the current fleet of Generation-ii(Gen-ii) NPPs, the initial assessmentof external flood risks and the subse-quent deterministic design of floodprotection measures (including engi-neered site platform level) have oftenbeen executed in a period of limitedavailability of both statistical data onnatural phenomena (storm surges,high river flow rates, etc.) and toolsfor modelling flood threats. Nowa-

days, the modelling of flood threatshas improved substantially due toprogress on several fronts: techniquesfor obtaining detailed bathymetricand topographic measurements(for the site and surrounding area),

reassessment of flood risk and floodprotection.

Reassessment of flood protection atBelgian NPPs

In Belgium, a reassessment of floodrisk and protection was performedfor each NPP site during the mostrecent PSRs. For Doel, which is anestuary site located along the tidalreach of the river Scheldt, the majorincentive for this reassessment wasthe flooding of the Blayais site in

France (December 1999), which wasprovoked by a storm surge and highwind waves in combination with hightide. For Tihange, which is a riversite located along the river Meuse,the original flood risk assessment

Dries Gryffroy, Bel V (Belgium) | Hans Brinkman, NRG (Netherlands)

Extreme phenomena, such as storm surges or high river water levels, may endanger the sapower plants (NPPs) by flooding the plant site, with subsequent damage to safety-related buildmay result in simultaneous failures of safety-related components, such as service water pumpequipment. In addition, the plant may become inaccessible due to flooding in the plant(Re)assessments of flood risk and flood protection measures should therefore be base

state-of-the-art methods.

An overview of Belgianand Dutch experience

REASSESSMENT OF FLOOD PROTECTION MEASURES


18/32

as boundary condi

statistical variables foinflow are extremespeed and wind distochastically generCarlo calculation covalue distributions.strated that the upstthe river Scheldt hon the water level acomparison with thof high tide and sto

Tihange NPP: High waves or upstream dahazardsThe flood risk at thlargely dominated b

itation in the Meusflood risk has been mum river flow rareturn periods derical peak-over-threshof flow rate data. Comrates and wind waves

identified and a selection of poten-

tial hazard scenarios was made foreach site to determine the designbasis flood(DBF) and its effects onthe site and the nuclear installations.The DBF to be taken into account isthe worst case among these hazardsor concomitant occurrences ofhazards having an occurrence fre-quency exceeding 10 -4/year (or areturn period of10,000years).

Doel NPP: Coping with high tide andstorm surge

The flood risk in the Scheldt estuaryis dominated by storm surges. To cal-culate high water levels, wave heightsand wave overtopping of the dikes

at the Doel site as a function of thereturn period (up to 10,000years), acalibrated hydrodynamic model ofthe Scheldt estuary and its tributariesis used, with downstream inflow fromthe open coastal side and upstreamrun-off discharges from the river side

R E A S S E S S M E N T O F F L O O D P R O T E C T I O N M E A S U R E S


19/32

failures were considered for a fre-

quency of concomitant occurrenceup to and including 10-4/year. Forthese scenarios, flood levels and areaswere simulated with high precisionusing a 2D-hydrodynamic model anddetailed bathymetric and topographicdata from the Meuse valley. On theriver, mobile dams constructed every15 to 20 km each have several passagesthat are normally shut with steellocks, which are lifted above the waterlevel in the event of high flow rates.Therefore, a flood level increment(cliff-edge effect) caused by themobile dam downstream of theTihange site is also simulated forreturn periods exceeding approxi-

mately1,000years.

The defence-in-depth logicThe results of these simulations showthat, in particular for the Tihange site,a reassessment of the flood protectionmeasures was needed following thelogic of defence-in-depth, based on: Adequate flood monitoring and

warningsystems; Permanent structural protection

measures (e.g. peripheral floodbarriers or dikes where site elevationonly is insufficient, water-tightprotection of important safety-related areas or buildings or equip-ment that must be protected);

Temporary flood protection forspecific areas if warning time can beassured (e.g. mobile flood barriers);

Drainage of flood water off theplant site;

Emergency response management,

dominated by storm surges. Dutch

nuclear regulations require that anNPP withstand all external initiatingevents with a return period exceed-ing one million years. For externalflooding, this requirement is the basisof the so-called nuclear design level(nucleair ontwerp peil, NOP), i.e. thewater level at which a system amongothers, the nuclear island and theultimate heat sink should still func-tion properly. For bunkered systems,a higher value for the NOP is appliedto exclude cliff-edge effects. In deter-mining the NOP, the mean waterlevel, wave height and wave behav-iour during storm surges are takeninto account. This concept could also

be used to simulate external floodingin a PSA by assuming that floodsexceeding NOP levels lead directly tocore damage. However, this straight-forward modelling approach ignorestwo important aspects: the first is themitigative effect of the dike ring pro-tecting the plant; the second aspect isthat although water levels lower thanNOP will not lead directly to coredamage, they could do so indirectly asa result of combinations of systemlosses by flooding and random failuresof required safety systems to transferthe plant to a safe, stable state. Con-sequently, a more sophisticated PSAapproach is needed.

Drawing upon experience gained insafety assessment of the dikes

In the development of such PSAs, theexperience of the NetherlandsDepartment of Water Management

R E A S S E S S M E N T O F F L O O D P R O T E


20/32

switchyard). A convolution of thehazard function (exceedence frequencyof the water level outside the dikering) and the fragility curve of thedike ring (the conditional probabilityof failure as a function of the waterlevel) are made to determine theexceedence frequency of those levelsinside the dike ring. The fragility

curve of the dike ring is obtainedfrom a failure model that includes dike

sectioning (according to dike strength,orientation, subsoil, etc.) and possiblefailure mechanisms such as: (Wave) overtopping: failure occurs

due to water running over the dikecrest and eroding the inside slope of

Besides a determinising the failure mechaple for soil liquefacand their corresponthe new approach r(statistical) data ontions and failure mecdue to the very lowphenomena involve

of these data remain

Time: A critical factFinally, time is an imbe included in dikbecause: most failure mech

to develop;

time also determinwater that enters thFor instance, in casethe dike, the duratiocan be too short to rwater level inside tfailure frequency ofgiven water level isdefinition equal to tfrequency for that g

An approach similaof dike designs

The described approistic analysis of the hazard of NPPs. It rknowledge of dike

of the relevant loand hydraulics condopment closely resrable approach fRijkswaterstaat for puation of dike desig

View of the Doel NPP in the

Scheldt estuary (Belgium).

R E A S S E S S M E N T O F F L O O D P R O T E C T I O N M E A S U R E S


21/32

Views of th

before and

provoked

Antonio R. Godoy,Former Head of the International Seismic Safety Centre, IAEA

wide. Safety re-evaluation programmeswere implemented in many countriesto take due account of new data,methodologies and criteria as part ofperiodic safety reviews. All thesesafety re-evaluation processes led inmany cases to significant upgrades of

the facilities. But let us explain this inmore detail.All oceanic regions and sea basins ofthe world and even fjords and largelakes can be affected by tsunamis.Tidal waves propagate outward fromthe generating area in all directions,with the main direction of energypropagation determined by thedimensions and orientation of thegenerating source. A tsunami couldcause inland flooding because itswavelength is so stretched that a hugemass of water follows behind thewave front (see Figure for tsunamiparameters).A tsunami is called a local tsunami

when it affects only the region near itssource. Less frequent but affectingwider regions are distant tsunamisthat arrive at places remote from theirsource after travelling across the oceanor sea basins. Examples of destructive,

As a major consequence of the magni-tude 9.3 earthquake that occurredat the boundary of the Indian andBurmese tectonic plates on 26 Decem-ber 2004, an ocean-wide tsunami wasgenerated that resulted in devastationamounting to national disasters in

numerous countries on the coastlineof the Indian Ocean. This was one ofthe largest tsunamis ever recorded inhistorical time. Again, on 27 February2010, when a magnitude 8.8 earth-quake occurred off of Maule, Chile, atsunami was generated that devas-tated its coastal areas and islands,producing many fatalities and reach-ing far into the Pacific basin.

A (not so) new threat that drawsincreasing attention

Generally speaking, tsunamis are notnewthreats to the safety of nuclearinstallations and, from the perspec-tive of the IAEA, they should have

been considered, properly and in atimely fashion, in their siting, design,construction and operation.The selection and evaluation of thesites and the design of existing plantswere mostly performed following

Tsunamis: A (not so) new thre


22/32

designs. Similar attention is receivedfrom newcomers in relation to safety

issues to be solved, and from theoperators and regulatory bodies, dueto the potential impact on the safetyof operating facilities.

The different steps taken by the IAEAThe safety of nuclear installations withregard to external hazards has receivedsubstantial attention at the IAEAthrough the development of relatedsafety standards. During the past threedecades, these standards have maturedthrough a continuous updating processand with the feedback from a largenumber of safety review and trainingservices provided to Member States.Today, they constitute a well-recog-

nised set of safety requirements andguides. They were revised, taking dueaccount of recent developments andincorporating the lessons learnedfrom these extreme natural events,with significant participation and con-

nuclear accidents i

quakes and tsunamisdissemination of assessment and emment tools, and expepart of it.The InternationalCentre (ISSC) was eIAEA Director Gea global focal point

tion and experienknowledge and assitors and regulatorenhance the safety otions in relation to tit is operative todayNuclear Safety Insta

The importance of pFinally, it should becritical issue identevents is the need toon the safety level of lations as regards thand to provide reliwithout delay. The ption to the internatiomunity of all lessons events together withIAEA safety standarered as the most vathese efforts. Sharinrecent technical research developmenrience and good pr

the occurrence and of extreme externalpower plant sites, maintaining the safecritical and sensitivetinuously changing e

FigureParameters derived fromtsunami hazard assessment.When the tsunami waves reachthe coastal zone, they producehazardous effects near and onthe shoreline. In this case, forthe safety evaluation of a nuclearpower plant which may beaffected, the main concernsrelate to: (1) damage to systems,structures and components

(SSCs) important to safety due toflooding induced by the tsunamiat the site, (2) temporary lackof cooling water availabilitybecause sea water levels maydrop due to sea recession,(3) loss of cooling water becausethe water intake may be pluggedby drifting material, and (4) dam-age from dynamic forces to water

intake structures. A tsunami hazardassessment should therefore beperformed during the evaluationof the site and duly consideredin the design basis of the plant.Basically, it should compare theplant ground level and the poten-

ShorelineInundationHorizontal flooding

Indundation line or limit

A

AWater levelat shoreline

BMaximumwater level

CRun-up

B C

Datum Tsunami EarthDatum is mean sea level or mean lowwater at the time of tsunami attack

Maximum water level may be located at shorelineor the inundation or anywhere in between

T s u n a m i s : A ( n o t s o ) n e w t h r e a t


23/32

Global climate change is a central issue of political and public interest, but local meteorologmay differ significantly from the projected global mean values. Regional or even local climaies must therefore be performed to design appropriate protection measures at individual sit

Jrgen Jensen, Research Institute for Water and Environment, University of Siegen (Germany

concentrations and the use of differ-ing estimates of future greenhousegas emissions.

Expected consequences of globalwarming

An increase in global temperaturewill cause sea levels to rise and will

change the amount and pattern ofprecipitation. Other likely effectsinclude changes in the frequency andintensity of extreme weather events,although the nature of regional vari-ations is uncertain. It is obvious thata higher sea level influences theheights of storm surges, resulting in

a higher risk of flooding for theaffected coastal areas. In contrast tomany climate model projections, themean sea level and its variability overthe past centuries have not beenanalysed in detail up to now.

Global climate changeOriginally used to designate a changein the statistical distribution ofweather over periods of time rangingfrom decades to millions of years, theexpression global climate changehascome to mean, in recent times, changesin modern climate. It is often qualified

as anthropogenic climate change orglobal warming. The latter pertains tothe increase in the average temperatureof Earths near-surface air and oceanssince the mid-20th century and to itsprojected continuation.According to the 2007 Fourth Assess-ment Report by the Intergovernmen-

tal Panel on Climate Change (IPCC),global surface temperature increasedby 0.7 C ( 0.2 C) during the20th century. It can be said that mostof the observed temperature increasesince the middle of the century has

FROM GLOBAL CLIMATE CHANGE TO LOCAL CLIMATE IM

Global warming, a fairly locissue


24/32

to lead to changing ling discharges anheights, or more fevents. Advanced taking these issues itherefore be devefield of research cuanalysing in detail tof failures of hyd

such as dikes and esas a product of the pure and the consequThis requires detailloads and resistancof the flooded area. Won flood protectionrivers (inland) are m

and flood durationmeasures along coasestuaries are also afstorm surges (peak aby wind waves (rping). Since the alteistics of the relevanto climate change adent on regional and

design methods havindividual sites. probable change intance, the risk can bfor the present stastates, and the hydhave to be designeminimise the risk.

the climate system. GCMs depict thenatural system by using a three-dimensional grid with a quite coarsehorizontal resolution ranging from200 km to 600 km. As a consequence,

many physical processes cannot bemodelled properly, meaning thatimportant sub-grid scale featuressuch as clouds and small-scale topog-raphy are neglected. GCMs beingimpractical for regional impact stud-ies, downscaling methods have beendeveloped, which reduce the problem

of discordant scales between coupledmodels and enable the user to obtainregional-scale data from atmosphericvariables provided by GCMs.

Consequences for the design

Figure 1Example of a source-pathway-receptor-consequences modelin coastal areas.

Storm surgeSource

Dike breach

Dike

Industries

Residentialbuildings

Pathway

Consequences

Receptor

F R O M G L O B A L C L I M A T E C H A N G E T O L O C A L C L I M A T E I M P A C T


25/32

The debate on climate change has directed attention to how extreme weather conditions mdesign and safety of nuclear power plants. Work carried out on this issue in France, Finlandfor example, brought to light that the design of new plants against external hazards should bemodate possible future human-induced changes and natural variability. Nonetheless, climatpredicted to have severe effects on nuclear power plant safety.

Jorma Sandberg, STUK (Finland) | Gabriel Georgescu, IRSN (France)

Nuclear Installationsincludes a sectionon climate change. In its work onexternal event-related PSAs, the

Climate change: Soon an integral partof safety assessment

International agreements to reducegreenhouse gas emissions haveenhanced interest in new nuclearpower plant projects. At the same

time, the debates about the increasingintensities of meteorological phe-nomena have also drawn attention tothe ability of NPPs to withstandextreme conditions, possibly aggra-vated by climate change, as projec-tions on climate change over theplanned life of new NPP units have

large uncertainties, especially at theregional level.Extreme natural phenomena are fac-tored into site assessments based onhistorical data, but climate changeshould also be considered, as it could

NEW DESIGN REQUIREMENTS

New challenges in NPP desidue to climate change

Global wa

condition

favourabl


26/32

influences the Eart

melting of the Grcould cause oceamainly in the Southand Antarctic iceNorthern Hemisphextensive melting ithis century, thouexcluded.Baltic Sea water lev

enced by long-termin the North Sea anand low-pressureFinnish coast, pouplifting will probleast largely compeocean level. The incperature is likely to b

than in summer, anexpected to rise, esbut also in summerin extreme intensitiical phenomena arehave significant effeor siting.GRS, the German Tthe effects of clima

NPPs operated in the expected climathotter and dryer rainfall in winter, smore tornadoes. Wtend to increase thethey are not expectthreats to NPPs in th

France: Lessons leaprevious events

In France, several events having ththreaten nuclear saf

For catastrophic events with a lowsafety margin, the initiating event fre-quency should at most be of the sameorder of magnitude. If the safetymargin is higher, the frequency of thedesign value can be increased corre-spondingly. As good quality meteoro-logical measurements are typicallyavailable only for one hundred years,

the uncertainties at these low fre-quencies are considerable, regardlessof possible climate change.

In Finland and Germany: Climatechange unlikely to have significantimpact on NPP design or siting

In Finland, STUK issued safety

assessments for three new NPP pro-jects in 2009 covering two existingand three possible new sites, all locatedon the Baltic Sea coast. Extrememeteorological and hydrological phe-nomena were considered as well as

Finnish NPPs are designed towithstand harsh winter condi-tions including low temperature,frazil ice formation, pack ice andsnowstorm. Due to possibleclimate change, a wider spectrumof extreme conditions has to beconsidered and safety marginshave to be re-evaluated in thedesign of new NPPs.

N E W D E S I G N R E Q U I R E M E N T S


27/32

Le Blayais, EDF reassessed the maxi-

mum design flood level at all plantsites and has launched a review pro-ject with the aim of ensuring theeffective protection of is facilitiesagainst external flooding. Thereassessment of the maximum designflood and the application of the newmethodology have brought aboutmany modifications and improve-

ments at the sites. Another significantevent was the heat wave in the sum-mer of2003, which prompted EDFto make several design improvementsto its reactors.For new reactors, the TechnicalGuidelines document (1) specifies thatdesign features must protect against

external hazards, consistent with theprovisions taken against internal fail-ures and internal hazards. Externalhazards must not constitute a largepart of the risk associated with nuclearpower plants of the next generationand, at the same time, a substantialreduction of the overall core-meltfrequency must be achieved for those

NPPs. Implementation of improve-ments in the defence-in-depth shouldlead to a total frequency of core meltof less than 10-5 per plant operating

year, taking into account uncertain-ties and all types of failures and haz-ards. Since external hazards can affectdifferent defence lines of the plants

consecutively or simultaneously andare site-dependent, due considerationmust be paid to site selection so thatexcessive requirements are not imposedon the design of the correspondingplants.

ability of future operational evolu-

tions. The adaptability of the plant isthus analysed for all climate-relatedhazards.The incorporation of climate-relatedexternal hazards into the plant PSA,as a supplement to the deterministicframework, would play an importantrole in meeting the aforementionedtargets.

Incorporating climate-related externalhazards into the PSA

Climate change is one factor affectingthe uncertainty of extreme meteoro-logical and hydrological events. Thereis presently no evidence that the pre-dicted change would have any serious

effects on NPP safety. However, itwould be prudent to consider the lat-est studies on anthropogenic climatechange and natural variability in thedetermination of design values forexternal events and to include fea-tures that allow for future plant evo-lutions. The incorporation of cli-mate-related external hazards into

the PSA may also play an importantrole in ensuring safety for the nextgeneration of NPPs.

(1) Technthe desig

of the nenuclear ppressuris

N E W D E S I G


28/32

Giovanni Bruna, IRSN (France)

As evidenced in the previous articles of this special issue of the EUROSAFE Tribune on eMother Nature, man and his activity threaten the safe and secure operation of nuclear poweral ways, making both the siting of new nuclear facilities and the retrofitting of existing oneing. Based on the findings of ongoing studies on climate change, earthquakes, sandstoroperating feedback, would environmental data selected forty years ago for the constructi

generation of nuclear facilities still be considered suitable for building future reactors or nplants? In light of these studies, to what extent can operating facilities be upgraded to consafely and securely? These are questions for consideration at a time when several countriesare announcing plans to resume or embark on new build programmes, and when utilitieextend the service lives of their existing fleets.

The knowledge gained on external

hazards through studies and feedbackfrom nuclear power plant operationsallows continuous updating of uncer-tainty appraisal methods. These, inturn, drive the evolution of the safetyrequirements issued by regulatorybodies, the design and constructionspecifications adopted by vendors, as

well as the safety assessment proce-dures used by TSOs.Such new knowledge impacts the siteselection criteria for the constructionof new facilities: for instance, theprospect of potential drought in a

intensity and poten

to risk, the designincorporates provisforced protectionagainst the crash of cial aircraft and resgation, the redesignmitigate the drawbsand build-up and

to prevent clogginaccretion of debrismounting of the reequipment on silentmodate vibrationssuch as those gen

Coping with external hazardin the future

EVOLUTION OF SITING AND RETROFITTING METHODS


29/32

difficulties of the task and the very

high costs expected.For example, huge design modifica-tions, such as the reinforcement ofcivil works to withstand the crash ofwide-body airliners or the mountingof the facility on silent blocks to

withstand earthquakes, cannot beregarded as fully realistic options

today. If in future such requirementsshould become mandatory for thesafe and secure operation of a plant,the operator might consider closingdown the plant for good.

The delicate issue of retrofittingThe knowledge gained from ongoing

studies on the different externalhazards and plant operating experi-ence does not deeply modify sitingand construction rules from a regula-tory perspective. However, the lessonslearned are progressively being incor-

for a new build, some of them, such

as earthquakes, are expected to bevery difficult to factor into the retro-fitting of operating facilities. In somecases, this limitation can be conduciveto early decommissioning of thefacility.

EPR react

at Flaman

E V O L U T I O N O F S I T I N G A N D R E T R O


30/32

Upcoming meetings on nuclear safety assessment

March 13-17, 2011, Wilmington (NC), USA

Topical meetings on probabilistic safety assessment

and analysis (PSA) | Organised by the AmericanNuclear Society (ANS)

Additional information at http://www.psa2011.orgor E-mail [email protected]

A few links for reading more about external hazards

IAEA activities related to seismic safety of nuclear

installations| The International Seismic Safety Centre |By Antonio R. Godoy, Acting Head, International Seis-mic Safety Centre (NSNI/IAEA), 12Aug.2009http://www.vtt.fi/proj/smirt20/presentations/pw1b/01_pw1b_ar_godoy.pdf

Engineering seismic risk analysis| By Carl AllinCornell (1968) | Bulletin of the Seismological

Society of America 58(5), pp. 1583-1606.http://www.ce.memphis.edu/7137/PDFs/Cornell/1583.pdf

Issues in probabilistic seismic hazard analysis fornuclear facilities in the US| By Robin K. McGuire(2009) | Submitted to Nuclear Engineering andTechnology, Korea Fugro William Lettis & Assoc.http://article.nuclear.or.kr/jknsfile/v41/JK0411235.pdf

European Utility Requirements for LWR nuclearpower plants| Revision C (2001)http://www.europeanutilityrequirements.org

Eurocode 8: design of structures for earthquake

IAEA mission report, preliminlessons learned from the16July2Kashiwazaki-Kariwa NPP | VoAugust 2007http://www.iaea.org/NewsCente

shiwazaki-kariwa_report.html

Meteorological and hydrologicaevaluation for nuclear installatioGuide DS417 | IAEA, Vienna (20http://www-ns.iaea.org/commitdefault.asp?fd=942

Site evaluation for new nuclear p346, Canadian Nuclear Safety Comhttp://www.cnsc-ccsn.gc.ca/engtorydocuments/published/inde

Probabilistic Safety Analysis (Pexternal events than earthquake|NEA/CSNI/R(2009)4 | OECD, Pahttp://www.nea.fr/nsd/docs/2009/

Technical Guidelines for the destion of the next generation of nucwith pressurized water reactors| Athe GPR/German experts plenaron October 19th and 26th, 2000. htnuclear-safety.fr/index.php/conte15572/100931/technical_guidelin

struction.pdf

Probabilistic safety analysis of (external hazards| By J. SandbergG. Georgescu | EUROSAFE Foru2-3 November 2009, Brussels.

VENUES & WEBSITES


31/32

EUROSAFE Forum 2010

held in Grzenich Hal l in C

November 8th and 9th wil l

Innovation in Nuclear Safety

The corresponding debates

will be reported in the EUROSA

EUROSAFE Tribune

is a periodical from

the EUROSAFE Forum

Programme Committee

Pieter De Gelder (Bel V)Ulrich Erven (GRS)

Robert Jansen (KFD)Zdenek Kr (JV)Antonio Munuera Bassols (CSN)Edouard Scott de Martinville (IRSN)Lars Sknberg (SSM)Eugenijus Uspuras (LEI)Seppo Vuori (VTT)

Coordination

Horst May (GRS)Emmanuelle Mur (IRSN)

Writer

Jean-Christophe Hdouin (HIME)

Design

Martin Brunner Associs

Credits

Front cover: Thierry Truck - IRSN Arnoalco - Fotolia.com Corbis - Fotolia.com

Sparky - Fotolia.comBack cover: Irina Efremova - Fotolia.comp. 3, p. 6: GRSp. 7: Valrie Beudon - Fotoliap. 9, p. 10, p. 21: IAEAp. 18: Michel Verbeek - Bel Vp. 20: Photo library Bel Vp. 24: Jason Branz - Fotolia.comp. 25: Ari O. Laine - STUK

p. 26: TVOp. 29: Thierry Truck - IRSN

ISSN: 1634-7676Legal deposit: October 2010

The EUROSAFE Tribuneis available on the website:


32/32

INSTITUT DE RADIOPROTECTION ET DE SRET NUCLAIRE (IRSN)

B.P.17, 92262 FONTENAY-AUX-ROSES CEDEX, FR ANCE

GESELLSCHAFT FR ANLAGEN- UND REAKTORSICHERHEIT (GRS) mbH

SCHWERTNERGASSE 1, 50667 KLN, GERMANY

FOR FURTHER INFORMATION: www.eurosafe-forum.org

external hazards, new insights into old issues

Documents