Natural Hazards and Nuclear Power Plant Safety

Abstract

The safety of nuclear power plants with respect of natural hazards can be ensured by adequate characterization of hazards and proven design solutions to cope with natural hazard effects. Design and severe accident management require characterization of very rare event. The events identified for the design basis and for the safety analysis are with annual probability 10−4–10−5 and 10−7, respectively. In this chapter, a brief insight into the actual issues of natural hazard safety of nuclear power plants and related scientific challenges is provided. The state of the art of ensuring safety of nuclear power plants with respect to natural hazard is briefly presented with focus on the preparedness to the accident sequences caused by rare natural phenomena. The safety relevance of different hazards and vulnerability of NPPs to different hazards are discussed. Specific attention is made to the non-predictable phenomena with sudden devastating effects like earthquakes and fault ruptures. Post-event conditions that affect the on-site and off-site accident management activities are also considered. The “specific-to-nuclear” aspects of the characterization of hazards are discussed. This is a great challenge for the sciences dealing with hazard characterization. The possibility for ensuring nuclear safety is demonstrated presenting cases when the nuclear power plants survived severe natural phenomena.

1. Introduction

Nuclear power plants (NPPs) have negligible cradle-to-grave environmental impacts. In spite of this fact, nuclear power plants (NPPs) are potentially high-risk facilities, since the consequences of a severe accident at a nuclear power plant can be enormous. Severe accidents of NPPs affect large area and have environmentally regional and economically global character [1]. The accident at the Chernobyl NPP shows the extent and severity and long-term consequences of the nuclear disasters. Natural hazard safety of nuclear power plants became an eminent importance after the Great Tohoku earthquake on the 11th of March 2011 and subsequent disaster of the Fukushima Daiichi NPP. The case of the Fukushima Daiichi NPP demonstrated the tragic outcome of the interaction between severe natural phenomena and nuclear power plant, that is, the severe natural phenomena are a great threat per itself, but their damaging effects could be multiplied when a natural phenomenon damages a hazardous facility like a nuclear power plant. The importance of the preparedness to the natural hazards at NPPs has recently been demonstrated when the Hurricane Florence September 2018 endangered the NPPs in North and South Carolinas.

Majority of the existing nuclear power plants will be operated during the twenty-first century, and there are ongoing new construction projects. There are prestigious institutions and authors justifying that the nuclear power is needed for sustainable power supply (e.g., [2]). There are good enough reasons for continuous efforts to ensure and enhance the nuclear safety.

Protection of NPPs against natural hazard effects has been required since earlier times of industrial deployment of nuclear power. Related design requirements were getting more and more stringent with accumulated knowledge on hazards, with their consequences, as well with the development of design methodologies and supporting empirical evidences. All probable at the site natural hazards should be accounted for in the design of NPPs.

The risk due to NPPs is controlled and reduced by design means ensuring very low annual probability of a large release of radioactive substances. The acceptable annual probability limit for large release is ≤10⁻⁶. The concept of defense in depth (DiD) is applied for protection of the people and environment [3, 4]. According to this, a hierarchy of protective means and procedures should be designed and implemented for preventing the escalation of a failure to accidents and to maintain the integrity of physical barriers between the radioactive substances and environment, even if a protective feature fails. There are a series of physical barriers nested inside one another for separation of the radioactive substances from the environment: the fuel matrix, the fuel cladding, the primary pressure boundary, and the containment. The effectiveness of barriers should be maintained in every operational state, and the last barrier, the containment, should perform its retaining function as long as possible during accident sequences.

In this chapter, a brief insight into the actual issues of natural hazard safety and related scientific challenges is provided. The state of the art of ensuring safety of NPPs with respect to natural hazard is briefly presented with focus on the preparedness to the accident sequences caused by rare natural phenomena. The safety relevance of different hazards and vulnerability of NPPs to different hazards are discussed. Specific attention is made to the non-predictable phenomena with sudden devastating effects like earthquakes and fault ruptures. Post-event conditions that affect the on-site and off-site accident management activities are also considered. The “specific-to-nuclear” aspects of the characterization of hazards are discussed. Design and severe accident management require characterization of very rare events with annual probability 10⁻⁴–10⁻⁵ for the design basis and up to 10⁻⁷ for the safety analysis. This is a great challenge for the sciences dealing with hazard characterization. There might be epistemic limitations, and a positivist approach to the possibility of learning the phenomena is questionable. The epistemic issues of natural hazard characterization and management are also briefly considered.

The approach followed in the chapter is a typical positivist, engineering approach. The hazards accounted for in the design of conventional, potentially high-risk industrial facilities, are about hundred times more likely and far less dangerous than the design-basis hazards for the nuclear power plants; apart from this cardinal difference, the development and design of nuclear power plants are carried out according to the same logic as any other technical objects, that is, the design shall be based on evidences, verified knowledge, and experimentally proven methods. The design requirements and safety analysis procedures are briefly presented with the main focus on the rare and unpredictable phenomena.

The statement of the head of the Fukushima Nuclear Accident Independent Investigation Commission should be understood, which recognized the Fukushima accident as a typical “man-made disaster” that could be foreseen and prevented [5]. In spite of the truth of this statement, the extreme natural phenomena can cause enormous consequences at NPPs. The question is how frequent can an extreme event happen that can trigger a nuclear catastrophe, and whether the risk due to these events can be reduced to an acceptable for the society level?

Nuclear power plants are stigmatized by two severe accidents, Chernobyl accident, and by the Fukushima NPP accident caused by extreme natural phenomena. However, the operation of nuclear power plants is characterized not only by these accidents but also by more than 10,000 reactor years of positive experience. There are studies predicting 50% of chances for occurrence of a Fukushima-type accident within every 60–100 years [6] and auguring decreasing the frequency but increasing the severity of nuclear accidents. The lessons learned from the Fukushima accident changed the paradigm of the design; preparedness to extreme improbable situations became a great importance. In this chapter the availability of proven technical means against natural hazards is demonstrated on the practical examples. The presentation of the manageability of natural hazard effects should not relativize the safety issues, just providing realistic insights compared to those determined by the shock of the Fukushima catastrophe.

Natural hazards can also cause economic impact due to inability of being operated at 100% level, and/or restoration is needed for the restart of the plant. These aspects will gain more importance due to increasing severity, frequency, and duration of some hazards, for example, extremes due to climate change that affect the efficiency of nuclear power plants especially those with freshwater cooling. These aspects of vulnerability are briefly considered.

An overall presentation of the state of the art of hazard evaluation and natural hazard risk management is not intended in the chapter. The focus is limited to the recent practice of the nuclear industry.

2. Hazards and their severity

Nuclear power plant can be constructed and operated at a particular site without undue risk to the health and safety of the public by ensuring the confinement of radioactive substances. From the technical point of view, this means that some fundamental safety functions should be ensured during and after the natural phenomena: the reactor should be shut-down, subcriticality of the reactor core and the spent fuel pool should be ensured, and the fuel in the reactor core and the spent fuel pool should be cooled. The most important function is the retaining capability of the reactor containment that should be kept leak-tight as long as possible.

Plants are designed per principle of defense in depth (DiD) [3, 4], applying overlapping provisions (design, operational, etc.), so that, if a failure were to occur, it would be detected and compensated for or corrected by appropriate measures returning the plant to the normal operational conditions. In case this is not succeeding, a hierarchy of protective means and procedures are designed in preventing the escalation of a failure to accidental event, even if a protective measure fails. These protective means are redundant safety systems that are conservatively designed to withstand even effects of natural hazards beyond those accounted for in the design.

The effects of natural hazards selected for the basis of design are loads defined conservatively and used in the design calculations according to codes and standards. Therefore, in deterministic sense, the effects of natural hazards within the basis of design should not cause accidents, or any failures, called initiating events, leading to accident sequences. Off course, the probability of failure of some systems or structures is not equal to zero, but the adequate design ensures low probability of failure with high confidence. The conservative design ensures sufficient margin to resist the effects exceeding in some extent the design-basis level.

DiD also means a box-in-box design of physical barriers for confining the radioactive substances. The first barrier is the fuel matrix, the ceramic uranium dioxide pellets, and the second one is the cladding of fuel pins. The third barrier is the pressure-retaining boundary of the primary circuit, and the fourth and very last barrier is the containment building. The heat generation by the decay of fission product in the fuel lasts long after the chain reaction is stopped. If the residual heat will not be removed, the first two barriers the fuel matrix and the cladding tubes containing the pellets will be overheated, melted, and damaged. The third barrier is the pressure-retaining boundary of the primary circuit. The fourth barrier is the containment building.

Severity of natural hazards can be categorized according to the level of DiD affected, complexity, and duration of post-event situation. The highest level of severity is caused by rare, sudden, non-predictable, beyond-design-basis events with high damaging potential that can cause sudden loss of safety functions (that is called as cliff-edge effect). Retaining capability of the containment can be lost, and significant amount of radioactive material can be released. Compared to the above case, less severe are the hazard consequences, when the fundamental safety functions can be restored or ensured by severe accident management measures, that is, the accident sequence can be controlled, and the off-site releases can be limited. Moderate severity are those hazards, effects of which are within the design margins. In this case, the control of accident sequences for limiting the radiological releases and preventing escalation to severe accidents can be ensured by design means and procedures. Less severe are the hazards with effects within the design basis, especially, if a forecast or warning of the occurrence of dangerous event is possible. The effects of these hazards are manageable by operational features and measures.

The economic losses are strictly correlated by the extent of damage, possibility, and effort needed for restoring and restarting the plant operation, doses from releases, needs, and extent of off-site measures (evacuation and decontamination of large area).

Ranking the hazards with respect to safety and economic significance:

1. Sudden, non-predictable, beyond-design-basis event with high damaging potential, beyond-design-basis, significant damages over large region hindering accident management—Large releases due to containment failure, loss of plant, and evacuation of large area (Fukushima Dai-ichi NPP, Great Tohoku Earthquake 2011).

2. Sudden, non-predictable, beyond-design-basis event with high damaging potential but within the designed margins—Justification of safety and restoration works (Kashiwazaki-Kariwa NPP, Niigata-Chuetsu Oki Earthquake, 2007, North Anna NPP, 2011).

3. Sudden, non-predictable event with high damaging potential within the design basis—Outage for limited time (Onagawa NPP, tsunami due to Great Tohoku Earthquake 2011).

4. Events with damage potential, warning, and preventive measures are possible—Outage for limited time or restart after the event (NPPs impacted by Katrina hurricane, 2005; floods at Blayais NPP, France, 1999, and at Fort Calhoun Nuclear Generating Station, USA, in 2011).

5. Warning is possible, and effects are manageable by operational features and measures—Operation at a reduced power level and no safety consequences (Cernavoda NPP, Romania, ow-river level 2009).

An exhaustive list of external hazards that can affect the safety of nuclear power plants, including the list of possible correlated and independent concurrent hazards, are given, for example, in [7]. The nuclear safety regulations use a generic formula requiring identification and characterization of natural phenomena that are specific to the region and which have the potential to affect the safety of the nuclear installation [8, 9, 10, 11]. Examples of hazards and their possible primary consequences are presented in Table 1.

Table 1.

Hazards, hazard effects, and possible consequences at NPPs.

In Table 1 examples of hazards are indicated, which can be or should be excluded by proper site selection (collapse of karst, avalanches, landslides). There are examples in Table 1 for hazards, which can be excluded by engineering means (flood protection, soil improvements). Although the possibility of mitigation of some volcanic effects (tephra fallout, missiles, gas emissions, debris flows) is considered as realistic [12], it is preferable to exclude the volcanic hazard from the design basis of nuclear power plants.

The hazards accounted for in the design of the plant should be differentiated with regard their basic features: possibility of forecast, characteristic time for evolvement of phenomenon, possibility to avoid administrative or operational measures, possibility of protection of the site, and modification of adverse site features.

The earthquakes affect the site and large surrounding region. It is impossible to foresee and it happens suddenly. The effects of earthquake should be “as far as reasonably practicable” managed by design solutions even for the cases exceeding the design basis. The operators should be prepared to manage the post-earthquake extreme situations. Here, the long-lasting effect is caused by the damages at the site and in the area surrounding the plant. The dwellings of the operational personnel and the local infrastructure (transportation, communication) can be affected [13]; therefore, arrangements should be in place for the replacement of personnel and logistical support of the plant.

Contrary to the above example, reliable forecasts can be made for the majority of hydrometeorological extremes, like hurricanes, tornados, typhoons, extreme precipitation and temperatures, and floods. This allows implementation of protective measures and preparation of the NPP for the extreme situation. The operators should have procedures and means for preparedness to the possible abnormal situations. For most meteorological extremes, the implementation of protective design solutions can be combined with operation procedures for both, ensuring the safety and possible fast recovery of normal operation. Reduction of cooling capacity due to clogging of cooling water system can be managed in a similar way.

There are meteorological extremes with extended duration, for example, heat wave and drought. These long-lasting conditions can also affect the operational personnel and the logistical support of the site.

There are hazards having similar effects, for example, the straight wind and tornado missiles and hail cause an impact effect. Obviously, the hazard with the largest impact effect will dominate the design of structures important for safety.

Simultaneously occurring hazards should also be considered in the design. It is interesting to mention that almost 600 possible combinations can be identified according to [7].

There are causally connected hazards where one hazard may cause another hazard, but the other hazard can occur by themselves (like earthquake and tsunami). There are simultaneous hazards when one hazard is a prerequisite for a correlated hazard (earthquake-liquefaction).

There are associated hazards, which are probable to occur at the same time due to a common root cause or having same physical origin, for example, the storms and lightning and storms and extreme precipitation.

The analysis of the probability of event combinations should consider the duration of the events. The exact coincidence of the demand is decisive for the design and safety. It is possible for more than one independent natural event to occur simultaneously at the site. Combinations of frequent hazards with similar effects should be considered carefully, since the simultaneous effects can be superimposed. It should be noted that simultaneous occurrence of two independent low-frequency hazards is considered as unreasonable.

3. Designing for safety

As it is shown above, the risks of nuclear power plants due to natural hazards can be controlled in two ways:

1. The hazards can be avoided via site selection deeming the sites unsuitable for the location of NPP.

2. Appropriate design and/or administrative measures shall be implemented for site and plant protection.

In the first case, if the effects of external events affecting the sites and the region cannot be compensated by proven engineering solutions for protection of the NPP, the site should be discarded.

The hazards can be qualified as avoided, if it is physically impossible to occur under the conditions at the site or if the hazard can be considered with a high degree of confidence to be extremely unlikely. For example, landslides should not be expected, if the site is located in a flat area; collapse of karst should not be expected if there are no karst formations below the site. Specific considerations on how to define the acceptable low probability will be given below. Rules and requirements for site survey and selection are given, for example, in [8, 10]. The International Atomic Energy Agency published a series of design guidances focusing on different hazards [12, 14, 15, 16].

In the second case, the hazards shall be properly identified, characterized, and accounted for in the design basis as required in [10]. The performance of the plant safety features should be ensured by the design and/or administrative measures for the design-basis hazard effects, that is, for the case of design-basis hazards, very low probability of failure of the safety-related SSCs should be justified with high confidence. The generic design rules and requirements are set, for example, in the [9]. The International Atomic Energy Agency published series of design guidance focusing on different hazards [17, 18]. The applicable design requirements are as follows:

• Apply reasonable design conservatism for design-basis hazards that provides sufficient margins for the case, if the effects of hazards exceeding the level accounted for in the design.

• Apply passive safety features (no need of external or emergency power supply).

• Develop pre-event preparedness and post-event procedures.

• Apply adequate means and procedures to coop with hazards that are predictable.

• Ensure that the safety systems intended to be used in design-basis accidents will be not adversely affected by the natural hazards.

• Ensure sufficient resources at multiunit sites.

• Consider temporary limitation of the off-site logistical support.

The generic design principles applicable are related either to system engineering or structural and layout aspects. These are:

• Diversity via employing different principles of operation.

• Redundancy of components and systems.

• Independence of system and components.

• Using failsafe components.

• Avoiding structural interactions.

• Ensuring physically separation of redundant safety systems.

The design solutions can also be classified as:

• Systems-solutions: inherently safe design, use of preferable passive safety systems capable to function even in the case of beyond-design-basis hazards.

• Structural solutions: optimized for hazard effect structures with sufficient capacity to avoid sudden loss of function.

• Layout solutions: separating the redundant safety systems.

For the optimal use of design means, the SSCs are usually categorized in accordance of their safety relevance and intended function during and after the natural phenomena. This allows to implement the graded approach regarding design conservatism, quality, and reliability requirements. The safety systems are usually in the highest category that should be designed to withstand high-magnitude low-annual-probability hazardous effects, while the systems needed for the continuous operation only are designed in accordance of nonnuclear building/construction codes and standards for a moderate magnitude and for 10⁻²–10⁻³ annual probability effects, as usual.

It should be emphasized that the natural hazards affect the entire plant, all facilities at the site, or even the whole region. Therefore, the events could simultaneously challenge several redundant or diverse trains of a safety system, causing multiple failures of SSCs.

In the state-of-the-art practice, plant conditions more severe and complex as those accounted for in the design basis are considered as design extension conditions. In design extension conditions, prevention of severe accident, mitigation of the consequences of complex plant conditions, and the integrity of the containment should be maintained by additional safety features or extension of the capability of safety systems as far as is reasonably practicable.

The chances for multiple failures and complex plant conditions due to natural hazards can be rather large, if the magnitude of event exceeds those accounted for in the design.

4. Safety goal, design basis, and beyond-design-basis hazards

Let us start with a simple consideration. The simplest formulation of the risk due to some damaging effect is the $R=P_{\mathit{\text{fail}}}·C$ , where $P_{\mathit{\text{fail}}}$ is the probability of the failure caused by that effect and leading to the consequences with measure $C$ .

The probability $P_{\mathit{\text{fail}}}$ depends on the probability of occurring of an event with damaging effect E, $P\left(E\right)$ and on the conditional probability of failure if the effect is equal to E, that is, $P\left(\mathit{\text{fail}}\text{if}E\right)$ . Thus, the total probability of failure can be written as $P_{\mathit{\text{fail}}}=P\left(E\right)·P\left(\mathit{\text{fail}}\text{if}E\right)$ . The state-of-the-art design procedures and standards ensure a very low probability of failure with respect to the effects accounted for in the design, $E_{\mathit{DB}}$ ; this can be expressed as $P\left(\mathit{\text{fail}}\text{if}E\le E_{\mathit{DB}}\right)\ll 1$ . There are hazards damaging the potential of which can be characterized by several parameters; thus, $\mathit{E}=\left\{E_1,E_2,\cdots ,E_n\right\}$ .

In the practice of the nuclear industry, the term “fail” could have several meanings. The term “failure” can be associated to a single component, to a system performing certain safety function, and to the entire plant, respectively. As it has been mentioned above, for ensuring the confinement of radioactive substances, the nuclear power plants are designed per principle of defense in depth. Failure of some structures, systems, and components (SSCs) can trigger a sequence of events at the plant deviating from normal operational conditions. If a sequence was considered in the design basis of the plant, the safe stable condition of the plant should be ensured by safety systems. The safety systems shall ensure the control of reactivity, that is, the chain reaction in the reactor shall be stopped, the heat generated by decay of radioactive fission elements shall be removed from the reactor core to the ultimate heat sink (to the environment), and the radioactive substances shall be confined in the fuel elements.

Thus, the term “fail” can be first linked to the core damage (CD) and to the loss of the first two barriers (fuel matrix and cladding). The annual probability of the core damage, $P_{\mathit{CD}}$ , is limited by the nuclear regulations. The acceptable value for a new design should be less than 10⁻⁵ summarized over all accident sequences. This can be expressed as $P_{\mathit{CD}}=P\left(\mathit{\text{fail}}\text{if}E\right)·P\left(E\right)\le {10}^{-5}$ . Thus, the safety systems should withstand the effects of natural hazards and fulfill their intended functions for avoiding the core damage. The acceptable probability of loss of any safety function due to failure caused by natural hazards should not exceed 10⁻⁶/a.

In very improbable cases when the safety features fail, and the conditions are more severe than those accounted for in the design, the radioactive releases shall be kept as low as practicable. The most important objective of this level is the protection of the confinement function. In this case, the term “fail” is linked to the large release (LR) of radioactive substances to the environment. It is as dangerous as earlier it happens in the course of the severe accident. The annual probability of the early large releases, $P_{\mathit{LR}}$ , is also limited by the nuclear regulations. Its allowable value for a new design should be $P_{\mathit{LR}}=P\left(\mathit{\text{fail}}\text{if}E\right)·P\left(E\right)\le {10}^{-6}$ summarized over all accident sequences. It means the acceptable value for a singular sequence should be less approximate by an order of a magnitude.

It is obvious from the above consideration that a hazard could be screened out and neglected on the basis of probabilistic consideration, if the probability of occurrence is less than the acceptable for severe accident probabilistic limit with a high degree of confidence, that is, 10⁻⁷/a or less.

Since the consequences of nuclear accidents caused by natural hazards can be enormous, the risk should be reduced by selecting effects for the basis of design with very low annual probability. Therefore, the magnitude of natural hazard accounted for in the design basis should be associated to the probability 10⁻⁴–10⁻⁵ per year depending on the strength or capacity assured by the design. Some exception is the regulation regarding the tornado hazard in the USA, where the tornado hazard is a reality due to meteorological and topographical conditions. The Nuclear Regulatory Commission has determined the best-estimate design-basis tornado wind speeds for new reactors, which correspond to the exceedance frequency of 10^–7 per year [19]. Probably, the reason for this conservative approach is the complexity of post-event conditions.

The SSCs should be categorized regarding their safety relevance/function. A target performance, $P_T$ , should be set to each category. The hazard exceedance frequency for the design of the particular SSC, $H_D$ , should be selected taking into account the achievable resistance, $R_H$ , that is the conditional probability of failure for the effects with $H_D$ , that is, $P_T=H_D·R_H$ .

Care should be taken to the convolved frequency, where there are multiple parameters used to define an event. For example, it is not reasonable to consider a 10⁻⁴ intensity of a storm with a 10⁻⁴ duration of a storm unless there is a clear correlation. Obviously, there is a strong correlation between the phenomena having the same physical origin.

Regarding combinations of independent events, the same probabilistic criterion can be applied as for the single event, that is, a 10⁻⁴/a earthquake should not be combined with a 10⁻⁴/a strong wind. Contrary to this, for example, the combination of a big storm with a high tide could lead to the external flooding of a power plant.

Specific considerations are made in case of causal-related events, like earthquake and liquefaction, earthquake and tsunami, or earthquake and failure of structures protecting the sites.

In case of liquefaction, based on the soil date and the design-basis earthquake magnitude, the conditional probability of liquefaction can be calculated. The total probability—earthquake and liquefaction—should be less than the probabilistic screening criterion for neglecting the liquefaction hazard (see, e.g., [20]). This condition can also be formulated in terms of safety factor with respect to liquefaction. If the site soil conditions are improved by engineering methods, this probability and/or value of safety factor can be applied for acceptance criterion for the soil improvement.

There are multiple causally correlated hazards. For example, possibility of multiple causally linked hazards has been recognized at Tricastin site in France that initiated a focused safety justification in 2017 [21]. The level of the Tricastin site is 6 meters below the nearby channel level. The nuclear site is protected by embarkment. Although the embarkment would resist the maximum historically credible earthquake, it could not be excluded that it would fail if the design-basis earthquake of the plant hits the site. If the site would be flooded, loss of off-site and on-site electrical power supply and failure of the cooling systems of the reactors could be expected. Limited access to the site would hinder the emergency response. In this case the seismic resistance of the embarkment is the key question, since the plant remains safe in case of design-basis earthquake. The probability of loss of safety function in this case is defined by the probability of design-basis earthquake, since the embarkment failure and the consequent flooding are highly probable if a design-basis earthquake happens.

In case of causally linked hazards, the damaging effects of root cause event and the consequential event would not be necessarily simultaneous. The timing of effects should be considered in the design.

The above considerations with the small probabilities may seem like the usual reasoning and magic of the nuclear industry. As a matter of fact, that is the state of the art. However, this is recognized to be not sufficient. The generic design paradigm afore Fukushima Dai-ichi accident was “design for sufficient low probability of effects for ensuring the acceptable risk.” The new design paradigm is “to be prepared for the impossible.” Since a devastating natural event can never be completely ruled out, the necessary provisions for managing a radiological emergency situation, onsite and offsite, must be planned, tested, and regularly reviewed [22, 23].

5. Difficulties of the safe design

Two fundamental questions have to be answered here:

1. Whether the characterization of rare natural hazards can be performed with high enough assurance? The question is related to the possibility of definition of the hazard curve, which is the annual probability of an event that will occur at the NPP site with a damaging effect exceeding a given threshold.

2. Whether there are proven engineering solutions available for ensuring enough capability of NPPs to withstand safely the effects of hazards? In other words: Whether the design will ensure $P\left(\mathit{\text{fail if}}E\le E_{\mathit{DB}}\right)\ll 1$ for the conditional probability of failure? The question is related to the vulnerability/fragility of the NPP.

Presentation of the state-of-the-art methodologies for hazard evaluation is out of scope of the recent chapter. The nuclear industry is adapting the most novel scientific achievements for the site characterization and investigation (see, e.g., [24]). The hazards accounted for in the design are subject to regular review and update in countries where the regime of periodic safety review is established. Most extensive programs for natural hazard evaluation and upgrading and justification of operating plant safety have been implemented in the USA and several Eastern-European countries, where the operators should deal with the issues of underestimation of the seismic hazard for the design basis. Summary description of these programs is given in [25, 26, 27, 28]. Events, like the Great Tohoku Earthquake, triggered an overall review, correction, and justification of hazard evaluation at the plants (see the stress test initiated by the European Union and the reviews and upgrading programs in several countries, e.g., [29, 30]).

The Fukushima accident is the worst-case example for improper characterization of tsunami hazard. The NPPs can be protected from the flooding due to tsunamis, assuming that the design-basis wave height is adequately defined and the uncertainties of the tsunami characterization are properly compensated by the conservative design. Contrary to the Fukushima Dai-ichi plant, the 14-m high seawall protected the Onagawa NPP from flooding due to tsunami [31].

The basic difficulties of the hazard characterization are the epistemic and aleatoric uncertainties that should be evaluated and accounted for.

Considering the design-basis hazards, the uncertainty is compensated by conservative approach: in the definition of the demand and calculation of the resistance of the SSCs. The generic design rules are fixed in the nuclear regulations and acceptable standards (see, e.g., [9] and [32, 33]).

It should be emphasized, that in the engineering practice, prediction of the effects of hazardous phenomena is recognized to be “a posteriori” uncertain. Therefore, the design should cope with this uncertainty not only within the design basis but also beyond.

It is required that the NPPs should be prepared for the unexpected exceedance of $E_{\mathit{DB}}$ and the sudden loss of safety functions (a cliff-edge phenomena) shall be eliminated. This can be expressed as $P\left(\mathit{\text{fail if}}E\gtrsim E_{\mathit{DB}}\right)\lesssim M$ , where $M$ is some acceptable probability of failure for unfortunate cases, if the design-basis effect is exceeded by a certain value $E=E_{\mathit{DB}}+\mathit{\delta }\mathit{E}$ .

Very important are how large should be the acceptable value of $M$ and $\mathit{\delta E}$ .

In the case of earthquakes exceeding the design basis, the design should provide an adequate margin to protect items ultimately necessary to prevent escalation of the event sequence to severe accident. According to the regulations, the best-estimate approach can be adopted for the evaluation of this margin [34]. The high-confidence of low-probability of failure (HCLPF) could be the measure of the seismic margin [35, 36]. For new plants, depending on the regulatory framework and design practice, a HCLPF capacity of at least 1.67 [37] or 1.4 [38] times the design-basis peak ground acceleration is required to be demonstrated. These values are based on the conservatism of the nuclear design standards and justified by extensive studies. In the standard ASCE/SEI 43–05 [33], it is proposed to accept the probability of unacceptable performance less than about 10% for a ground motion equal to 150% of the design-basis ground motion, while for the design basis, the probability of unacceptable performance less than about a 1%.

The above concept can be adopted for other hazards as it is proposed, for example, in [37].

6. Justification of design tools and solutions

The design tools/solutions can be proven:

1. Directly by NPP experiences (events and damages).

2. Indirectly by:

   • Reconnaissance and analysis of event consequences and damages (nonnuclear).

   • Experiments (shaking table tests, wind tunnels, etc.).

   • Numerical analysis and experiments.

From our point of view, the most important are the real NPP experiences regarding natural hazard events and consequences. There are several sources archiving the experiences of extreme natural events. The International Atomic Energy Agency International Seismic Safety Centre collected the information on the earthquake experiences reported by the operators. There are several hundreds of significant earthquakes registered within 300 km epicentral distance from NPPs.

The World Nuclear Association has also collected the data of nuclear accidents that could be compared by other industrial activities [39].

The European Commission Joint Research Centre also published a study on the external hazard-related events at NPPs [40]. According to this study, apart from earthquakes and tsunamis (Fukushima case), the fouling events (biological fouling of water intakes affecting also the ultimate heat sink and chemical fouling causing corrosion) and extreme weather conditions, including lightning strikes and floods, are dominating. A few events reported have safety significantly according to the International Nuclear Event Scale.

In the USA the Nuclear Energy Institute published a fact sheet on the response of US NPPs to natural events starting with June 2011 Missouri River (Nebraska) flooding up to September 2018 as the Hurricane Florence threatened the NPPs in the Southeast region of the USA and including also the 23rd of August 2011 beyond-design-basis seismic event at North Anna NPP in Virginia [41].

The examples show that the nuclear plants can withstand and properly respond to extreme natural events, if the design basis defined is adequate that was not the case at the Fukushima site with respect to the tsunami. The industry has the tools, the analytical and testing capabilities, and the consolidated standards to design and build safe plants.

6.1. Justification for possibility protection by the experiences of NPPs

6.1.1. Earthquakes: vibratory ground motion

There are plenty of examples demonstrating that the codes and standards accepted in the nuclear praxis ensure sufficient capacity of SSCs to withstand the ground vibratory effects of earthquakes.

Although the recorded ground motions exceeded those values for what the plants were designed, the safety consequences of the earthquakes were negligible. That was the case of Miyagi earthquake (August 2005) at the Onagawa NPP and the Chūetsu offshore earthquake (July 2007) at the site of the Kashiwazaki-Kariwa NPP [42]. In case of the Great Tohoku earthquake, the behavior of 13 nuclear units in the impacted area on the East shore of the Honshu Island demonstrated high resistance against ground vibrations due to earthquake. Even the Fukushima Dai-ichi plant survived the strong motion period of the earthquake. In August 2011 the North Anna plant in Virginia, USA, also survived a beyond-design-basis earthquake thanks to the designed and built margins. The North Anna case demonstrated also the adequacy of definition of damage criteria formulated in terms of cumulative absolute velocity and justified the correctness of predefined measure of margin. Although the ground motion experienced at the site exceeded the design-basis level, the damaging effect of the earthquake was found below the margin evaluated, and the damages were really negligible [43].

Sufficient capability of plants to withstand beyond-design-basis vibratory motion of earthquakes has been demonstrated by the stress tests performed in the European Union and by focused reviews implemented in other countries. The stress tests have been aimed to the review of seismic hazard assessments for sites of nuclear power plants and to the verification of the design bases, as well as to the evaluation of margins against external hazard (mainly earthquakes and floods) effects, whether the beyond-design-basis hazard effects can cause cliff-edge effect, that is, sudden loss of safety functions due to effects exceeding the design-basis one. Information on these programs in the European Union is provided at http://www.ensreg.eu/EU-Stress-Tests. Information regarding post-Fukushima measures in the USA are available at http://www.nrc.gov/reactors/operating/ops-experience/japan-dashboard.html and for Japan at https://www.nsr.go.jp/english/library/index.html, respectively.

6.1.2. Flooding

Food safety can be ensured by combination of technical and procedural measures, reducing the power generation or shutting down the reactors. The protection of plants against floods is feasible even at rather unfortunate sites like the Tricastin one [21]. In spite of this, floods at some sites caused safety issues. For example, at Fort Calhoun site in 2011 [41], the plant should be protected by extraordinary temporary measures. The flood and fire resulted in a 3-year shutdown of the plant. At Blayais Nuclear Power Plant in 1999 [44], the high tide and storm flooded the plant and caused an event Level 2 according to the International Nuclear Event Scale. Safety upgrading measures and improved procedures have been developed and implemented to achieve the required safety level. The case turned the attention to event combinations that are capable to cause extreme flood event. Both cases reveal the importance of design-basis definition, regular review of the hazard characterization, and checking the protection capabilities and upgrading if necessary.

The NPPs can be protected from the flooding due to tsunamis, assuming that the design-basis wave height is adequately defined and the uncertainties of the tsunami characterization is properly compensated by the conservative design. The case of Onagawa NPP demonstrates that the proper definition of the design-basis tsunami height is an essential precondition of the safety. On the 11th of March 2011 at Onagawa plant, all safety systems functioned as designed, the reactors automatically were shut down, and no damage of safety related systems, structures, and components (SSCs) occurred [31]. The Madras NPP also survived the December 2004 tsunami. Although the fatal underestimation of the design-basis tsunami wave height at the Fukushima Dai-ichi site cannot be compensated simply by designed margins, even in this case, a conscious layout of emergency diesel generator would save the plant.

6.1.3. Meteorological extremes

The extreme cold and heat should not cause design difficulties that is justified by Kola and Bilibino NPPs in subpolar region of Russia and Bushehr NPP in Iran and Madras and Kudankulam NPP in Tamil Nadu, India.

The real experiences demonstrate that the NPPs can be protected from extreme storms and hurricanes [41]. There are proven solutions to protect the NPPs against extreme winds. In August 1992 the Turkey Point NPP survived the Andrew hurricane with 230 km/h wind speed (280 km/h gusts). The Sandy hurricane in October 2012 hit 34 US plants that survived the storm. Turkey Point and St. Lucie NPPs survived the Irma hurricane in 2017.

Considering the consequences of meteorological extremes, the transmission system also can interrupt the operation, especially the combination of extremes, for example, wet snow plus wind and freezing rain plus wind. Since the hydroclimatic hazards are relatively slow and predictable phenomena, safety is also ensured by reducing the power generation or shutting down the reactors.

A design principle can be mentioned here. Considering the same safety-related structures, the impact of aircraft crash is covering the impact effects of other phenomena, for example, the tornado missiles. The latter is covering the impact of hail whatever the size of the hail is. Obviously, the design is made for the largest effect.

6.2. Indirect justification for possibility protection of NPPs

As it has been summarized above, experiences demonstrated that the plants designed in compliance with nuclear standards can survive the effects of the vibratory ground motion even due to disastrous earthquake. However, severe accidents can be caused by phenomena accompanying or generated by the earthquakes. The severe accident of the Fukushima Dai-ichi plant was caused by tsunami. Other earthquake-related damaging phenomena can be the surface faulting and the soil liquefaction.

6.2.1. Liquefaction

In case of new plant, if the potential for soil liquefaction is recognized, the site shall be qualified as unacceptable, unless proven engineering solutions are available for the soil improvement [8]. For screening out the hazard, the factor of safety to liquefaction should be calculated by conservative deterministic method, or a probabilistic liquefaction hazard analysis should be performed. In case of operating NPPs, the liquefaction hazard and its safety relevance have been recognized either by periodic or focused safety reviews. Typical failure modes due to liquefaction are the tilting due to differential settlement, structural failures caused by tilting, and damages of lifeline connection to different buildings. The basic finding of 41 operating NPPs at soil sites in the USA [45] revealed that the liquefaction is generally not a safety issue. However, if it is the case, liquefaction could be an essential contributor to the core damage. Similar conclusion was made on the basis of seismic PSA for Paks NPP, Hungary. In this case, a justification of sufficient margin against liquefaction consequences should be made applying state-of-the-art techniques and best-estimate methodologies as for beyond-design-basis effects. Example for the sophisticated numerical analysis of liquefaction hazard and its consequences has been made for Paks NPP [46].

6.2.2. Surface displacement

According to earlier regulatory approach, the existence of surface rupture and fault displacement hazard at a site was an exclusion criterion for the site [8, 15]. As a consequence of this, the detailed evaluation of hazard and the engineering treatment of consequences for nuclear power plants remained for long time an early stage of development. The post-Fukushima hazard reviews revealed the issue (a summary description of the issue and relevant publications is given, for example, in [28]). It’s trivial, an earthquake happens when two blocks of the earth suddenly slip past one another, and the energy stored up in the block is released in the form of seismic waves. Surface faulting is a displacement that reaches the earth’s surface during slip along a fault. However, the manifestation and the measure of the displacement depend on the magnitude and local geology. The surface rupture/fault displacement causes mechanical effects completely differing from the effects of vibratory ground motion. That is the reason why a specific term “capable fault” has been introduced for this type of faults that is based not on seismological but on the engineering considerations. If the fault movement happens just below the plant, the consequences could be tilting, foundation and structural failures, and damages of lifelines due to differential displacements. However, the safety significance of displacement depends on the measure and type of displacement. There are sufficient engineering knowledge and analytical tools to evaluate the consequences of surface displacements as it is stated in [15, 28, 47, 48].

7. Operability of nuclear power plants during and after the events

The operability of the plant is defined by the weakest link, that is, by those non-safety-related SSCs designed/qualified to withstand low-magnitude effects of natural phenomena according to building code or conventional industrial standards (e.g., EUROCODE 8 for earthquakes). These magnitudes usually correspond to the 100 years of return period events. In case of earthquakes, the limit of continuous operation is the operation-based earthquake with approximately 100 years of return period or 475 years as per EUROCODE 8.

If the return period, T, of the lower magnitude hazard effects is 100 years, the probability of exceeding the corresponding magnitude of hazard for the entire operational lifetime (60 years) is ${\mathit{PE}}_{60}\ge 0.4528$ . This is the probability of the shutdown and related economic losses caused by exceedance of magnitude of the operational level.

The relevant hazards limiting the operation for the inland freshwater-cooled plants like the Paks NPP in Hungary are the low flow rate in river and high water temperature. Controlling parameter for freshwater cooled plants is defined in terms of river water temperature measured at some distance from the hot cooling water outflow. In these cases, for safety and environmental protection, the power generation is reduced, or the reactors are shutting down. The hydrometeorological extremes became more frequent and more severe due to climate changes. Assume that the return period of event with the given limiting magnitude will be 50 years as an average over the 60 years of operation instead of 100 years. In this case, the probability of economic losses will be ${\mathit{PE}}_{60}\ge 0.7024$ . Over the timespan of 60 years, the worsening of hydrometeorological conditions and increase of the magnitude and frequency of extremes will affect the economy of the nuclear power production, especially those plants with freshwater cooling. Even if the values given above for the exceedance probability of magnitude of hazards for continuous operation might be not precise, the tendency is clearly showing the growing probability for economic losses due to climate change for any thermal power plants.

8. Conclusions

The nuclear power plants survived several extreme natural events during 17,825 reactor years of operation (as per the 1st of December 2018). In spite of the Fukushima disaster that was also avoidable, the experience is demonstrating that there are sufficient knowledge and engineering means to ensure the safety of the nuclear power plants and protect the people and environment even in case of severe natural phenomena. In the chapter the conscious approach to hazard and availability of proven technical solutions against natural hazards has been demonstrated on the practical examples.

It has to be recognized, mother Gaia can cause sad surprises, outliers, black swans, and dragon kings that should not be “ab ovo” excluded from considerations. However, these are “products” of probabilistic considerations. Probabilistic considerations that are also accounting the epistemic uncertainty should be the basis of and generic approach to hazard and safety. Although the nuclear industry is widely using the argumentation with the small probabilities, the era of neglecting low probabilities is passed. It may seem to be a fatalist attitude; the new design paradigm is to provide necessary provisions and procedures for managing severe emergency situations, since a devastating natural event can never be completely ruled out.

Living in the word of risk, we should be aware what we do not know, and our lack of knowledge should be compensated consciously. Over the centuries of industrial era, risk has been always compensated by obvious benefits for the society. Obviously and with good reasons, this has changed nowadays. There are obvious and at the same time not fully understandable reasons for sensitivity and low tolerance of the society against the nuclear industry. To overcome this, the nuclear industry is making the necessary moves also with respect to the nuclear safety against natural hazards.

Conflict of interest

The author declares that there are no conflicts of interest that might have any bearing on publishing of information/research reported in the submitted manuscript.