Safety of Nuclear Power Plants with Respect to the Fault Displacement Hazard

Featured Application

Nuclear engineering, safety of nuclear power plants.

Abstract

The hazard of permanent ground displacements/deformations can challenge the safety of the nuclear power plants. Increasing knowledge of the hazard and development of methods for structure–fault–displacement interaction motivates the designing of nuclear power plants for permanent ground displacement instead of abandoning the sites that could be affected by this kind of hazard. For the design basis, permanent ground displacement should be defined at the hazard level that complies with the probabilistic criteria for accounting for the natural hazards in the design that also ensure compliance with probabilistic safety criteria. In this paper, a procedure is proposed for the definition of the design basis permanent ground displacement that is based on the deaggregation of seismic design basis hazard. The definition of the displacement for the margin evaluation is also proposed. The feasibility of safe design is also demonstrated for the proposed definition of design basis hazard via qualitative judgement on the sensitivity of the structures, systems and components ensuring the fundamental safety functions with respect to the permanent ground displacement that is supported by existing case studies.

1. Introduction

The lessons learned from the accident of Fukushima Dai-ichi Nuclear Power Plant changed the safety paradigm radically. Instead of designing for external events with rather low probability, e.g., earthquakes with a return period of ten thousand years, preparedness for practically impossible events is required.

The experience of the Fukushima accident and other cases when earthquakes affected the nuclear power plants demonstrated that the effects due to vibratory ground motion were well sustained by the nuclear power plants, even if these exceed the design basis levels. Therefore, the focus of the post-Fukushima safety reviews worldwide was to update the site hazard evaluations with respect to adequacy and completeness of the design basis and assess the beyond design basis hazards and plant response to these hazards. One of the objectives of the site hazard re-evaluation was to prove whether the potentially active faults at or in the vicinity of the nuclear site are capable of causing permanent ground displacements/deformations (indicated further as PGD) that could have a significant impact on nuclear safety.

In case of a new site, the nuclear safety regulations require abandoning the potential sites that could be exposed to a fault displacement hazard [1,2], if the potential effects of the PGD on the nuclear safety cannot be compensated for by means of a combination of measures for site protection and design features of the nuclear installation. Compared to the earlier generic avoidance, this approach reflects a tendency to consider the PGD as a load case that could be accounted for in the design of nuclear power plants. This conceptual change in the regulation is motivated by several factors: (1) Experience shows that some structures could survive the effects of direct surface rupture, [3,4]. (2) The design experience of non-nuclear facilities is convincing regarding the possibility of protective measures, [3,4]. (3) There is essential progress in PGD hazard characterization [5,6,7,8]. (4) There are certain experiences in hazard evaluation for nuclear sites, for example, [9,10]. (5) Highly sophisticated analytical tools are available capable to simulate the response of the foundation medium and the structure to PGD, for example, [11,12].

There are some other, more interest-based motivations: the selection of a new site is very difficult from both technical and socio-political aspects. Therefore, quite often, the already existing sites are envisaged for the new projects. If it is a case, even for the accepted sites, a state-of-the-art site characterization might be needed. For example, it is the new-build project at the site of Paks, Hungary, that includes updates of fault mapping and the re-evaluation of fault capability. The hazard re-evaluations, as it has been made after the Fukushima accident, can reveal new scientific information suspecting the capability of faults at or around the site, as it happens at Higashidori, Tsuruga, Ohi, Mihama, Shika and Monju nuclear power plants [13,14,15].

There are sites where the assessment of the activity of the mapped faults in the site vicinity or even within the site location cannot be assessed due to specific geologic context. There, the simple presence of the fault suggests suspicion of the capability, see examples in [16,17], and the doubts are inevitably considered as an issue in nuclear safety.

The evaluation of a PGD hazard became important for the design of new plants as well as for the justification of safety of the old plants due to some new scientific evidences related to secondary faulting. The recognition that the fault movement can cause surface displacements at a rather extended area increased the need of investigation of distributed faulting that can potentially affect the nuclear sites, see, e.g., [18,19].

Nuclear safety is a very complex matter that can be properly understood in a holistic way. The design is code conservative, and the design rules and standards are proven by experiments and practice. The safety regulations require one to account for severe external loads, including 10⁻⁴ to 10⁻⁵ per annum earthquakes, severe tornados, postulated crash of military and large commercial airplanes, etc. Contrary to this, no nuclear power plant has been ever designed for PGD. Fortunately, empirical information regarding response of nuclear power plants to the permanent ground displacement is completely missing. Nevertheless, there are opinions (see, e.g., [20]) that the structures, systems and components of nuclear power plants might have good chances to withstand effects due to PGD thanks to designing for mentioned above extreme loads. Unfortunately, the number of rigorous analyses on the subject is limited. The ANSI/ANS-2.30-2015 standard [21] defines the rules for hazard evaluation and siting. The JANSI-FDE-03 document [22] provides insight for safety evaluation for permanent ground displacement. In spite of these achievements, detailed rules for the PGD design should be developed that would fit into the system of nuclear requirements. It is reasonable to promote these activities, since it could not be excluded that the safety of some existing plants should be justified for PGD hazard, or a new plant should be designed accounting for the PGD hazard. The latter can happen because of difficulties in finding a new nuclear site that would be accepted by the society. Therefore, the paper intends to contribute to the development that makes the design of nuclear power plants for PGD as “business as usual”. The paper is composed of two parts.

The first part aimed to develop a reasonable method for the definition of design basis PGD. The probabilistic safety criteria and their use in the definition of the design basis natural hazards is the starting point. It is also assumed that seismic design basis is defined by the probabilistic method as per International Atomic Energy Specific Safety Guide SSG-9 [2]. Two hypotheses are formulated and discussed in the first part of the paper:

• The PGD that should be considered in the design basis and safety evaluation can be defined on the basis of deaggregation seismic design basis hazard taking into account the localized sources with magnitude contributing to the seismic hazard. The annual frequency that could be associated with this ground deformation should be less than the hazard level for design basis earthquake. This ensures the conservatism of the design basis for PGD.
• The PGD associated to the source identified, as above, can be conservatively approximated by the displacement due to the maximum potential magnitude of the source. This conservatively defined PGD can be considered as beyond design basis phenomenon.

Based on the probabilistic nuclear safety criteria and on the deaggregation of the design basis seismic hazard, a method for the definition of the design basis permanent hazard has been proposed.

It should be emphasized that the review and discussion of the state-of-the-art of PGD hazard assessment is beyond the scope of this paper. Basic references for hazard characterization are referred in the ANSI/ANS-2.30-2015 [21] and JANSI-FDE-03 rev.1 [22]. Criteria for the capability of the fault to cause significant surface displacement are understood as per International Atomic Energy Agency (IAEA) Specific Safety Guide SSG-9 [2].

In the second part of the paper, a qualitative analysis of the sensitivity/vulnerability of the structures, systems and components of nuclear power plants that are needed for fundamental safety function is presented.

The baseline information on the resistance of important for safety systems, structures and components with respect to PGD is given in the JANSI-FDE-03 document [22]. The most recent fragility analyses of the structural response to ground displacement, [23,24], are also used as supporting information. The analyses performed for Nuclear Power Plant Paks in Hungary for the differential settlement will also be referred as practical example.

A qualitative judgement of the author sensitivity/vulnerability shows that reasonable limited quasi-rigid body movement and tilting due to differential settlement will not challenge the integrity and function of the structures and will not hinder the safety functions of systems and components.

2. Baseline Information for the Definition of Design Basis PGD

The specificity of the PGD hazard could be enlightened in the frame of the basic principles to be followed in the design and safety evaluation of nuclear power plants.

2.1. Safety Objectives

Nuclear power plants should be designed by applying the ‘defense-in-depth’ principle, that is a systematic implementation of consecutive and independent levels of protection combining box-in-box physical barriers redundant and diverse safety functions and accident management measures. If one level of protection or barrier were to fail, the subsequent level or barrier should be available.

In case of accidents accounted for in the design basis, the plant should be brought into the safety condition. The reactor should be shut down and the reactivity in the reactor core and spent fuel pool should be controlled, the heat from the reactor core and spent fuel should be removed, and the integrity and leak-tightness of the containment should be ensured. The seismic design basis is defined at 10⁻⁴ to 10⁻⁵ annual probability level. The reactor core damage should be the avoided in case of design basis event. The annual probability of core damage (CDF) cumulated for all possible initiating events and external hazards should not exceed 10⁻⁵/a level in the case of new designs.

The conservative design ensures sufficient margins to cope with effects of events exceeding the design basis; thus, the sudden loss of safety functions called cliff-edge effect could be avoided. The design should cope with design extension conditions (DEC) that are postulated conditions not considered in the design basis but that are subject of the design. The safety goal is to avoid the fuel damage and loss of containment function. The assessment of the effects of beyond design basis hazards and the DEC conditions on the facility can be based on realistic assumptions and the single-failure criterion is not applicable. Generally, the total frequency of event sequences resulting in large or early releases (indicated further as ELRF) summarized for all initiating events and phenomena (excluding sabotage) should not exceed ELRF $\lesssim {10}^{-6}/\mathrm{a}$.

Safe design for PGD should comply with the above safety concept and criteria. Thus, the PGD hazard exceedance probability H_PGD should meet the condition $H_{PGD}\times P_F\le CDF$, where the $CDF$ is the acceptable core damage frequency CDF $\lesssim {10}^{-5}/\mathrm{a}$. The $P_F$ expresses the mean probability of unacceptable performance that is the convolution plant fragility (conditional probability of failure given the PGD level) and PGD hazard curve integrated up to the PGD value at $H_{PGD}$ level.

Additionally, sufficient margin should be demonstrated by the design for avoiding the early or large releases and cliff-edge effects. This can be expressed as $H_{PGDm}\times P_{Fm}\le ELRF$, where $H_{PGDm}$ is the hazard level of the PGD for what the integrity and functionality is proved. For the case of severe external events, beside of safety systems, additional design features should be in place to avoid the severe accident sequences. Therefore, in margin assessment, the set of systems, structures and components and their annual probability of loss of the function is not necessarily equal with those for core damage. Here, the concept of seismic design could be accounted for.

It is reasonable to apply the concept of seismic design and safety evaluation. For earthquakes, the plant safety with regard to both core damage frequency and early or large releases’ criterion is demonstrated either by probabilistic safety analysis or via demonstrating sufficient margin above design basis earthquake effects. The latter can be done by code deterministic assessment [25]. A minimum 40% margin above design basis maximum horizontal acceleration is required.

The maximum potential PGD depends on the maximum potential magnitude, $M{w}_{max}$, of the fault/source that can affect the site area, directly or due to distributed faulting. Therefore, as for an ultimate case, it should be demonstrated the possibility of avoiding the severe accident sequence if an earthquake would hit the site with $M{w}_{max}$.

2.2. Regulations Applicable for the Definition of PGD Design Basis

The IAEA SSG-9 [2] provides instructions for the scope of investigations and criteria for the definition of the capable fault. The SSG-9 advises defining the annual probability of exceedance for PGD, $\lambda \left(\mathrm{D}>\mathrm{d}\right)$. However, the SSG-9 [2] does not define the annual rate for the design basis PGA.

The 10 CFR 100 Appendix A [26] provides criteria for the capability of the fault, i.e., for the possibility of permanent ground displacement. According to this, the fault is capable if a movement at or near the ground surface can be identified at least once within the past 35,000 years or movement of a recurring nature within the past 500,000 years. Essentially, these criteria could be used for the definition of the design basis PGD hazard level. Let us assume that the events are Poisson distributed in time, and, applying the Chi-square test, the rate θ could not be less than:

$$\theta =\frac{{\chi }_{\left(1-\alpha \right),2\left(r+1\right)}^2}{2T}$$

(1)

where $\left(1-\alpha \right)$ is the confidence level, r is the number of the events during time interval, T.

Thus, if there is one near surface movement recognized with a 95% confidence level during the past 35,000 years, the rate θ is greater or equal to $1.36\times {10}^{-4}/a$. This is significantly higher than the empirical rate $\lambda =1/\mathrm{35,000} \mathrm{years}=2.86\times {10}^{-5}/a$. To the contrary, if no PGD event is identified during the past 35,000 years, the estimated rate for non-zero PGD is not less than $8.56\times {10}^{-5}/a\approx {10}^{-4}/a$. Extending criterial time T to the past 50,000 years and assuming one event happened, the rate for non-zero PGD will be $\cong {10}^{-4}/a$. If there is no event identified during the past 50,000 years, θ should not be less than $6\times {10}^{-5}/a$. The condition in 10 CFR 100 Appendix A regarding the recurring nature of events during the past 500,000 years is rather controversial. Recurring nature means a minimum of two events during the past 500,000 years. Assuming two events, the rate θ will be equal to 1.26$\times {10}^{-5}/\mathrm{year}$. This rate would suggest screening out the hazard from design basis. Consequently, the fact that one movement can be identified during past 35,000 years (or even 50,000 years) is adequately indicating the need for further analysis and the characterization of the hazard and “no event” during the past 35,000 years (or 50,000 years) is not sufficient to screen out the hazard with high level of confidence.

3. Concept Proposed for Definition of Design Basis PGD

The design basis for PGD is proposed to be developed starting with considerations of whether the design basis earthquake could cause PGD. It is assumed that the site is investigated in accordance with IAEA requirements and guidance [1,2]. The design basis earthquake is defined in terms of the annual probability of the exceedance of maximum horizontal acceleration that is set usually to 10⁻⁴/year. The deaggregation of the hazard defines the weights in magnitude-distance bins how the earthquake with magnitude Mw and at distance R contributes to the hazard. The deaggregation of hazard can be transformed to a probability density function, $\wp \left(Mw,R\right)$, i.e., the integral for all magnitudes and distances ${\displaystyle \iint }\wp \left(\mathrm{Mw},\mathrm{R}\right)dMwdR=1$. It does not seem practicable to assume that the site location can be affected by several sources within the site area. Furthermore, it should be noted that, in case of seismic design basis at hazard levels 10⁻⁴ to 10⁻⁵ per annum, the dominating sources are generally close to the site (see, Figure 1) and the magnitudes tend to maximum potential (or cut-off) magnitude $M{w}_{max}{}^{*}$ (see, Figure 2) for the Paks site, Hungary [27].

The first question to be answered is whether permanent ground displacement can happen at the hazard level for the seismic design basis. Considering the fault traces and possible surface ruptures, those distance bins should be taken into account that are within the screening distance, $R_{scr}$ between the site location and principal fault or between the site location and any Quaternary fault as per ANSI/ANS-2.30-2015 [21].

Let us denote the magnitude probability distribution as $p\left(Mw\right)=\mathrm{C}{{\displaystyle \int }}_0^{R_{scr}}\wp \left(Mw,R\right)dR$, where $C>1$ is the scaling constant for ensuring that ${{\displaystyle \int }}_0^{M{w}_{max}}p\left(Mw\right)dMw=1$. The $M{w}_{max}$ is the maximum magnitude of the source contributing to the seismic hazard at the level of design basis ($H_{DBE}$). The $M{w}_{max}$ should be less or equal to the maximum potential magnitude of the source $M{w}_{max}{}^{*}$ that is defined on the basis of geologic and tectonic considerations for the seismogenic source contributing to the hazard. It is reasonable to assume that a single capable source is in the site area.

Introducing the conditional probability distribution of PGD greater than zero versus magnitude $P\left(sr\ne 0|Mw\right)$, the probability of PGD greater than zero $P\left(sr\ne 0\right)$ for the hazard level of design basis earthquake can be calculated as follows:

$${{\displaystyle \int }}_{M{w}_{min}}^{M{w}_{max}}p(\mathrm{m})\mathrm{P}\left[\mathrm{sr}\ne 0|\mathrm{m}\right]dm=P\left(sr\ne 0\right)$$

(2)

where m is the running value of $Mw$, $M{w}_{min}$ is the minimum magnitude that can cause surface rupture, and $M{w}_{max}$ is the maximum potential magnitude of the source that contributes to the hazard and is capable of causing PGD at the site $M{w}_{max}\le M{w}_{max}{}^{*}$. Thus, for the sake of the simplicity of writing the equations, the continuous distribution form is used. The $\mathrm{P}\left[\mathrm{sr}\ne 0|Mw\right]$ is the conditional distribution for surface rupture (indicated here as sr) if an earthquake happens with $M_w$. Depending on the fault type, the $\mathrm{P}\left[\mathrm{sr}\ne 0|M_w\right]$ is to be taken into account, for example, from Youngs et al. (2003) [5] and Petersen et al. (2011) [6], Moss and Ross [7], or from Takao et al. (2015) [8]. Regarding minimum accountable $M{w}_{min}$ and the area of possible distribution faulting, it is advised that [18,19] are taken into account.

An estimation of the $P\left(sr\ne 0\right)$ can be done approximating $p\left(Mw\right)$ by uniform distribution in the interval [$M{w}_{min}$;$M{w}_{max}$] and $\mathrm{P}\left[\mathrm{sr}\ne 0|Mw\right]\le \mathrm{P}\left[\mathrm{sr}\ne 0|M{w}_{max}\right]$. Thus, for $P\left(sr\ne 0\right)$, the hazard level of seismic design basis holds:

$$P\left(sr\ne 0\right)<\mathrm{P}\left[\mathrm{sr}\ne 0|M{w}_{max}\right]\le 1$$

(3)

The annual frequency of non-zero PGD is approximately equal to $\mathrm{P}\left[\mathrm{sr}\ne 0|M{w}_{max}\right]·\lambda \left(M{w}_{max}\right)$. Here, the $\lambda \left(M{w}_{max}\right)$ is the annual frequency of $M{w}_{max}$ taken from the deaggregation.

The intensity measure, IM, of the seismic hazard is usually the maximum horizontal acceleration of design basis earthquake PGA_DBE. The rate of exceedance $\lambda \left(IM>{\mathrm{PGA}}_{DBE}\right)$ of PGA_DBE will be:

$$\lambda \left(IM>{\mathrm{PGA}}_{DBE}\right)=\lambda \left(Mw>M{w}_{min}\right){{\displaystyle \int }}_{M{w}_{min}}^{M{w}_{max}}{{\displaystyle \int }}_0^{R_{max}}P\left(IM>{\mathrm{PGA}}_{DBE}|m,r\right)p\left(m,r\right)drdm$$

(4)

Since the double integral is larger than zero, the $\lambda \left(M{w}_{max}\right)<\lambda \left(IM>{\mathrm{PGA}}_{DBE}\right)$.

Consequently, the following inequality is also valid:

$$\mathrm{P}\left[\mathrm{sr}\ne 0|M{w}_{max}\right]·\lambda \left(M{w}_{max}\right)<\lambda \left(IM>{\mathrm{PGA}}_{DBE}\right)$$

(5)

The PGD for seismic design basis can be calculated as the mean value of the permanent ground displacement, D that can be calculated formally as:

$$<{\mathrm{PGD}}_{DBE}>=\underset{0}{\overset{PG{D}_{max}}{{\displaystyle \int }}}D·{{\displaystyle \int }}_{M{w}_{min}}^{M{w}_{max}}p\left(D|m\right)·p\left(m\right)dmdD$$

(6)

Instead of $<{\mathrm{PGD}}_{DBE}>$, it is reasonable to correlate the PGD design basis via the empirical relationship $PGD=D\left(\mathrm{Mw}\right)$, selecting the ${\mathrm{PGD}}_{DB}$ at the maximum magnitude $M{w}_{max}$ of the localized source from the deaggregation of seismic design basis using reference, for example, [28].

$$PG{D}_{DB}=D\left(M{w}_{max}\right)$$

(7)

Obviously, the $\lambda \left({\mathrm{PGD}}_{DB}\right)=\lambda \left(M{w}_{max}\right)\le \lambda \left({\mathrm{PGA}}_{DBE}\right)$. Consequently, the selection of ${\mathrm{PGD}}_{DB}$ is conservative and can be used for the safe design.

Since the magnitudes tend to be the maximum potential magnitude $M{w}_{max}{}^{*}$, the PGD hazard can be screened out per annual frequency via comparison with the acceptable value for the early or large releases, ELR, frequency, if:

$$\mathrm{P}\left(sr\ne 0|M{w}_{max}{}^{*}\right)·\lambda \left(M{w}_{max}{}^{*}\right)<\lambda \left(ELR\right)\le \frac{{10}^{-6}}{year}$$

(8)

Here, it is implicitly assumed that a PGD event will unavoidably cause early or large releases that is a rather conservative assumption that is an over conservative assumption, except if the site is directly located at a capable fault with very large maximum potential magnitude.

The condition $\lambda \left(M{w}_{max}{}^{*}\right)\le \lambda \left(M{w}_{max}\right)\le \lambda \left({\mathrm{PGA}}_{DBE}\right)$ would also allow for considering:

$$\mathrm{PGD}=D\left(M{w}_{max}{}^{*}\right)$$

(9)

as a beyond design basis effect that can be used for margin analysis.

If the PGD hazard cannot be screened out via Equation (6), the hazard should be taken into account in the design and the safety should be evaluated and justified in accordance with the criteria for core damage and early or large releases.

Following the logic of seismic design, the curve $\lambda \left(\mathrm{D}>\mathrm{d}\right)$ should be defined. For the design, the design basis ground displacement, PGD_DB, can be defined on the mean $\lambda \left(\mathrm{D}>\mathrm{d}\right)$ at the hazard level for the seismic design basis, H_DBE, that is usually 10⁻⁴ to 10⁻⁵ per annum.

The justification of safety can be done by probabilistic or deterministic methods.

The probabilistic method of safety analysis for PGD can be based on the logic of Seismic Probabilistic Safety Analysis. For the probabilistic safety analysis for PGA, the evaluation of the hazard curve for PGD is required, the identification of accident sequences, the development of event trees and fault trees for the plant should be done, the conditional probability of failures (fragility) versus displacement for the relevant structures, systems and components should be developed (see, e.g., [23,24]), and, finally, the annual frequencies of core damage or releases categories should be calculated.

Adopting the deterministic seismic margin assessment methodology [25], the review level displacement, PGD_RL, should be defined. The PGD_RL should be large enough to threaten the integrity and function of structures, systems and components (SSCs). The PGD_RL could be correlated by the $M{w}_{max}{}^{*}$. This is appropriate if the annual frequency of maximum possible magnitude of the source within the site area is approximately one order of magnitude less than the seismic design basis hazard level ($10\times \lambda \left(M{w}_{max}{}^{*}\right)\approx \lambda \left({\mathrm{PGA}}_{DBE}\right)$). Thus, the PGD associated with $M{w}_{max}{}^{*}$ can be used as input for justification of sufficient margin. Thus, the possibility of the cliff-edge phenomenon can be assessed comparing the PGD values associated with $M{w}_{max}$ and $M{w}_{max}{}^{*}$.

4. Baseline Information for Plant Response to Permanent Ground Displacement

Existing representative studies will be briefly presented below that support the hypothesis that limited internal deformations and tilt due to PGD will not challenge the integrity and function of the structures and will not hinder the safety functions of systems and components. These studies are focusing on the cases when the permanent ground displacement results in uneven settlement and tilt of the plant nuclear island structures and do not cover all types of permanent ground displacements.

4.1. Structural Features of the New Nuclear Power Plant Designs

For understanding the potential safety issues due to PGD, the design features of the nuclear power plants should be considered.

As an example, typical structural features of a new Pressurized Water Reactor (PWR) will be considered. In the modern designs, such as the European Pressurized Walter Reactor, the AP-1000 or the Russian designs, the reactor is placed in a double containment that is surrounded by safety buildings. The 1.2 to 1.5 m thick prestressed concrete inner containment sized for pressures (0.5 to 0.7 MPa) and high temperatures due to loss-of-coolant accident. The ≈2 m thick outer cylindrical shell (diameter ~50 m, height ~70 m) protects the reactor in the internal containment from the effects of crashing of large commercial airplane, like A380. The safety-related buildings should be designed for 10⁻⁴/year (in some countries 10⁻⁵/year) earthquake. The structures inside of containment supporting the extreme heavy components and the reactor shaft that serves as shielding increases the overall mass and stiffness of the structure. The containment is surrounded by safety buildings housing the redundant trains of safety systems and the control building. The building complex of nuclear island was built up on the common base mat with a footing pressure between 0.5 and 0.9 MPa. The dimensions and stiffness of the foundation complies with the mentioned above features of the superstructure.

Regarding basic safety functions, the reactor can be shut down by solid neutron absorbers. The injection of boron into primary coolant is the diver and redundant system that can be used in case the solid absorbers could not be inserted into the reactor core (anticipated transients without scram—ATWS). In design basis accidents, the heat from the reactor and spent fuel is removed by redundant emergency cooling systems outside of the containment either to a water body (sea, river, artificial pond) or to the air via cooling towers.

The primary systems in the inner containment are connected with the “outside” structures and systems by the piping of feedwater and steam lines for the steam generator. The piping of the emergency heat removal, and cables for emergency energy supply and cables for control and instrumentation connect the SSCs housing in the inner containment and safety and control buildings. The modern designs are equipped with passive safety systems that can remove the heat from the core and inner containment directly to the air without external power supply. The systems of passive heat removal are located in the containment building.

4.2. Case Studies for Existing Designs

Basic investigations of nuclear power plants for PGD have been published in the JANSI-FDE-03 document [22]. Here, case studies have been performed for a “design basis” $\delta a=0.3$ m and a “beyond design basis” $\delta b$ displacement below the center of typical PWR and BWR (Boiling Water Reactor) reactor buildings, assuming a soft foundation (Vs = 500 m/s) and a hard rock foundation (Vs = 1500 m/s). The study covers the analysis of the response to PGD for base mat, building structure, piping and mechanical components of typical PWR and BWR reactor types. The loads due to displacement of building have been combined by normal operating and seismic loads of the same origin as for the ground displacement. The evaluation procedures and allowances comply with nuclear standards of the design basis for each of the failure modes while sufficient margin should be demonstrated. Criterion for the beyond design basis was set that buildings and structures should maintain the shape as the whole structure without leading to total fracture.

In case of components and piping systems, compliance with nuclear codes has been required as for the design basis accidents. The normal operational and seismic loads have been combined with the loads from declination and deformation of supporting structures.

Three important statements can be extracted from the JANSI-FDE-03 [22] study:

• The available analytical tools are capable of simulating the fault displacement–plant interaction and for the evaluation of the response of the plant SSCs to the PGD.
• The nuclear codes and standards are applicable for the evaluation of the integrity and functionality of structures, systems and components for the load case of PGD.
• For the PWRs and BWRs specifically not designed for PGD, the analyses demonstrated that the safety functions of the structures, systems and components remain even in case of significant ground movement.

Moreover, the fragility analyses published in [23,24] demonstrated a high HCLPF (High Confidence for Low Probability of Failure) values of typical existing reactor design with respect to PGD failure modes for both foundation and containment.

The findings of the studies referenced above will not be presented and discussed but they are implicitly used to support the discussion on the safety issues due to PGD.

4.3. Studies Contributing to Understanding the Case of Plant Responses to PGD

For the evaluation of the consequences of differential settlement, useful experiences have been gained from the linear and non-linear analysis performed for the case of liquefaction for Nuclear Power Plant Paks, Hungary [29]. Although the physical phenomena of liquefaction and PGD is differing, the differential settlement in both cases cause similar static demand on the structure.

The differential settlement in the study for Paks Nuclear Power Plant was comparable with the $\delta a$ in the JANSI-FDE-03 [22] study. Here, the normal operational loads and the loss-of-coolant accident have been combined with the loads due to differential settlement. The load case was considered as a beyond design basis one. Except for the earthquake loads, a “ready to use” methodology does not exist for the beyond design basis analysis and evaluations. Therefore, the analysis and evaluation procedure were developed on the basis of standards ASCE/SEI 43-05 [30], FEMA-356 [31], EC 8-3 [32,33]. The ASCE/SEI 43-05 “slightly damaged, LS-C” and “significant damages, LS-B” damage levels were set for the ultimate acceptable condition of the structures. These are practically equivalent with the categories “immediate occupancy, IO” and “life safety, LS” according to FEMA-365. The starting point was to justify the IO criteria. For the containment, this assumption complies with the general integrity criteria of the IAEA Safety Guide NS-G-1.10 [34]. If all relevant structural components resist the loads of differential settlement and loss-of-coolant accident in compliance with IO level, the nuclear safety criteria are met. Moreover, it is also assumed that the structures provide reliable supports for systems and components. In case of an LS condition, focused analysis has been made for the proof of the integrity/stability of the entire building and demonstrating that the safety functions will not be hindered. The FEMA-365 NC condition could also be allowed for non-supporting structural elements if the damages of these structural elements do not affect the safety functions. The damage limits for the evaluation of conditions developed on the basis of EC-2 [35], E-3 [36], E-7 [37] and FEMA-356 [31,38,39,40] are presented for some structural elements in the

Table 1. Damage limits examples [40].

Type	IO	LS	Source
Overall tilt	1/400		EC2, EC3
Reinforced concrete column, wall eccentricity	0.06 h *		EC2
Reinforced concrete beam	0.0015–0.010 rad	0.002–0.020 rad	(FEMA-356)
Reinforced concrete column	0.001–0.005 rad	0.005–0.015 rad	(FEMA-356)
Steel beam or pole end (cross-section class 1)	1xθy **	6xθy	(FEMA-356)
Steel beam or pole end (cross-section class 2)	0.25xθy	2xθy	(FEMA-356)
Foundation system	1/4000~1/2000	1/1000~1/500	(EC7)
Non-ductile reinforced concrete frames, ISD ***	0.35%	1.36%	[32]

* h wall thickness, ** θy yield rotation, ISD *** inter-storey drift ratio.

.

For the systems and components inside the buildings, the effect of tilt on the integrity and function have been analyzed. Specific analyses have been made for underground piping and for the lifelines at the interfaces between adjacent structures. Piping and equipment have been examined per safety class, according to ASME Section III Division 1 for Service Level D [39]. The examination of the strain of containment liner has been performed according to ASME Section III Division 2 Table CC-3720-1 (Factored category, Combined Membrane and Bending) [40].

The findings of the Paks NPP case study [41] will be implicitly used below during the qualitative judgement of the failure modes caused by differential settlement.

5. Sensitivity/Vulnerability of the Fundamental Safety Functions to the PGD

The basic hypothesis in this paper is that if the limited internal deformations and tilt due to PGD will not threaten the integrity and function of the structures and will not hinder the safety functions of systems and components.

For the identification of potential safety issues due to PGD, a simple approach is applied in this paper that is based on the judgement on the fundamental safety functions and integrity of physical barriers:

• For the integrity of the fuel matrix and the cladding control of reactivity, heat removal should be ensured.
• The latter means that the integrity of the boundary of the primary system, emergency core cooling system and the systems transferring the heat to the ultimate heat sink should be ensured for the mechanical loads transferred to the piping and components from the supporting structures. Moreover, the emergency energy supply systems including cables should be available.
• The containment function should be ensured. Such a function is challenged by ground shaking, ground displacement, and, in the case of a loss-of-coolant event, by internal pressure and heat.

It should be noted that the possible damages and failure modes due to PGD depend on the particular design features of the nuclear power plant and on the peculiarities of PGD phenomenon and PGD foundation–structure interaction. The latter depends on the magnitude of earthquake, depth, style, sense of faulting, the thickness and parameters of the overlying the fault soil layers, the foundation type and rigidity, the load due to structure and foundation, the stiffness of the structure, the position of the structure relative to the fault trace are decisive [42]. The consideration of all these aspects was beyond the scope of a recent paper.

Qualitative judgement of the PGD effects on fundamental safety functions is presented below. Although the results of the studies [22,23,24], [29,41] are explicitly not used, these results support the considerations below.

5.1. Containment Function

Since the containment is the ultimate barrier and the reactor, the reactivity control systems and part of the emergency heat removal systems are located in the containment, the integrity and leak-tightness of the containment is the ultima ratio and it is reasonable to start the considerations with the containment response to PGD.

In both studies [22,41] the integrity of the concrete containments was not threatened by the differential movements below foundation. Moreover, the fragility analyses [23,24] demonstrated rather low conditional probability of failure of the BWR reactor containment and foundation for the $P_F<0.01$ for the PGD of dip-slip movement $D>0.3$ m.

The containment and the adjacent safety and control buildings are on the common rather rigid base mat. There are seismic gaps between the buildings for avoiding the interactions. The PGD should not cause differential movement between the building on common base mat. The differential movement between the buildings on separate foundation can affect the integrity of pipelines and cables connecting the adjacent buildings, and the underground lifelines should be checked for differential settlements. Generally, these pipelines and cables passing through building interfaces are designed for allowing differential movements due to seismic ground motions.

Leak tightness is ensured by a steel liner of the inner containment wall that is sized for internal pressures and temperatures due to loss-of-coolant accidents. The liner is a ductile structure. The strains in the liner can be evaluated in accordance with ASME Section III Division 2 Table CC-3720-1. The analysis for uneven settlement performed in [41] demonstrated that the strains in liner are below allowable limits, even if the ultimate deformation of concrete walls of hermetic boundary of the containment is assumed.

The safety systems inside the containment and safety buildings are composed by vessel and piping type components fixed to the walls and floors. The containment inner concrete and steel structures provide reliable support for these components, but the effects of tilting should be analyzed.

5.2. Shut Down of the Reactor

The shutdown and control of the reactivity of the reactor is ensured by the insertion of the neutron absorbers into the reactor core that use of gravity, or stored energy or driving force (compressed air) that does not need external power. The PGD can cause tilting of reactor building that can inhibit the solid neutron absorbers falling to the reactor core. Tilting due to uneven consolidation settlement is limited for both reasons, for avoiding structural consequences and providing free-fall for the absorbers. For example, according to the Russian standard PiNAE-5.10-87 “Construction Design Code for NPP with Different Types of Reactors” [43], under normal conditions, the strain in the walls of the reactor building and in the foundation is controlled by limiting the settlement and the tilt. For normal operational conditions, a tilt ≤0.001 is allowed. In case of specific effects, e.g., the seismic settlement, the tilt should be ≤0.003. The latter value corresponds to a drop of an edge of the base mat relative to the opposite one, approximately equal to 0.2 m and it is qualified as acceptable by the standard. The drop of absorbers into the core is not hindered by the allowed tilt. Practice shows that the rather old VVER-440/213 type reactors, like at Paks, Hungary, equipped by heavy absorber assemblies are even less sensitive to tilting. Even less sensitive to tilting should be the forced injection of absorbers in case of Boiling Water Reactors.

The shutdown shall be accomplished even if the solid neutron absorbers fail to be inserted. Boron as neutron poison can be injected by the chemical control system into the core for diverse control of the reactivity. The reactor can be brought into a controlled state by this system and can be kept in subcritical condition for a prolonged period of time. These systems are located in the containment and safety buildings. The systems are composed by piping, vessels and pumps that are not sensitive to the tilt of supporting structures.

5.3. Emergency Heat Removal from the Fuel and Containment

For the cooling down and continuous heat removal from the fuel, redundant emergency core cooling systems are in place at nuclear power plants (practically independent of the type and design) that transfer the residual heat to the ultimate heat sink (natural or artificial water body or air).

In case of typical PWR design, the safety systems inside the containment and safety buildings are composed by vessel- and piping-type components fixed to the walls and floors.

The pipelines and cables passing through building interfaces are designed for allowing differential movements due to seismic ground motions. The relative displacement between the building interfaces can cause damages in distribution systems. However, rather simple design solutions exist for avoiding these damages.

The heat from the reactor should be transported to the ultimate heat sink that is either a natural or artificial water body or the air. The systems for heat removal to water body consist of piping heat exchangers and pumps. The pipelines and cables are crossing the interfaces between the buildings and run usually underground. Critical could be the interfaces between structures. Diesel generators are sources of emergency power supply. These aggregates are not sensitive to the surface movements. In case of cooling towers used for heat sink, cooling ponds are usually designed as a redundant and ultimate heat sink that can be damaged by the PGD.

In the new designs of reactors, passive emergency core cooling systems and passive containment heat removal systems are designed that do not need external power supply. These are composed from heat exchangers and piping that are not sensitive to the tilting of the building.

5.4. Ultimate Argument—An Example of a Crash of a Large Commercial Airplane

The design for a crash of a large passenger airplane could be the ultimate argument for supporting the opinion regarding the survivability of permanent ground displacements.

Perhaps the effects of the crash of a large passenger airplane are the most challenging for the SSCs of a nuclear power plant, and the complex effects (impact, penetration, vibration, fire) of the crash can be accounted for in the design. The safety requirements for the case of a crash of a large passenger airplane are also specific.

For example, U.S. 10 Code of Federal Regulation § 50.150 [44] requires that either the reactor core remains cooled or the containment remains intact, and the complex effects of the crash can be accounted for in the design based on realistic or best-estimate assumptions.

In some national regulations, for example, in Finland, the extreme external events with a frequency less than 10⁻⁵/a, including a large commercial airplane crash are considered as design extension conditions [45]. The fundamental safety functions should be ensured by design, but the single failure criterion is not applicable.

The new designs of reactors comply with these extreme load case, see, for example, the U.S. Nuclear Regulatory Commission Design Certification Applications for New Reactors webpage [46].

The capability of newly designed reactors to withstand complex effects of the airplane crash strongly support the possibility of safe design for permanent ground displacement.

6. Discussion of the Results

The adequate level of conservatism, use of proven methodologies and the graded approach to the design that is achieved for seismic design should be extended for the load case PGD.

On the basis of the above requirement, in Section 2, the concept of design for the safety of a nuclear power plant is briefly presented that should be based on the derivation of the design basis PGD from the deaggregation of seismic design basis hazard. The PGD for design basis can be correlated with the closest and largest magnitude earthquake contributing to the hazard, as per Equation (7).

If the site selection is made reasonably, multiple sources could be excluded from the definition of PGD. The annual rate of this PGD will be less than the annual rate associated with seismic design basis that ensures a reasonable level of conservatism that may compensate the uncertainty in the correlation between the magnitude and ground displacement. A conservative screening criterion is proposed that is based on the maximum potential magnitude of the source and on the probabilistic criterion for the early and large releases (Equation (8)).

The displacement that is defined for the maximum potential magnitude of the source affecting the site can also be used as a beyond design basis PGD if the annual frequency assigned to maximum potential magnitude is about an order of magnitude less than the seismic design basis hazard level. This assumption is in line with the generic concept of seismic margin assessment.

A key element of the derivation of the design basis PGD is the conditional probability $\mathrm{P}\left[\mathrm{D}>\mathrm{d}|\mathrm{m}\right]$ (or the $\mathrm{P}\left[\mathrm{D}>\mathrm{d}|\mathrm{m},\mathrm{r}\right]$) similar to the probabilistic ground displacement analysis. The aleatoric and epistemic uncertainties related to the seismotectonic bases of the evaluation of the hazard are accounted for in the probabilistic seismic hazard analysis. Uncertainties in the empirical correlations between surface displacement and fault movement characteristics need a coordinated effort of a researcher to correct and evaluate the field observations; this is promoted, e.g., in [47]. The ground shaking and permanent surface displacement evaluation methods should be better supported by physics-based rupture modelling, e.g., [48]. A better understanding of the effects of plastic, soft rock, thick soil layers on the surface manifestation of the fault movement should also be achieved, see, e.g., [49].

A qualitative assessment of the sensitivity of structures, systems and components needed for the fundamental safety functions is performed in the paper that is supported by the JANSI-FDE-03 case studies and on the analysis of Paks Nuclear Power Plant reactor building for uneven settlement. Most important conclusion of this qualitative assessment is that the nuclear island structure, piping and components of safety systems are rather rugged with respect to permanent ground displacement. Although permanent ground displacement effects were not accounted for in the design of studied in [22,41] existing reactors, the safety-related structures, systems and components can withstand moderate ground displacements (0.2 to 0.3 m in the referenced studies). According to Wells and Coppersmith [28], a PGD of 0.2 to 0.3 m can be expected at Mw 6 to 6.5 for practically all styles of faulting. These findings should encourage and motivate the designers of nuclear power plants to consider the design for permanent ground displacement as “business as usual”. Although the fragility analyses [23,24] show higher than 0.2–0.3 m High Confidence for Low Probability of Failure PGD values for both the foundation and containment of some existing reactor designs, the analytical pieces of evidence are not sufficient to make a judgement about plant vulnerability if just below the site earthquake magnitude exceeds 6.5. Based on recent practice, it should also be noted that the potential sites with sources at the site area $Mw>7$ are not considered as a reasonable selection for nuclear power plants.

The case studies and the examples of fragility analyses referenced in this paper do not cover the wide variety of fault types, magnitudes, or surface manifestation of ground displacements. Therefore, the judgment on the possibility of safe design could be only qualitative. More arguments are needed for a generic statement on the possibility of ensuring the safety of nuclear power plants against permanent ground displacements. More attention should be made on the efforts of designing non-nuclear facilities for permanent ground displacement, see, e.g., [50,51]. The generic caution with respect to the capability of site vicinity faults to cause permanent surface displacement and case-by case approach should be combined with proven design measures in the siting and design of nuclear power plants.