Abstract submission guidelines for the Conference on ...

Technical Innovation in Nuclear Civil Engineering – TINCE 2013 Paris (France), October 28-31, 2013 Evolution of Nuclear Containment Design Over Time and the Place of Innovation in their Development. Dr. Paul Smith1. 1

Associate Director, Safety-Critical Design & Engineering, Arup.

In this TINCE 2013 plenary paper I would like to introduce a personal view related to the considerations and factors we face with nuclear containment development into the future. The key design function of the containment is to protect against release of harmful radioactive fission products and substances, as advocated by the IAEA, References 1 and 2. Continuous improvement in nuclear standards and best practice is an intrinsic imperative for us all. However, accidents force us to stop and re-think if what we have been doing is right. The fact is that the process of evolving better design and engineering, improved standards and practice - takes time; and whether we like it or not, nuclear accidents feed into this somewhat haphazard evolutionary process. My perspective here will be broad and holistic. I sincerely hope this paper fosters discussion and debate to enhance nuclear containment design and engineering into the future.

The nuclear containment is the final physical barrier that protects human communities and the environment from danger, while also acting as a biological shield against gamma-ray and neutron radiation. The containment structure also acts as a physical barrier to protect the internal nuclear reactor plant against natural and man-made external hazards like earthquake, flood, tsunami, hurricane, tornado, and aircraft crash etc., When you think about it, we ask a great deal of the nuclear containment overall. Its fundamental design is relatively easy to analyse by assuming linear behavior, but non-linear behaviour becomes more problematic when going beyond the design basis bounds. The containment’s structural behaviour becomes more non-linear close to its ultimate strength with the various complex failure mechanisms occurring, Reference 3.

Evolution of nuclear reactor plant and their integrated containment has developed considerably since the early 1960’s, initially driven in the USA with the advent of light water reactor technology introduced by companies like Westinghouse, Bechtel and Combustion Engineering. In parallel, the overarching governance and safety regulation was (and still is) predominantly prescribed by the US’s Code of Federal Regulations, Reference 4.

1ère Conference on Technological Innovations in Nuclear Civil Engineering TINCE 2013, Paris 28 - 31 October

In broad terms the technology’s progress is usually demarcated into so-called Generation I, II, III or the III+ (and future) design stages, intrinsically linked to the progress of containment design configurations like with Mark I, II, III containments. If we compare the early Mark I containment configuration with the most recent, the difference is quite profound in the plant’s cross-section, footprint plan and the complete system design, yet still centred out from the reactor pressure vessel in which the nuclear core resides. Founded on the historical evolution that has taken place, nuclear containment design configurations still in use today vary in their size, shape, material choice and strengths used, together with the integrated safety mechanisms, devices and circuits. In essence the containment engineering is a mixture of passive and active safeguard systems. Specific aspects include the leak-tight structure, leak-tight seals, pressure relief mechanisms, systems to control the temperature under various conditions, circuit isolations, systems to remove fission products and other harmful substances. Other systems control buildup of hydrogen and oxygen, together with emergency heat removal circuits that can be used for long periods during which an accident / severe accident scenario, eventually (and hopefully) stabilising to a safe state.

The concrete and steel fabric overall accounts for around 95% of the capital cost of new stations, and will become even more expensive in a carbon-constrained world economy. So the present challenge for designers and builders of nuclear power plants is to achieve improvements in safety, at the same time keeping the capital cost economically competitive, merged in the background of an austere utility market and the aspiration for a low carbon economy. Meanwhile different design approaches to nuclear reactor plant have been studied and are still competing with each other for market share. These approaches can be grouped principally into the options for (i) small versus large reactors, (ii) passive versus active safety systems, and the (iii) mitigation of accident and severe accident consequences. Yet a broad common denominator for all the nuclear plants is that the containment plays a dominant role in mitigating harmful consequences by being successful in its intended key design function - reducing the probability and consequence of a release, References 1 and 2.

Irrespective of the causal initiating event and sequence that results in a reactor accident, whether it be equipment unreliability / failure, human error, or a beyond design basis natural external hazard loading, the nuclear containment needs to have survived the initiating event, perform its

1ère Conference on Technological Innovations in Nuclear Civil Engineering TINCE 2013, Paris 29-30-31 October

intended functional design of mitigating the harmful radioactive release to less than the prescribed allowable limits, as well as continuing to do so through the aftermath of the scenario. In our thinking today, we also now need to take account of what happened in Japan on the 11th March, 2011. A key conclusion from investigating the Fukushima Daiichi (herein abbreviated to FD) accident, Reference 5, is the importance for Level II Probabilistic Safety Analysis (PSA) modeling of a nuclear facility (that includes the containment) and to better understand the significance of harmful off-site release consequences. There is always the need to update a facility’s PSA if any additional information becomes available during operation of the plant, or maybe from implications found in the industry as a whole. The experience of FD has recently raised this spectre, as did Three Mile Island (TMI) back in 1979. The real life experience resulting from accidents like TMI and FD are extremely important to understand. To re-analyse the original probabilistic modeling, together with re-assessment of the facility’s overall deterministic design and the engineering system hardware used, trying to find any shortfalls in the design. In addition, and as emphasised through the experience at FD, Reference 5, the nuclear facility’s plant-site character that incorporates its safety related services and supplies is a key factor when emergency accident recovery has to be implemented. It is therefore crucially important that we determine nuclear containment’s design and engineering worthiness to carry out its necessary design function, Reference 1 and 2, while a properly developed PSA model can theoretically identify any weaknesses or vulnerabilities that need to be addressed. Going a stage further, it is proposed that the modeling should account for the whole site’s design and engineering configuration together with its capability to withstand and tolerate the initiating event / accident / severe accident scenarios, as well as modeling the complex variables and dynamics that may exist with a postulated hazard scenario. In addition, the site’s subsequent post-accident conditions should be modelled, taking due cognisance of any damage or degrade in the plant’s systems, structures and components because of the hazard’s effect. Of particular interest here at TINCE, not only does the EPR™1 take advantage of the convergence and optimization between the German KONVOI and French N4 reactor plants as a Generation III+ plant, but also the designers took account of the principal lessons learnt following the TMI accident. Hence, the EPR™ containment addresses the concern for severe 1

EPRTM is a trade mark of Areva for their Evolutionary Power Reactor.


accident core melt mitigation with new core catcher technology residing in the lower civil basement, thereby reducing the likelihood for a core volume-fraction large release scenario. Considering containment in purely structural terms now, a nuclear containment’s design configuration uses a thin spherical or cylindrical shell structure. The thin shell structure is inherently strong at its outer curvature, yet relatively weak on the inner thickness {a fundamental characteristic of shell-like structures}. Two main types of material are used in the structure; steel and concrete, together with composites of both in various geometric layouts. The steel component overcomes the inherently poor tensile strength of the concrete, while the effective composite of steel reinforcement and (sometimes) steel post-tensioned tendons are used to keep the concrete in a compressive stress state, thereby enabling optimum use of the concrete as the dominating civil construction material to collectively yield large amounts of strength and ductility for a very cost effective construction option. Sometimes a steel liner is used as a leaktight membrane on the inside surface of the concrete containment wall, as with EPRTM.

In terms of design loading a postulated primary coolant pipe break resulting in a Loss of Coolant Accident (LOCA) has historically been presumed the worst case accident, acting as the design basis inner pressure benchmark and design criterion. The containment is designed to easily tolerate a postulated LOCA by a considerable strength margin (at least a safety factor of 2), with the containment design pressure usually being in the range of about 0.4 to over 1 MPa. The precise details depend on the type and size of the reactor plant, balanced against the containment’s enclosed volume that will allow for the abnormal LOCA steam expansion event. But as with any structure there is an ultimate strength limit above which the structure starts to fail. At very high internal accident pressures the containment shell will eventually crack resulting in leakage paths through the torn liner and the concrete wall section, Reference 3. Suffice to note that it is very important to include pressure relief devices that enable the reactor plant operators to manage and control gross over-pressure situations, circumventing catastrophic containment failure. The presumed event of a LOCA is admittedly important, but accounting for the high quality and structural integrity of modern day steel components in the primary pressure boundary plant, together with the recent experience of FD, we should more holistically consider the spectrum of postulated initiating events that the containment needs to tolerate and ultimately


withstand, while sustaining its key design function, References 1 and 2. With PWRs, four engineered physical barriers provide independent lines of protection. This defence in depth approach is based on the concept of using multiple lines of protection such that if failure of one barrier were to occur, then the safety of the operators and the general public would be protected by the presence of the other remaining independent barriers, Reference 6. Applying a suitable and sufficient defence in depth approach effectively decreases the probability for a release of radioactive fission products that will usually be claimed in the PSA justification and be included in the safety case justification. The safety philosophy is to reduce the risk’s probability and the consequence posed by nuclear reactors if they go wrong. But we also need to recognise the fact that the nuclear containment cannot be totally reliable since it is the last single protection and the final defence barrier against release. This makes the nuclear containment extremely important. In the process of keeping the capital cost economically viable, one factor a plant’s cost benefit analysis tries to balance is for plant performance and availability set against the obligations for sustaining public and environmental safety (which is expensive when having to include multiple defence in depth barriers). Inputs into the cost benefit analysis will require valid data that is fed into a algorithm. If done effectively, the cost benefit analysis will be able to discriminate between the benefit and dis-benefit balance. The substantive conclusion should in concept to indicate that the power plant facility is feasible and is actually the right thing to do. Integral of the cost benefit algorithm will be some form of probabilistic risk-based modeling, informed by a preliminary PSA (or similar). The justification that the power plant is the right thing to do is then justified by the plant’s substantiated safety and compliance, taking account of stochastic data and other empirical data that will have been specific to the nuclear plant technology and the site chosen for its placement. And probably of most significance is the operating need for unlimited cooling water supply that is crucial for safety, whether from lake, river, sea or ocean – siting wherever an abundant resource of cooling water supply exists.

After a number of years operation of a power plant, the power output itself becomes intrinsic of the country’s societal and even political tapestry, thereby becoming more and more difficult to lose. Once a large and complex power plant facility has been constructed and commissioned, it is then financially expensive and logistically difficult to make any major modifications to its


structure and engineered system. Premature closure of any prime power supply infrastructure is intensely problematical, simply because society depends upon its availability while the power plant becomes integral of the rest of a country’s infrastructure needs. And nuclear power technology will usually have been chosen by a country to compensate for lack of naturally occurring fuel resource. Loss of domestic power supply for long periods jeopardises people’s physiological needs, as identified by Maslow in 1943, Reference 7, and undermines a country’s ability to maintain its business and commerce. People’s safety needs, again perceived by Maslow, Reference 7, are obviously also important, but people have a tendency to retain little awareness of their safety and security needs except during periods of dis-organisation in the social structure and when its stability is undermined, or in times of emergency during natural disasters; as experienced in history during the TMI, Chernobyl and (now) FD emergencies. Some 34 years after the TMI accident, 27 years after Chernobyl, and on the 11th March 2011 at FD, yet again the world held its breath as people watched live pictures from helicopters recording the horrific tsunami bring death and destruction to the north eastern coast of Japan, and eventually causing the nuclear accident at the FD power plant. The plant is sited in the in Fukushima Prefecture of Japan, located approximately 250 km north of Tokyo by the nearcoastal towns of Futaba and Ohkuma, where the plant draws its cooling water from the Pacific Ocean. The enormous energy and wavelength within the tsunami of the 11th March 2011 was such that the land was inundated, creating unique hydro-dynamic conditions to worsen the tsunami’s potential for destruction. Although the earthquake and tsunami was a possibility since the Japanese coastline faces the region where the Pacific tectonic plate is gradually moving against the Japanese island arc, the extremity of the danger was not fully appreciated as a credible possibility to overrun the ‘high’ sea walls, nor was its actual effect fully appreciated. The accident at FD has fundamentally highlighted the potential danger faced by nuclear sites adjacent to oceans where tectonic plates meet. Abrupt out-of-plane tectonic movements will give birth to severe earthquakes at such localities and potentially lead to unexpected tsunami characteristics that could impact the rising coastline. And nuclear plants have historically been designed to be seismic resistant as a judged priority, while less emphasis has been given to extreme floods and tsunami waves that result in gross water inundation scenarios.


Irrespective of the long history of nuclear power plant design and development that has taken place over the past 50 years, on the 11th March 2011 our perception and awareness radically changed, while our technical confidence was diminished as scientists and engineers. I would suggest that we must now rise and face head-on this new technical challenge. Similar examples of extreme flooding can be due to hurricane storm surge and swollen rivers due to immoderate rainfall upstream. As mentioned at the beginning of this paper, a key conclusion from investigating the FD disaster was the importance of Level II PSA modeling, Reference 5. If we are honest with ourselves on a personal level, and as an international community of scientists and engineers, signs do exist (both tangible and intangible) to indicate that significant earthquake and landslide events can result in severe tsunami natural hazards around the world, with the possibility of being felt across the ocean as well. In the particular case of the FD plant and its site, the possibility became a reality on the 11th March 2011. Upon hindsight it is apparent that the signs possibility existed earlier, although were not adequately recognised or addressed. Tangible records told us that there have been major earthquakes distributed over the plate in the last few hundred years and earlier. What was unexpected was the incredible danger of the earthquake when it happened to produce such a destructive tsunami. However we may define the character of the unexpected energy, height and tailing wavelength of the tsunami that hit the Japanese coastline to cause such enormous amounts of destruction and loss of life, it is now a significant legacy to be coped with and we need to learn from it. This emphasises the difference between proactively designing and preparing for a “tangible probability”, as opposed to an “intangible possibility”. In technical terms, the tsunami that hit FD was (I would suggest) an “intangible possibility” that needed to be tolerated and withstood if the nuclear plant’s at FD were to have remained safe. The initial recognition for the existence of “intangible possibilities” may be related to things like the known existence of supposedly dormant geological faults, like those that cross Western Europe for example. Widening our view on a more holistic level, in 1953 some oil prospectors in Alaska by chance discovered land damage and indicative evidence for an enormously destructive wave, where trees had been uprooted and cleared from the valley sides well above the normal water line. Five years later in 1958 a cliff of relatively modest size became weak and collapsed into an Alaskan bay, the collapsed rock then produced a massive wave. The reality; debate will take place, no doubt, but


all these types of examples could be argued to have a form of “intangible possibility”. In simple terms, “intangible possibilities” can range from earthquake triggered tsunamis to coastal adjacent landslides that may result in tsunami waves, with the ability to crossing oceans far-off. Since we know this could happen, we should design and prepare for such significant events at coastal locations by appropriate measures, but also to seriously consider re-assessing our nuclear sites where we think they may be weak or vulnerable, including the robustness of their reactor plant and its containment design. The nuclear containment’s design and its allied engineering must be able to initially tolerate and ultimately withstand postulated initiating events that should include “intangible possibilities”, making sure it can perform its intended functional design, References 1 and 2. Acceptance that we must do something to protect ourselves is of absolute priority when it comes to potentially unstoppable natural hazard events that may be perceived as “intangible possibilities”.

More broadly, we should better recognise how active our earth actually is and where our nuclear sites are located. Limited vision and holistic thinking tends to diminish our overall awareness and focused attention to such things as the “intangible possibilities”. And the real mindset problem with such “intangible possibilities” is that they cannot be easily included in PSA-like probabilistic models that by definition depends on available empirical evidence and data, yet useable data and information may well not be available or immediately identifiable without indepth and time consuming research. I would suggest that this implies that we need to take a more holistic view when carrying out our site, plant and containment design, together with the PSA modeling, thereby ensuring that we do not have another accident like those that have happened at TMI, Chernobyl, and now especially FD. Further, I would suggest that consideration should be given to a potentially radical notion for a “no accident is tolerable” approach, introduced by Visser in 1991, Reference 8, to be adopted for the type of consequence associated with extremely dangerous accident scenarios. When accounting for the postulated initiating events, in the future we should not only address the probables, but also the possibles, that may have previously been judged to be unexpected, unforeseen or ‘incredible’. In the search for a “no accident is tolerable” approach, Reference 8, we will need to be holistically wiser, while opening our minds to both the tangible ‘facts’ (that we have always been used to addressing with our past mindset), but also accounting for other less clear and apparent intangible ‘signs’ that could evolve through an event


sequence to a severe accident scenario that we may have dismissed or ignored in the past, and could undermine all the defence in depth logic by simply bypassing the protective barriers. In addition, our safety-led defence in depth methodology will also need to be extended for postevent protection, mitigation and intervention strategies. The aspiration for a “no accident is tolerable” concept put forward by Visser, Reference 8, could be perceived as being quite different to broad acceptance for a minimal probability of risk in terms of the tolerability of risk philosophy, Reference 9, although the raw truth is they are effectively one and the same concept when considering extreme accident consequences, as experienced with the FD nuclear plant in 2011. Hence, I would suggest that we need to consider and debate whether to take a more holistic view related to nuclear containment design and engineering, while achieving enhanced defence in depth against the uncontrolled release of accidental radioactive fission products; not only for the reactor plant, but also for the power plant’s site as a whole. We should more broadly take account of the post-accident recovery actions in terms of the emergency planning, as advised from the Level II PSA modeling that has been concluded following the FD lessons learnt, Reference 5. Therefore, a fundamental question which I believe needs to be asked is whether our plant-site design solutions should conceptually expand the civil containment boundary, with more barriers to supplement the present style of containment engineering. A new style of plant and site containment engineering needs to cater for not only the accident and severe accident, natural external hazards like tsunami water inundation, but also the post-accident recovery actions when the mitigation and intervention planning comes into action. This also raises the need to account for the broad possibility of water inundation and debris damage on a colossal hydro-dynamic scale, and for which the containment will need to confidently survive, sustaining its intended design function, References 1 and 2.

If we presume global warming to be a growing reality, climate change and rising sea level highly likely, then most certainly all forms of storms, floods and other “intangible possibilities” previously considered incredible will occur and exhibit greater destructive effect over and above our nuclear plant / site present design base technical parameters and criteria. Of particular concern for our existing nuclear facilities may be the postulated initiating events of large tsunamis caused by severe earthquake or landslide previously not recognised in either the deterministic design or the reliability / PSA modeling. A key added problem also exists at coastal


sites where any nuclear fission product releases can readily travel into the water body and can be transported on sea / ocean currents many thousands of miles from source, and can enter human community food chains. The design function of a nuclear containment to mitigate harmful radioactive release becomes very difficult to achieve and confidently justify if a similar scenario were to happen like at FD on the 11th March 2011. In the case of regions with very short prewarning times when people might not be able to evacuate quick enough, and where safety-critical infrastructure like coastal sited nuclear plants could be endangered, we need to identify these possible sites and enhance the design of their hydro-dynamic defences. A quite complex consideration is to take account of future hydro-dynamic design requirements for nuclear plantsites, recognising that the plant’s civil containment design is a key defence in depth imperative, while applying a more holistic design approach. The nuclear containment’s deterministic design and its assessed reliability against release of harmful radioactive fission products and substances is a crucial part of this holistic view to question whether the containment is achieving its design function, References 1 and 2. It has become painfully apparent on the 11th March 2011 that we do not always adequately model what happens beyond the design basis with severe accidents. The fundamental problem here is that we could be ill prepared and inefficient in our attempt to plan accident emergency arrangements, while ultimately running the risk of not being able to effectively mitigate the consequences and apply the appropriate intervention measures (like adequate public evacuation and reinstatement of necessary uncontaminated food and water). FD has emphasised this major concern. Real-world information about accidents should be more carefully interrogated and analysed in order to improve our plant-site civil containment designs in the future, while the PSA modeling will include the “tangible probabilities”, but also needs to address the uncertainty derived from other “intangible possibilities” that are much less clearly quantified. Addressing other “intangible possibilities” that imply beyond design basis modeling becomes an uncertain science. For example, non-linear behavior becomes a very real issue, then the complex physical geometries and configurations that exist at a plant and its site will need to be carefully considered, together with the effect of gravity and complex hydro-dynamic characteristics that will include a directional orientation. All these factors combine together to introduce a highly randomised collection of event sequences which result in many final scenarios that need to be prepared for by the emergency recovery teams. With the disaster data and information available from 11th March 2011 in Japan we must now aggressively question if our


design basis configurations are indeed wisely established and right, accounting for the probable and the possible, both probabilistically and deterministically. We need to better model and understand what happens beyond the design basis accidents using our deterministic and probabilistic tools. Any future nuclear power plant-site designs will therefore need to retain a more holistic understanding of the overall damage and hazard caused, together with the credible mitigation and intervention strategies that better addresses the accident and severe accident scenarios. A crucial structure of the nuclear power plant design is the nuclear containment and its design function, which should now be re-assessed having experienced the FD disaster, while our knowledge about all the containment issues, factors and criteria for accident and severe accident scenarios need to be seriously reviewed from a more holistic viewpoint accounting for the probable and possible. The process of investigating accidents and learning from them is absolutely crucial and key to improving our containment designs into the future. Using past accident information as a knowledge benchmark of lessons learnt should help guide us on how best to improve containment design, standards and best practice. Applying the techniques advocated by Rasmussen and Svedung, Reference 10, could prove very helpful with such investigations. The deterministic and probabilistic analytical tools we use to model and predict a design’s ultimate resistance to tolerate the various design loads should be applied in a much more holistic manner that accounts for the initiating event probabilities and possibilities. To enhance nuclear containment design and engineering into the future, it is recommended: 

To take account of the probable and possible initiating events, while assessing the significance of “intangible possibilities” that may be over and above what has been previously considered in the plant and containment design basis.



To consider expansion of the containment bounds of a proposed plant siting, where lake, river, sea or ocean could retain “intangible possibilities” not immediately identified, and especially where transport of harmful releases can harm the community and environment far beyond the site’s immediate locality.



To investigate the development for a more holistically based approach to containment design requirements for extending the containment boundary zone for defence in depth.



For the whole site to be designed such that it can control, tolerate and withstand natural external hazards that involve hydro-dynamic mass-flow due to extreme floods and tsunami, weight loads with massive inundation characteristics; {with the modeling


projections addressing the whole range of mitigation, intervention and emergency recovery measures}.

References 1 IAEA Safety Standards Series Requirements, Safety of Nuclear Power Plants: Design, No. NS-R-1, 2000. 2 IAEA Safety Standards Series Guide, Design of Reactor Containment Systems for Nuclear Power Plants, No. NS-G-1.10, 2004. 3 A Discussion of the Use of Finite Elements to Analyse Safety-Critical Concrete Structures, Smith P.C., Owen D.R.J. and Bicanic N., 14th International Conference on Structural Mechanics in Reactor Technology (SMIRT 14), Lyon, France, August 1722, 1997. 4 Code of Federal Regulations, Title 10, Energy, Part 50, Domestic Licensing of Production and Utilization Facilities (10 CFR Part 50), U.S. Nuclear Regulatory Commission, Washington, DC. 5 Japanese earthquake and tsunami: Implications for the UK nuclear industry, Final Report; HM Chief Inspector of Nuclear Installations, UK’s Office of Nuclear Regulation, ONR Report ONR‐FR‐REP‐11‐002 Revision 2, First published September 2011. 6 IAEA Defence in Depth in Nuclear Safety, INSAG-10. 7 “A Theory of Human Motivation”; A. H. Maslow, Psychological Review, 50, 370-396, published in 1943. 8 Visser, J.P. (1991): Development of Safety management in Shell Exploration and Production. Contribution to ’91 Bad Homburg Workshop on Risk Management. Published in: Brehmer, B. and Reason, J.T. (Eds.): In Search of Safety. Hove, UK: Lawrence Earlbaum. 9 The tolerability of risk from nuclear power stations. Health and safety executive, HMSO, ISBN 0 11 886368 1, 1988 (Revised 1992). 10 Proactive Risk Management in a Dynamic Society, Jens Rasmussen, HURECON, Smørum, Denmark and Inge Svedung, Risk Center, University of Karlstad, Swedish Rescue Services Agency, ISBN: 91-7253-084-7 © Räddningsverket 2000.
