Design basis and beyond-design-basis events

Lise Fortin starts Hana's second week with a list of about forty events on a whiteboard, from a turbine trip to a large earthquake. "Every one of these has to be in the safety analysis report," she says, "but not in the same way. Some happen several times in a plant's life. Some may never happen anywhere. The design has to cope with the first kind with no damage at all, and with the rarest kind by keeping the consequences as small as reasonably possible. Sorting events into categories is the first thing a safety analyst does." The list includes events that TVA's own plants have seen, such as a loss of a main feedwater pump, alongside events that have only ever been analyzed.

Plant states and the idea of a design basis

Safety analysis considers the full range of plant states. Normal operation includes startup, power operation, load changes, shutdown and refueling. Anticipated operational occurrences are departures from normal operation that are expected to happen at least once in the life of the plant, such as a turbine trip, a loss of one feedwater pump or a loss of normal electrical power. Design basis accidents are less frequent events that the plant is designed to withstand with its safety systems, within defined limits on damage and dose. Beyond design basis conditions are more severe or rarer still: multiple failures, or events larger than those assumed in the design. Severe accidents are the subset in which the core is significantly damaged.

The design basis is the set of conditions and events that the plant is explicitly designed to withstand, together with the methods and acceptance criteria used to show that it does. It has two parts: the internal events, such as equipment failures and pipe breaks, and the hazards, such as earthquakes, floods, high winds, fires and aircraft impact. For each design basis event the safety report shows, with conservative analysis, that the safety systems keep the fuel, the pressure boundary and the containment within their limits and that the dose to the public stays below a prescribed value.

The NRC uses the term beyond-design-basis events for events outside the design basis. Several are addressed by specific rules even though they are not design basis accidents: anticipated transients without scram (10 CFR 50.62), station blackout (10 CFR 50.63) and, since 2019, the mitigation of beyond-design-basis external events (10 CFR 50.155). Internationally, the IAEA calls these design extension conditions.

Frequency and consequence

The guiding rule of event categories is simple: the more frequent an event, the smaller its allowed consequences must be. An anticipated occurrence that happens every year or two must cause no fuel damage at all and no release beyond normal limits. A design basis accident that might happen once in ten thousand reactor-years may cause limited fuel damage and a small release, provided doses stay below a regulatory limit. Events rarer still are addressed by reducing their frequency and mitigating their consequences as far as reasonably practicable. Plotted on a graph of consequence against frequency, the acceptance limit is a falling line, and every event must lie below it.

US practice, following the American Nuclear Society's conditions, has traditionally classified events into normal operation, incidents of moderate frequency, infrequent incidents and limiting faults. Each class has its own fuel and dose acceptance criteria in the standard review plan, and dose limits for limiting faults are given in 10 CFR 50.67 and the site criteria of 10 CFR 100.

# Classify events by frequency into the categories used in safety analysis.
# Boundaries follow the usual order-of-magnitude scheme (illustrative values).
events = [
    ("turbine trip", 1.0),
    ("loss of normal feedwater", 0.1),
    ("loss of off-site power", 3e-2),
    ("small pipe break", 5e-4),
    ("steam generator tube rupture", 3e-3),
    ("large pipe break", 1e-5),
    ("station blackout lasting 24 h", 1e-6),
]
def category(f):
    if f >= 1e-2: return "anticipated operational occurrence"
    if f >= 1e-5: return "design basis accident"
    return "beyond design basis"
for name, f in events:
    print(f"{name:32s} {f:8.0e} per year  -> {category(f)}")

turbine trip                        1e+00 per year  -> anticipated operational occurrence
loss of normal feedwater            1e-01 per year  -> anticipated operational occurrence
loss of off-site power              3e-02 per year  -> anticipated operational occurrence
small pipe break                    5e-04 per year  -> design basis accident
steam generator tube rupture        3e-03 per year  -> design basis accident
large pipe break                    1e-05 per year  -> design basis accident
station blackout lasting 24 h       1e-06 per year  -> beyond design basis

The classification is approximate: the boundaries between categories differ between regulators, and an event's frequency is itself uncertain. A steam generator tube rupture, for example, has occurred several times in the world's fleet, so its frequency is around one in a few hundred reactor-years, and it is usually analyzed as a design basis accident with tighter criteria than a large pipe break. The program places events in categories with simple thresholds so that the logic is visible; real safety reports justify each event's category individually.

Initiating events

An initiating event is any occurrence that disturbs the plant and requires a response from control or safety systems. The safety report must show that its list of initiating events is complete enough. Analysts build the list from several sources: a systematic review of every plant system and what happens if it fails, operating experience from the plant and the world fleet, the generic lists published by regulators and industry groups, and hazards studies. Initiating events are then grouped into families that produce similar plant responses, so that the analysis can focus on the bounding member of each family.

Conservatism and the single failure

Design basis analysis is deliberately conservative. The analyst assumes the most limiting initial conditions allowed by the operating limits: power at the top of its uncertainty band, the hottest fuel, the least favorable coolant temperature and pressure. The analyst also assumes the worst single failure in the safety systems, in addition to the initiating event, and often a loss of normal off-site power at the same time. Operator actions are credited only after a delay that allows for diagnosis. The result is a calculation that bounds the real plant behavior with margin, so that uncertainties in models and data are covered.

Conservatism has a cost. A heavily conservative analysis can hide which features really matter, and it can lead to operating restrictions that do not improve safety. Modern practice therefore uses best-estimate models with a quantified treatment of uncertainty, so that the result is a high-probability bound rather than a stack of pessimistic assumptions. Lesson 3 describes both approaches. Either way, the point of the analysis is to show that the plant meets its acceptance criteria with a clear margin for every design basis event.

Hazards

Hazards are events that originate outside the systems being analyzed but can affect several of them at once. Internal hazards arise inside the plant: fires, internal floods from a burst pipe, high-energy line breaks that release steam into a room, missiles from a failed turbine, and heavy load drops. External hazards come from outside the site boundary or from natural phenomena: earthquakes, floods from rivers, lakes or the sea, extreme winds and tornadoes, extreme temperatures, ice storms, lightning, and human-induced events such as nearby industrial explosions or aircraft crashes. Hazards matter because they can cause common-cause failures that defeat redundancy.

For each hazard the design sets a design basis level, usually with a very low annual frequency of exceedance. A seismic design basis earthquake, for example, is typically chosen so that stronger shaking is expected less than about once in ten thousand years at the site. Safety-related structures and equipment are qualified to withstand that level with margin. Beyond the design basis level, the question becomes how much margin the plant actually has and what happens when it is exceeded. Fukushima Daiichi was designed for a tsunami of a few meters; the tsunami of 11 March 2011 was more than twice as high.

TVA's hazards include tornadoes and severe storms, river flooding and upstream dam failure, and the seismic hazard of the southeastern United States, including the East Tennessee seismic zone. After Fukushima, the NRC required US licensees to reevaluate flooding and seismic hazards using current methods.

Beyond the design basis

No plant can be designed to withstand every conceivable event. Beyond the design basis, the safety strategy changes from showing that limits are met to showing that the plant has margin, that cliff-edge effects are avoided and that there are means to prevent and mitigate severe accidents. A cliff edge is a point where a small increase in the severity of an event causes a large jump in consequences, such as a flood wall that holds until the water is one centimeter higher and then lets the whole site flood. Stress tests carried out after Fukushima looked for exactly these cliff edges.

The measures beyond the design basis include extra equipment that is not credited in the design basis analysis, such as portable pumps and generators; procedures and guidelines for accident management; strengthened containment features such as filtered vents and hydrogen control; and emergency preparedness off site. Probabilistic safety assessment, introduced in lesson 6, is the tool for estimating how likely beyond-design-basis sequences are and which measures reduce risk most.

Grouping and bounding events

No analysis can treat every conceivable event individually, so analysts group initiating events with similar effects on the plant and analyze a bounding case for each group. A family of small pipe breaks of different sizes and locations, for example, is represented by a few break sizes chosen so that each analyzed case is at least as severe as the others in its group for the acceptance criterion of interest. The grouping must be justified, because a break that seems small and benign may challenge a different safety function, such as the ability to depressurize, more severely than a larger one. Grouping also feeds the probabilistic assessment, where each group becomes one initiating event with a combined frequency.

The list of events is refreshed throughout a plant's life. Operating experience from the plant itself and from the worldwide fleet reveals new initiators, such as a loss of instrument air or a partial loss of a support system, that earlier lists did not include. Periodic safety reviews, carried out about every ten years in many countries, revisit the event list, the hazards and the analysis methods against current standards. A design basis is therefore not fixed at licensing but evolves as knowledge improves.

Beyond-design-basis events also need a defensible boundary. It is not possible to design for every extreme, so analysts use probabilistic arguments to screen out events that are extremely unlikely, deterministic arguments to show that some sequences are physically impossible, and margin assessments to show that the plant can withstand loads somewhat beyond its design values without abrupt failure. The aim is to avoid cliff edges, where a small increase in a hazard leads to a large change in consequences, as happened when the Fukushima tsunami overtopped the site.