E-Journal of Advanced Maintenance Vol.8 No.4 (2017) 57-65
Japan Society of Maintenology

Development of Resilience Evaluation Method for Nuclear
Power Plant(Part 4: Concept of System Safety on Operating Nuclear Power Plant)

Hosei University
University ofTokyo
University ofTokyo
Osaka University
Atomic Energy
Society of Japan
Mitsubishi
Research Institute,
Inc.

Hiroshi, MIYANO
Akira, YAMAGUCHI

MemberNon-member

Kazuyuki, DEMACHI

MemberTakashi, TAKATA
Shigeki, ARAI

Non-member
Non-member

Naoki, SUGIYAMA

Non-member

Abstract
The total system design of a nuclear power plant ensures "Nuclear safety" through making practically achievable
efforts to prevent and mitigate nuclear and radiological accidents. The performance based system design with "Defense
in Depth (DID)" has been laid out as the key means to "preventing accidents", "controlling escalation to serious
consequences", and "mitigating impact to the public". DID is extended to the management of severe accidents, and is anapproach intended to provide protection against the development of a wide variety of events by means of redundant,
diverse and independent protective barriers.
By combining the concepts and risk assessment discrete "Defense in Depth", it can be expressed as a risk level
corresponding to the degree of each layer of the DID. A Situation that exceeds the normal operation becomes anabnormal situation in which more than even the design criteria, various AM measures are taken. The ability of theresilience to recover the function until the required function, and quantified in risk level as a safety corresponding
capability of the system, are expressed as a resilience index.
By using the resilience index, safety capability of the plant system can be quantitatively grasped, that whether thesafety by the AM measured is how much improvement, what is good to select which means, etc. it can be used for thedecision.
Keywords: Resilience Index, Safety Assessment, Severe Accident, Accident Management, and System Safety
hit nuclear power plants in five locations in the Tohoku region.

1. Introduction

Reactor No. 1 of the Tokyo Electric Power Company in

In Japan, there is the threat of a variety of natural disasters.

Fukushima released a large amount of radiation which became

On July 16, 2007, an earthquake occurred in Niigata-ken

an unprecedented major accident.

Chuetsu-oki and the TEPCO Kashiwazaki-Kariwa nuclear

The Society experienced how the risk of nuclear power canpower plant was affected. Following the sensational headlines ofbe actualized. It revealed that an earthquake can cause a serious

a nuclear power plant disaster that showed a video of adisaster, not only by vibration propagation, but also othertransformer on fire, a feeling of insecurity among the general

phenomena that accompany such an event, for example,

public concerning the safety of a nuclear power plant, whentsunamis and landslides. This new experience led us think about

faced with an earthquake, has spread. However, a subsequent

our commitment to risk when it comes to natural disasters.

investigation of the Kashiwazaki-Kariwa nuclear power plantContact: Hiroshi Miyano, R1309, Hosei University
Graduate School of Design Graduate School ofEngineering, 72-21 Horikawa-cho, Saiwai-ku,
Kawasaki-shi, 212-0013
E-mail: hiroshi, Miyano.77@hosei.ac.jp

on nuclear safety revealed that all of the units were stopped
safely, and that no particular problem arose because of this.
On the other hand, on March 11, 2011, a tsunami, which was
generated by an earthquake of magnitude 9 off the Pacific coast,57

H. MIYANO, et al./ Development of Resilience Evaluation Method for Nuclear Power Plant(Part 4: Concept of System Safety on Operating Nuclear Power Plant)

The Fukushima Daiichi nuclear power plant accident clearlyfunctions, the reliability of safety functions maintenance isshows that the use of nuclear energy is accompanied by risk andevaluated. The deterioration of a function, as a system,that the nature of the threat or how to prevent it from developing

according to the deterioration and lifespan of materials, isinto a nuclear accident at a power plant is an important issue.

evaluated, and according to this one can then ask as to how

Furthermore how to prevent the development of the nuclear

much reliability has been reduced. Thus, as a response to when

accident caused by a variety of natural phenomena, has become

the system is operational, through incorporating elements ofan important problem.

conservation, what kind of conservation in reality - replacement

Previous designs decide the specifications required for theof material, inspection and the improvement of the equipment -equipment according to safety design by performing reliably toshould be installed in order to prevent the deterioration of

ensure design criteria where the most important aspect is that thefunction, and as to whether or not it is possible to indicate thatsafety of nuclear energy is assured. Such a design has significant

reliability is assured.

limitations.
Scope of Application
IAEA Defence In Depth (DID)

From now on, the design, normal operation, detection ofabnormalities, how to respond to abnormalities, will accord to

Hazard Assessment

levels; ranging from the first level of "defense in depth" inExternal Event(Natural Disasters)

response to a situation that exceeds the design criteria along with

Internal Event(LOCA, etc )an emergency response (Disaster Prevention) up to the fifth
level, where an equal amount of safety design is required. The
design will be obtained with the aim of optimizing the system as
a whole where it defines the common evaluation index. This

Fragility Evaluation
Safety Function
System Configuration
Structures
Components
MaintenanceDegradation
Human Factor
Inspection andMonitoring
Replacement andUpdateAging

Beyond of
Design Bases

Design Region

Scenario of Event‐ Accident Sequence

Safety Evaluation
Loss of Function

Evaluation of DID Level 4
and Level 5

Evaluation of DID Level 1‐3

will provide a safer system. In addition to post-accident response
and recovery, it is important that those aspects related to safety

Fig. 1 Concept of Safety Evaluation on Design Phase andgo on to include reconstruction, also. This recovery, entire

Beyond Design Phase

reconstruction, and the consideration in advance of including the

When dealing with an area of response to a situation that

accident occurrence factors that lead to the accident, form theexceeds the limit of the design, working on the assumption thatbasic concept of nuclear safety resilience – a new design

natural phenomena are also unpredictable situations, that go

proposal.

beyond previous assumptions, that is, situations that exceed the

2. System safety concept

design condition limits, a response should show that a variety of
preventative measures leading up to an accident at a nuclear

The boundary between labor and safety has become

power plant are being taken. Situations that exceed the design

ambiguous, and adds to the important task of responding tonatural disasters.

limits are not uniformly specified. Assuming a variety of factors,

At nuclear power plants, where safety

it is necessary to consider measures for a variety of possible

measures have become more complex, the securing of "nuclear

scenarios. When taking measures following such situations, we

safety" as a system of the entire power plant must be considered.

must ensure safety to obtain sufficient resistance.

Regarding the systematic checking of safety, see Fig. 1 below
for an overview of the structure [1].

3. Safety as a result of "defense in depth"

Regarding the category of design, there is a mechanism toevaluate whether the safety aspects of a nuclear power plant are"Defense in depth" is the most important and basic idea orbeing properly maintained or not. In other words, resistanceconcept concerning "nuclear safety", and it has been recognizedagainst natural disasters is required, especially in a country suchas a common concern throughout the world. The idea is to offer

as Japan that experiences earthquakes and tsunamis, volcanic

an effective and a variety of realistic strategies, along with theiractivity - where these hazardous threats may damage a nuclear

appropriate combinations to ensure safety. Both up until now,

power plant. When looking at the basic safety functions thatand in the future, the significance and role of these strategies will

nuclear power plants have as a system, together with related

not change. Insight into "defense in depth" and a risk assessment
58

H. MIYANO, et al./ Development of Resilience Evaluation Method for Nuclear Power Plant(Part 4: Concept of System Safety on Operating Nuclear Power Plant)

relating to combined beneficial safety can be obtained. [2]Earthquake, showed us that insufficient strategy towards

3.1 Nuclear energy and safety assurance

unexpected situations can cause severe accidents. The defense in

Basic nuclear power safety, originally, is to effectively

depth indicates the most important concept of ensuring thatminimize the amount of risk that human beings could besafety from the viewpoint of preventing nuclear accidents andexposedoffrom the objective of safety, which must be observed eventuallyinherently dangerous radioactive substance that is released

from the point of view of the countermeasures towards thosethrough the environment or comes into direct contact with

events, when it was designed, within the ranges of assumed

people.

designs and beyond the ranges of the design condition. This idea

to

when

there

is

a largeamountMany facilities, within the system and their design, preventof ensuring safety is applicable to other situations, and not only

the damage or destruction of equipment, of course, and for the

nuclear power equipment per se.

people who use them. Sufficient consideration is taken into

This intends to minimize the possibilities that may lead to aaccount so as not to adversely harm those in the vicinity. In

nuclear accident, by not only taking previous assumptions

many cases, the inclusion of quality management and design

which were considered in the design and ensuring definite safetyaccording to stringent conditions are implemented to securein the designed conditions, but by also, implementing the safety"nuclear safety." Design and construction of a nuclear power

measures in case of a situation that exceeds the design

plant, day-to-day operational management and security haveconditions.

been ensured in the following manner.

In this way, a situation where nuclear facilities are thought to

3.2 Ensuring safety in a nuclear power plantdesignhave caused contamination to people or the environment via

Firstly, from the viewpoint of preventing an abnormal

whereby even if the accident exceeds the limit of the design, it

occurrence, sufficient margins and quality assurance andshould be possible to reduce the possibility of a nuclear accident

improved inspection tests are included. Secondly, when it comesoccurring using an appropriate response. Furthermore, in theto full monitoring of abnormal occurrences, furnaces arecase that a nuclear accident has occurred, people affected in the

stopped in the first instance, thereby preventing the spread of ansurrounding areas, in addition to a "disaster prevention"

abnormal accident. Thirdly, in the event of a situation that may

response that can protect people in a number of ways, a safety

lead to an accident, in order to reduce the influence of themechanism that is responsive from a number of viewpoints is

accident to that of minor, sufficient cooling and the successful

known as "defense in depth."

confinement of radioactive materials is carried out. As a result,

3.4 Ensure its effectivenessradiation, it is eliminated by an effective planned response,in order to prevent a nuclear accident - following a nuclear

There are some difficulties in the implementation of theaccident, radioactive substances are released from the facility toprotection level setting and safety measures being based on thisthe outside, and this will relate to the affects radioactive

because of natural phenomena. It is difficult to foresee thematerials may have on people - a variety of measures are put incountermeasures of an abnormal situation, for example the leadplace. In this way, because of "multiple protection", nuclear

up to an accident which exceeds the design criteria. In otherpower is "safe."words it is difficult to cover all of the possible scenarios that canoccur under accident management (referred to as AM.)

Both of these are mechanisms of defense in depth found in
the design of a nuclear power plant, and are mechanisms that

For example, when it comes to flexibility with portable

have been set in place in order to avert an accident within an

equipment, it is thought that having a flexible response is

expected range.

effective, but on the other hand, in order to proceed with a

3.3 Countermeasures to a situation which
exceeds the design conditions

variety of accident management measures (AM measures),

The essence of defense in depth is to consider theand the people, appropriate judgment and leadership are what isability and responsibility that is responsive to the organization

countermeasures in the event that assumptions are exceeded.

required.

That countermeasure against the tsunami, which wasexcessively beyond expectation in the Great East JapanAs for the implementation of AM measures in a state59

H. MIYANO, et al./ Development of Resilience Evaluation Method for Nuclear Power Plant(Part 4: Concept of System Safety on Operating Nuclear Power Plant)

whereby a severe accident has actually occurred, it is also clear

considered, up to the third layer of the "defense in depth" safetythat there are a number of difficulties when it comes tomechanism, to be important, and the basis of the design for

implementation. For instance, there is a limit in time and spacedetermining the "design basis" has had an important position.

to permit a variety work carried out in a high radiation

Equipment design utilizes layers one through three of defense inenvironment, which causes serious constraint for the operators

depth, and in these, through the provision of equipment ofin the control room. Moreover, some scenarios prepared as AM

appropriate specification, a plant system that meets themeasures cannot always be implemented under certain accident

requirements of safety, is built, thus making up the structure.

conditions.

With this, the aim has been to reliably maintain nuclear safety.

In order that "defense in depth" be the principle of nuclear

In Table 1, an important feature to ensure nuclear safety,

safety, it is necessary to organically combine training andnamely, front system function, boundary function (to confine),

exercises so as to ensure the effectiveness of AM measures andcooling function (to cool), the control function (to stop), otherdisaster prevention - along with a large number of factors suchsupport systems and examples of apparatus and systems to

as constant review of those mentioned above, and additionally,

consist it is shown with the classification of safety function of

the carrying out of multiple and diversified safety, including

Prevention System (PS) and Mitigation System (MS).

Table 1 Basic Safety Function and Systemapplied to DID

both on and off-site.

4."Nuclear safety" in the system design

Defense-indepth level

4.1 Defense in depth in the design

Level 1
Normalconditions

A Nuclear power generation system is designed, built andoperated based on the specification request just the same asother general products. Its reliability and safety, is ensured basedon the theory, law and regulatory standards. The idea of theLevel 2Prevention

Boundary

CoolingPreventing proliferationof fission products in the
coolant (PS)Radioactive materials storage(PS)
Coolant pressure boundary(PSContainment of reactor coolant(PS)
Maintenance of reactor coolant(PS)
Radioactive materials storage(PS)
Closure of safety relief valve(PS)
Over pressure protection of
coolant pressure boundary(MS)

Maintain coregeometry(PS)
Reactor core coolingunder normal
conditions (PS)

Prevention of excess
reactivity (PS)
Circulation of reactor
coolant (PS)Heat removal afterreactor shutdown (MS)
Safety shutdown
functionsoutside control room
(MS)

Emergency reactor
shutdown (MS)Maintain sub-criticality(MS)

Containment of radioactive
release [PCV] (MS)Core cooling (MS)Mitigation of reactor
pressure increase(MS)

Maintain sub-criticality(MS)
Controlling power output
increase (MS)Radioactive releasecontainment [reactor building,gas treatment] (MS)Severe accident management[PCV event] (MS)Severe accident
management[Make Up Water
System, FP systems](PS)

Severe accidentManagement (MS)foundation is thought to ensure a "nuclear safety" and theensuring method by "defense in depth". Thus, each organization

Level 3
Mitigationmust play their part in recognizing a mechanism such as this.

Level 4
Accident
Management

The design can be defined to apply appropriately with theoperations which are assumed at that time, to ensure safety at theControlCommonCommon factors forLevel 2 & 3• Issuance of signals toactivateengineered safety facilities/
components & reactor
shutdown systems (MS)• Safety significant items (1)(Emergency onsite powersystems) (MS)• Safety significant items (2)(Control room) (MS)• Safety significant items (3)(reactor auxiliary coolant
systems) (MS)• Safety significant items (4) DC
power systems (MS)Level 5
Accident
Management

nuclear facilities in use and be verified using analyticalevaluation in order to confirm the soundness of the equipment to

There has been no definite concept in general, so far, thatsatisfy the required performance based on the specification

copes with a variety of events, especially for external naturally

request and to ensure “nuclear safety.” Thereby manufacturing

occurring phenomena. If you look at the equipment design onequipment and construction, also planning in order to operate

ground motion, based on the various ideas in academia, as aand maintain, and modifying the whole, design books should becomprehensive response, it defines a method for evaluating thecompiled as drawings and instructions.

soundness of the equipment which can determine the size of

4.2 The basic approach to design criteria anddesignground motion. The criteria used in the design has been
considered as follows. Considering conservatively the threat of

In nuclear power plant equipment design, the safety design isnatural phenomena to the extent that it is scientificallyprocessed in conjunction with the core design as part of the

anticipated, based on past data, the design criteria has beensystem design. “Safety design” can be defined through thedetermined quantitatively in order to ensure the structuralmodification of the overall achievement to ensure nuclear safety

soundness, even in case of a situation that is beyond the criteria,

through the total levels of protection, by applying the concept offrom the viewpoint of uncertainty. Based on this criterion, the“defense in depth." Also, facilities design can be defined todesign was processed with ample margin. And, manufacturing

construct the plant facilities logically with feedback from them.

and construction were performed based on this design. Similarly,

Up until now, the design, the safety design, was primarily

a design based on data evaluation of other natural phenomena,60

H. MIYANO, et al./ Development of Resilience Evaluation Method for Nuclear Power Plant(Part 4: Concept of System Safety on Operating Nuclear Power Plant)such as; tornadoes, volcanic explosions, also threats such as

the criteria, the concept of "defense in depth" will be applied.

falling meteorites; and physical theory, must be performed.

This measure is known as "accident management" (AM).Within

4.3 The role of the safety design

the realm of AM, we allow for scenarios that exceed it, by

In a conventional nuclear power plant design, up until theproviding equipment following a plan that considers thethird layer of "defense in depth," firstly the "stopping", "cooling,

diverseness and uniqueness of a scenario. Then equipment thatand the assurance of front system "confinement" was the main

effectively uses AM measures is prepared. In particular, whenidea. However, regarding another important aspect, in responsemanaging an accident, at an abnormal time when a number of

to a situation involving loss of power, functions that govern such

facilities are not used on a daily basis, a variety of scenarios area situation and the support system function, it is important toconsidered and exercises and training must be reinforced.

adequately respond to the front system.

5. System safety

Regarding the safety design of nuclear power plants,

5.1 Structure and functions necessary for"nuclear safety"

harnessed system design and a design that satisfies system
function, required in the safety design, must be carried out.

Table 1 shows the constructs that constitute necessary features

In the system design, equipment and piping design,of a nuclear power plant, its system and its instruments.

instrumentation and control and electrical design included, all of
the equipment is vital. In the system design, abnormal time, to

The basic elements required for design consist of: a boundary

ensure safety at the time of the accident including the powerfunction, a cooling function and a control function in

supply and the electrical system, further, it is important to work

conjunction with a power supply function (mentioned earlier).

on a comprehensive evaluation.

These are the important components necessarily underlying a
nuclear power plant. A nuclear power plant's design is made up

This kind of commitment to safety must always allow forof the maintenance of the appropriate inter-relationship of thesereview and be robustly responsive.
For safety design, facility design from the first layer of thefunctions. It is a system design. Thus for any given event within"defense in depth" to the third layer, and, of course, the fourth

the design criteria, the soundness of facilities and safety is

and fifth layers should be included. On top of that, theensured to be secured. This is the basic concept of system safety.

evaluation of required functions must be addressed also in order

On the other hand, in the event of a scenario that exceeds theto introduce the idea of "system safety" in the safety assessment.

design limit, because the response will differ depending on"In order to ensure the concept of "defense in depth," the safety

event and circumstances, all kinds of scenarios are important at

plan conforms to the whole of "defense in depth," and as

this level. In response to the unexpected, effective envisioning of

proposed in this series' paper, a mechanism built to enable thispossible scenarios and the preparation of a responsive coping

and for it to be carried out reliably is what is desired.

strategy will be necessary. Furthermore, by normalizing and

4.4 The role of AM measures

standardizing the equipment and procedures, a mechanism thatAs a plan basis, with a focus on the internal workings ofis systematically responsive is constructed.

5.2 Issues when preparing for an accident
1) Decisions "beyond the design basis"

LOCA, a plan that aims to ensure safety through the bolsteringof facilities has been carried out.
Natural phenomena are always accompanied by risk, andStructural integrity following seismic vibrations has become

while it is difficult to make an accurate assessment, we must

an issue. In other words, it means that seismic vibration intensity

fully understand natural phenomena in order to be able tohas slightly exceeded the reference value. For example, when aproperly evaluate the risk of a nuclear disaster. As for seismic

seismic vibration exceeds the level set by the part of a frequency

vibration, we started working on evaluating the risk of its after

band, or when the oscillatory waveform exceeds it momentarily,

effects, but just as with other events, a risk assessment must bethese are recognized as being threats to plant safety andcarried out.

structural soundness. Although seismic vibration at the

In order to reliably ensure safety, we must address anything

Kashiwazaki-Kariwa nuclear power plant, following thethat is likely to occur that has not been accounted for in the plan.

Chuetsu-oki earthquake, was more than three times the set level,

In other words, as a response to a scenario that has exceeded

it was confirmed that the soundness of the equipment was fully61

H. MIYANO, et al./ Development of Resilience Evaluation Method for Nuclear Power Plant(Part 4: Concept of System Safety on Operating Nuclear Power Plant)

intact. It was confirmed that the structural design for seismic

Degrees will vary, similar to those of ground motion, thus avibration had a more than adequately large margin. After that, in

response that assumes it will exceed these sizes is required. For anuclear power plants across the country, seismic vibration levels

variety of natural disasters, a creative approach is required.

we revised and set to a strict level, thus it can be confirmed that

However, in response to the unexpected, when it comes tothere is still a large margin. Simply put, while the margin for"defense in depth," a response that exceeds the design criteria

structural soundness has been well received, the margin for

can be carried out, for example, with respect to uncertain, newfunctionality is estimated to be even greater.

and big natural disaster threats, however, whether it can be said

We must rethink the meaning of "beyond the design. "Inthat measures can be taken, or that they are acceptable is aother words, even during the Tohoku-Pacific Ocean earthquake,difficult challenge. Whether or not there is a new hazard, orseismic vibration acceleration that just exceeded the set level at awhether the response measures are appropriate, it is always

number of nuclear power plants around the East Pacific Ocean

important to question and to continue making revisions.

Coast was observed. No effects presented themselves in the

6. Initiatives for a new system safety design

observed data of a power plant, and the time of earthquake
soundness of analytical estimations and from the history of other

Facility design is sought having been approved bypower plants, was also apparent in a report that was made by the

management, whereby management investigate equipment

Nuclear Regulatory Commission. Therefore, regarding adesign and disasters. But plant safety cannot fully address

scenario that exceeds the level of seismic vibration, it will notfacility design alone. The design, with AM measures, acrosssimply be a case of revising the, up till now, reference valuationdifferent disaster prevention measures, it is important toacceleration response, but we should discuss how the vibration

construct a concept of a new kind of nuclear safety withresponse effects the structural integrity and consider anfunctionality at its core.

appropriate method of evaluation.

Resilience: Extension of Defence‐in‐Depth

In addition, when setting a limit for tsunamis, from the• Response to & Recover from the accident• Preparation for the accident considering all phases(prevention, mitigation, response , recovery)measured height of the tsunami up to the point where it reachesTime

the power plant, from the least amount of time that it takes,

Defence‐in‐Depth

Crisiswhen it is a tsunami that exceeds a set height, we can prepare a

Equipment & procedures
to maintain effectivenessof safety barriers

Level 1equilibrium

response measure and change when to initiate it.

Level 2

PrepareAcceptable level
to resume operation
Difference in “resilience”

Control of abnormal
event

Therefore, we must set a limit which grasps and appropriately

Level 3judges as to "when it has exceeded the limit" and "to what extent

Control of accidents
within design basis

it has exceeded the limit." Having carried out accident

Mitigate

Recover
Response

Level 4Control of severe plantconditions

management (AM), this is an import decision to make.

(new) equilibrium
Design Basis

Difference in “resilience”

Level 52) In response to a scenario that "exceeds
prediction"

Mitigation ofradiological consequences

Acceptable level forregional continuity

Accident Level

It is said that the large tsunami that attacked our shores was

Fig.2 Concept of Resilience and D-I-D"unexpected." On the other hand, it is said that the "unexpected,"when it comes to nuclear safety, is impermissible. It is not easy

Design plays an important role. In order to properly maintainto predict a large tsunami that occurs perhaps once in a thousand"nuclear safety."

years. There is the complexity of wave design, from the

In order to properly maintain "nuclear safety," it basically must

movement of the earth's crust as well as seismic design, wave

be based on the safety design in accordance with the concept ofgeneration, propagation, run-up, post evaluation of floods and"defense in depth." The design, the response to the different

other phenomena, buildings, and then there is the complexity ofdimensions of level 1 - 5 of the IAEA's "defense in depth" haveequipment structural and electronic instrument design. A variety

been aligned and optimized and the mutual cooperation ofsimulations and estimates are carried out for a variety of tsunami

equipment design principles of level 1 - 3 and level 4 and thesizes. Even if the size is set, a tsunami that exceeds this may not

management principles of level 5 is important. There must be acome, but the guarantee of it not coming cannot be assured.
62

H. MIYANO, et al./ Development of Resilience Evaluation Method for Nuclear Power Plant(Part 4: Concept of System Safety on Operating Nuclear Power Plant)

safety mechanism that, as a system, combines functions

plant's system can be quantitatively grasped, and it is possible torequired by the plant.

see as to what extent safety, according to the AM measure, isachieved. Then, the best method can be chosen, which can thenbe used to inform a decision.

In the design of a nuclear power generation system, it is a

Acknowledgments

total system that takes into consideration a combination of theThis study is a part of the result of "Study of theentire system, such as the ground, buildings, equipment, piping,comprehensive safety evaluation method of the aging plant,"

electrical apparatus and instruments. From a total process(Mitsubishi Research Institute was commissioned by theperspective serving as a mechanism that takes into accountNuclear Regulatory Agency as aging technical evaluation

normal day-to-day running of the plant to a state of emergency,

business for innovation). Herewith, we would like to show ourmanagement consisting of all areas of "defense in depth," it is a

gratitude.

total management design that optimizes both software andhardware. Integrating all of these comprehensively, it needs to

Citationsbe a total design that has a holistic approach.

[1] Investigation Committee on the systematization of wave engineering

Measures that take into account a number of scenarios,

for Nuclear Safety: "Nuclear wave engineering for safety - afunction recovery measures should be prepared for in advance.

comprehensive technology system of the earthquake and tsunami

In fact, the size of the impact is expressed by the level of safety

defense" Japan Association for Earthquake Engineering, Nuclear

function, but corresponds to the reliability as a concept, which isSociety (2015).

[2] The Atomic Energy Society of Japan (2014): recommendations forthe opposite of risk value. It is the level of risk.
[3]

The basic concept of resilience from these normal

tomorrow and the first nuclear power plant accident - the whole"provisions" to "preventative measures," "grasping of thepicture of Fukushima, Society Gikocho report, Maruzen

conditions," "AM and recovery" and the "maintenance of a new

Publishing (2014).

[3] N. Sekimura, H Miyano, T Itoi,. "Resilience: Engineering: Newequilibrium state," point to a wide response. And this resilience
index, while considering these circumstances, shows to what

Discipline for Enhancement of Nuclear Safety", Short Paper ofextent each response measure's capability is. Starting with the

ICMST-Kobe 2014, pp.85-90, (2014)

evaluation of an abnormal occurrence, whether or not it leads to(27,7, 2016)

the occurrence of an accident, and the response that is taken
when an accident occurs, as a result, to what level is recovery
achievable. Then the efficacy of the processes which respond toa number of accidents are combined and an attempt is made toshow, as an index, to what extent a plant may be resilient.

7. Conclusion
By combining the concept and the risk assessment of discrete"defense in depth", the occurrence of a situation that exceeds thenormal operation, becomes an abnormal situation which
exceeds even the design criteria. A variety of AM measures aretaken and the amount of recovery resilience for necessaryfunctions, where the level of risk that corresponds to that degree
can be expressed. In this way the system's safety response
capability is quantified as a risk level, and an evaluation methodof necessary capacity for safety which appears as a resilience
index was proposed.
By using the index of such resilience, safety capability of the63

H. MIYANO, et al./ Development of Resilience Evaluation Method for Nuclear Power Plant(Part 4: Concept of System Safety on Operating Nuclear Power Plant)

Scope of Application
IAEA Defence In Depth (DID)

Hazard Assessment

Design Region

Scenario of Event

Fragility Evaluation

External Event(Natural Disasters)‐ Accident Sequence

Safety Function

Internal Event(LOCA, etc )Beyond of
Design Bases

System Configuration
Structures
Components
MaintenanceDegradation
Human Factor
Inspection andMonitoring
Replacement andUpdateAging

Safety Evaluation
Loss of Function

Evaluation of DID Level 4
and Level 5

Evaluation of DID Level 1‐3

Defense-indepth level
Level 1
Normalconditions

Level 2Prevention

Level 3
Mitigation

Level 4
Accident
Management

Boundary

CoolingPreventing proliferationof fission products in the
coolant (PS)Radioactive materials storage(PS)
Coolant pressure boundary(PSContainment of reactor coolant(PS)
Maintenance of reactor coolant(PS)
Radioactive materials storage(PS)
Closure of safety relief valve(PS)
Over pressure protection of
coolant pressure boundary(MS)

Maintain coregeometry(PS)
Reactor core coolingunder normal
conditions (PS)Control
Prevention of excess
reactivity (PS)
Circulation of reactor
coolant (PS)Heat removal afterreactor shutdown (MS)
Safety shutdown
functionsoutside control room
(MS)

Emergency reactor
shutdown (MS)Maintain sub-criticality(MS)

Containment of radioactive
release [PCV] (MS)Core cooling (MS)Mitigation of reactor
pressure increase(MS)

Maintain sub-criticality(MS)
Controlling power output
increase (MS)Radioactive releasecontainment [reactor building,gas treatment] (MS)Severe accident management[PCV event] (MS)Severe accident
management[Make Up Water
System, FP systems](PS)

Severe accidentManagement (MS)Level 5
Accident
Management

64

CommonCommon factors forLevel 2 & 3• Issuance of signals toactivateengineered safety facilities/
components & reactor
shutdown systems (MS)• Safety significant items (1)(Emergency onsite powersystems) (MS)• Safety significant items (2)(Control room) (MS)• Safety significant items (3)(reactor auxiliary coolant
systems) (MS)• Safety significant items (4) DC
power systems (MS)８

H. MIYANO, et al./ Development of Resilience Evaluation Method for Nuclear Power Plant(Part 4: Concept of System Safety on Operating Nuclear Power Plant)

Resilience: Extension of Defence‐in‐Depth• Response to & Recover from the accident• Preparation for the accident considering all phases(prevention, mitigation, response , recovery)
Time
Defence‐in‐Depth

CrisisEquipment & procedures
to maintain effectivenessof safety barriers

Level 1equilibrium

Level 2

PrepareAcceptable level
to resume operation
Difference in “resilience”

Control of abnormal
event

Level 3Control of accidents
within design basis(new) equilibrium
Design Basis

Mitigate

Recover
Response

Level 4Control of severe plantconditions

Difference in “resilience”

Level 5
Mitigation ofradiological consequences

Acceptable level forregional continuity

Accident Level

65