gmax137 said:
Station blackout (loss of all AC power) was not an original design basis for plants of that time. In the US, SBO first appears as a design basis (AFAIK) during the licensing of St. Lucie Unit 2 (in the mid 1980s), where the event is defined as a blackout lasting four hours. Later, the SBO was added to the US regulations with a formula for determining the duration based on site characteristics. But it's always 4, 8, or 12 hours. The 'final solution for SBO' was, the power comes back on at 4 (or 8 or 12) hours. So, the RCIC (or turbine driven auxiliary feedwater) has to operate for a fixed, finite time.
What Fukushima drives home is (1) the absolute importance of the external event design bases (since these events can lead to common cause failures like loss of both trains of service water, or loss of both diesel generators, or loss of all the switchgear) and (2) the need to consider much longer duration SBO. A third point which some people see (me included) is a kind of flaw in the design basis concept - it misses the need to design to fail gradually if the design basis is exceeded (rather than the design basis being a 'cliff edge'). This last point is hard for some to grasp.
I would ad a bit of a clarification to your cliff edge analogy.The problem with Fukushima, and which may be present elsewhere, is that the unrecognized seismic and tsunami risk was indeed a cliffedge.
From the very beginning of nuclear plant design, there was a recognition that accidents that exceed the design basis are possible. So plant designs had two levels of design and analysis This remains true today.
The design basis for safety systems is to prevent core damage that would release any radiation. This was based by conservative deterministic analysis with margin. In the case of containment safety systems the design basis was assumed to be the safety systems had failed resulting in an "arrested core melt accident" (Arrested meaning the core was damaged, but stopped after a partial melt. Again conservative, deterministic analysis was used to assure that containment would limit radiation dose to workers and the public within limits. This included margin for system leakage. The offsite release models were based on limiting atmospheric models and that the persons exposed were at the site boundary for two hours during the worst radiological dose or continuously in the low population zone for thirt days with no evacualtion.
The second type of analysis used is for severe accidents. Here the use of probabilistic approaches is allowed. This is supported by PRA for events that resu;lt in core damage and for containment failures. The consequences are also treated as probabilities. The WASH-1400 study was the first example of a systematic PRA approach to bring it all together. Other studies have followed, indicating the WASH-1400 study overestimated the consequences. NRC has initiated a recent update in the SOARCA project.
If you think about it, TMI2 was consistent with a beyond design basis reactor accident but within the design basis of the containment. (The lack of containment at Chernobyl is outside the process I am describing.) Fukushima is a severe accident but the consequences to date seem to confirm much of the severe accident analysis.
To relate this back to your post the SBO probabilities were used to justify the coping periods. They were based on grid performance studies that are available in reports from national labs. In addition to PRAs there are Integrated Plant Examinations of External Events (IPEEE) that are PRAs for external events. Clearly the Fukushima lessons learned witll include three basis response areas. The IPEEE for seismic and flooding events will need to be reviewed and updated. The basis of the SBO programs will need to reconsider duration bases on changes to IPEEE and likely new regulations. Design changes will probably need to be installed. PRAs and IPEEEs will ned to be updated reflecting new plant modifications. And during this whole process the results of each step will need to be reviewed to identify other vulnerabilities and guide corrective actions and modifications to areas with the greatest impact.
So my contention is that the current design of plants provides complete protection for design basis events and a reasonable process to install additional protection should accidents get past that point. As a result, absent a glaring design deficiency such as the Fukushima tsunami protection, it may be closer to a hillside than a cliff. I expect that the slope of that hill will be even shallower when the process is complete.