DEVELOPMENT OF A NEW SEISMIC PRA CODEFOR UNCERTAINTY ANALYSIS
K. MURAMATSU
Department of Nuclear Safety Engineering, Faculty of Engineering, Tokyo City University
1-28-1 Tamazutsumi, Setagaya-ku, Tokyo 158-8557, Japan

T. UCHIYAMACSA of Japan Co., Ltd.
1-3-9, Shiba-Daimon, Minato-ku, Tokyo 105-0012, Japan

H. MUTA
Department of Nuclear Safety Engineering, Faculty of Engineering, Tokyo City University
1-28-1 Tamazutsumi, Setagaya-ku, Tokyo 158-8557, Japan

A. NISHIDA
Center for Computational Science and e-Systems, Japan Atomic Energy Agency
178-4-4, Wakashiba, Kashiwa-City, Chiba, 277-0871, Japan

ABSTRACTThe probabilistic risk assessment (PRA) is an important tool forknowing factors that contribute to risks and improving safety of
nuclear power plants (NNP). The authors have developed a newcomputer

code

SECOM2-DQFM-U

for

accident

sequencequantification in seismic PRAs of NPPs. The important advantage ofthe code is that it provides uncertainty analysis not only for coredamage frequencies but also for importance analysis using FV andRAW measures with consideration of the effect of correlation of
failure among components. This capability was made possible by theuse of the Direct Quantification of Fault Trees using Monte Carlo(DQFM) method.

This paper presents the modeling scheme for

uncertainty analysis and some results of applications of the code as
well as its advantages.

1. Introduction
After the Fukushima accident, it is widely recognized that the probabilistic risk assessment(PRA) is a powerful and practical approach for searching potential severe accident scenarios
to improve our protection against such scenarios as far as reasonably practicable. To support
risk-informed decision making by both utilities and regulatory organizations for continuoussafety improvement, PRAs should have a good quality and a wide scope. As part of its scope,
it should consider the accident scenarios caused by internal and external hazards such as
earthquake and tsunami. It is also necessary for PRAs to provide adequate information on theuncertainties in their quantitative outputs.
In this paper, the authors try to show features of the SECOM2-DQFM code[1] and its latest
version SECOM-2-DQFM-U developed by the authors and outcomes from past applications inbrief, as well as a review of analytical methodologies used for uncertainty analysis by
SECOM2-DQFM-U. Then, it shows philosophy and algorism of a newly proposed analyticalmethodology for consideration of correlation of seismic failures in the process of uncertainty
analysis for accident sequence frequencies and importance measures in level 1 seismic PRA.
Finally, usefulness of such analysis codes for risk informed applications is discussed.

2. Current status of quantification methods for seismically induced coredamage frequency (CDF)
In seismic PRAs, the failure probability of each component of safety systems (fragility) is
calculated as a function of the intensity of input seismic motion. This calculation uses
information on the uncertainties in the estimation of component strength (seismic capacity)and seismic load (seismic response). Such uncertainties are categorized into those due tolack of knowledge and those due to inherent randomness. The quantification of CDF is madeby combining three types of information: (1) the information on the occurrence frequency ofearthquake motions at the site (seismic hazard) expressed as a function of the maximum
acceleration at bedrock, (2) the information on the fragility, in other words, capacity andresponse of each component, and (3) the information on system configuration expressed byfault trees (FT) and event trees (ET). For internal event PRAs, many computational tools havebeen developed and used. But for seismic PRAs, some special considerations werenecessary. An important and difficult challenge was the consideration of correlation of failures.
There are several analytical method for this problem, such as methods using truth table,
methods using minimal cut sets (MCSs), and methods using Monte-Carlo simulation. The
DQFM (Direct Quantification of Fault tree using Monte-Carlo simulation) method is one of themethods using Monte-Carlo simulation. A verification calculation by Oikawa et al. [1] showedthat the DQFM method gives numerical results very close to that produced by the Boolean
Algebra method which was believed to have accuracy close to theoretical solution. In general,
methods using MCSs, which are the defact-standards for seismic PRA, have somedisadvantages and DQFM method provided a resolution for this disadvantage [1],[2]. The
advantage of the DQFM method can be shown by the following comparison of results ofcalculations with two methods for a hypothetical boiling water reactor (BWR). Figures 1 and 2
show conditional probabilities of various accident sequences as functions of the size of input
seismic motion expressed by peak acceleration of bedrock.

Fig 1 Conditional probability of accident sequences calculated with a method using MCSs
Based on the DQFM method, the result shown in Fig 1 turns to be a different result with thesame model and data, as shown below.

Fig 2 Conditional probability of accident sequences calculated with DQFM method
In general, total probability of core damage sequences with methods using MCSs havetendency to be over estimated, and it makes the difference between the peak probabilities in
Fig 1 and Fig 2. If probabilities of accident sequences are uniformly over-estimated by amethod, the method can be used to understand relative importance of sequences. But, since
the degree of over-estimation is not uniform, Fig 1 shows that there is a possibility thatimportance of some sequences might be erroneously emphasized [3].

3. Past achievements and current applications by SECOM2-DQFM
The SECOM2 code system was originally developed and verified by Oikawa et al. [1],[2]. Anapplication of the code system to a model plant seismic PRA was conducted by JAEA (Japan
Atomic Energy Agency). Then SECOM2-DQFM was extracted from the code system, andwas modified and published for use on IBM compatible PCs [4].
Since the code has a feature to treat a wide range of simultaneous seismic failures
reasonably, it is used not only for single-unit sites but also for multi-unit sites. It was used toshow effectiveness of the accident management strategy by cross-connections of emergency
diesel generators (EDGs) for a multi-unit site [5]. An example of results from this application isshown below.
Tab 1 Core damage frequency (CDF) for each case
Correlations*

Cross-

CDF of a

CDF of This

Frequency ofConnections

Single Unit

Two-Unit

Simultaneous Coreof EDGs(/Year)Site**

Damages of Both Unit(/Year)-5

4.110(/Year)-5

5.510-6

Base

No

No

2.310Case 1Yes

No

3.010-5

4.810-5

1.310-5

Case 2Yes

Yes

2.010-5

2.810-5

1.110-5[Notes] * Correlations of component responses in the same building are considered using
rules of NUREG-1150[6],[7],[8], and component responses between different
buildings are also considered to be the same as in the same building, conservatively.
** Frequency of core damages of at least one unit at the same site
In the base case, the CDF of this two-unit site was about 1.8 times higher than that of a single
unit instead of 2 times because earthquake was a common cause event that caused
simultaneous core damages of both unit. When correlations were considered in Case 1, there
was a significant increase of the frequency of simultaneous core damages of both units, which
was about 2.3 times higher than that in the base case where correlations were ignored.
On the other hand, when cross-connections of EDGs between the two units were available inCase 2, the CDF of this two unit site was lower than the CDF of a single unit site in Case 1.
SECOM2-DQFM code is based on typical seismic PRA procedures such as that described in
the seismic PRA standard published by AESJ (Atomic Energy Society of Japan). Until now,the code has been applied to seismic PRA for light water reactors (BWRs and PWRs), andrecently, the code is being applied to seismic PRA for high temperature gas cooled reactors.

4. New development
SECOM2-DQFM code

of

the

uncertainty

analysis

capability

of

the

After Fukushima accident, the importance of accident management (AM) is widely recognized
and it is required for us to quantify importance of various accident scenarios and importantcomponents to support selection of cost effective AM measures.

To identify the important scenarios, it is necessary to figure out uncertainty of accident
sequence frequencies and uncertainty of component importance measures. To obtainrealistic values, it is necessary to consider correlation between component failures, but the
number of codes capable for it was limited. Since SECOM2-DQFM code is one of the few
codes, the authors added a feature for uncertainty analysis to it and named the new version
SECOM2-DQFM-U.

4.1 Modifications of equations for the uncertainty analysis capability
To add the new feature for uncertainty analysis, it was necessary to enhance equations forpoint estimate analysis, to allow uncertainty analysis. An example of the equations for point
estimate analysis is shown as follows,
Ci = Cmiexp{(Ri2Ui2)1/2Xi}

Eq 1

where Ci is a response for i-th component generated artificially, and expected to distributelognormally. Cmi is the median of response for i-th component. Ri andUi are standard
deviations due to aleatory uncertainty and epistemic uncertainty, respectively. Xi is random
sampling number following standard normal distribution. Eq 1 could be used to generate
artificial capacity as well. SECOM2-DQFM-U code compares the artificial response and theartificial capacity, and judges the occurrence of failure of the component if response is greaterthan the capacity. Then the code counts up the number of the failure, and calculates failure
probability by dividing the number of the failure by the number of total iteration forMonte-Carlo simulation.
In general, epistemic uncertainty should be estimated in uncertainty bounds of target
measures (e.g. CDF etc.), then Eq 1 was modified and the following equation was developed,
Ci = Cmiexp(RiYiUiZi)

Eq 2

where Yi is a random sampling number following standard normal distribution, generated forMonte-Carlo iteration for calculating median fragility curve. It corresponds to Xi in Ex 1. Zi is arandom sampling number following standard normal distribution, generated for Monte-Carlo
iteration used for uncertainty analysis. It expresses deviation from the median fragility.
Now the SECOM2-DQFM code provides uncertainty analysis capability for two importancemeasures (Fussell-Vesley(FV)) measure and the Risk Achievement Worth(RAW)) as well as
the uncertainty analysis for accident sequence frequencies.

4.2 Decomposition of correlation coefficients
Uncertainty analysis considering correlations involves an issue that the analyst (the user ofthe code) has to provide his resolution. That is the decomposition of correlation coefficients.
When correlation is considered in a point-estimate analysis, the DQFM method requires amatrix of correlation coefficients to generate a set of correlated random sampling numbers
shown as Xi in Eq 1. For uncertainty analysis, Xi was decomposed into Yi and Zi in Eq 2. Thencorrelation coefficients must also be decomposed and given by users of the code. The

definition of correlation coefficients is as follows,ρ Ci ,C j =Cov (C i , C j )β Ci × β C j

Eq 3

where Ci,Cj is a correlation coefficient between responses (or capacities) of i-th and j-thcomponents. Cov(Ci,Cj) is covariance between responses (or capacities) of i-th and j-thcomponents. Ci andCj are standard deviations of responses (or capacities) of i-th and j-thcomponents, respectively. In typical seismic PRA, Ci and Cj can be considered to be
decomposed into epistemic element and aleatory element, as shown below.

C i = R i × Ui
C j = R j × Uj

Eq 4

Here, if we assume that epistemic elements and aleatory elements are completely
independent, Eq 3 can be expanded to the following equation.

ρ Ci ,C j =β Ri β R j ρRi ,R j + β Ui β U j ρUi ,U j
β Ri 2 + β Ui 2 × β Rj 2 + β U j 2

Eq 5

In Eq 5, Ci,Cj could be obtained if correlation coefficient for aleatory element Ri,Rj
and for epistemic element  Ui,Uj are given, since  R and  U should have been
already known in a seismic PRA.
If knowledge of responses or capacities are limited, U would be larger thanR. For
example, if the data is given that Ui andUj are 0.5, Ri andRj are 0.1, and Ci,Cj is
0.75, then the range of Ui,Uj is limited in 0.73 - 0.75 in Eq 5, since Ri,Rj can’t havethe value more than 1.0 or less than 0.0. It means that composite Ci,Cj is dominatedbyUi,Uj of epistemic element which has larger uncertainty.
The data set used in this study are in almost the same situation as above. In thefollowing analysis, we applied the rules used in a seismic PRA[6] for NUREG-1150 for
Ci,Cj, then it was assumed that Ri,Rj are 0.0. The rules determine the correlation
coefficients for responses of two components on the basis of similarities in theirlocation in building and natural frequencies. This assumption gives a bounding
estimation on potential effect of correlation of uncertainty in responses. However thevalue of Ri,Rj is not expected to affect the results significantly if we can assume
epistemic elements are larger than aleatory elements. In general, it is likely to havesmall R and large U. In such cases, Eq 5 and the above approach helps to decidecorrelation coefficients.
Based on the above equations, uncertainty involved in accident sequence frequencies can bequantified. In the following sections, results of uncertainty analysis are shown for cases withand without consideration of correlation of failure.

4.3 Results of uncertainty analysis without considering correlation
Uncertainty of conditional core damage probability (CCDP) without correlation is shown as
follows.
0

8 2 A 4 4 CD

00

(C9 A5 C
6+(C9 A5 C

0

.

6C

. A

) 0

0
C BC

C

0
(

(
2

55

AC

C - 6A 5 1

Fig 3 Uncertainty analysis result for conditional core damage probability
The mean curve of uncertainty analysis shows good agreement with the curve calculated inpoint estimate analysis, and the uncertainty bounds are quantified in the figure as well.
The seismic hazard to be multiplied by CCDP in the analysis is shown as follows.

/ 88

7FA 5 F6 7 37

1

1
1

(

1

)

1
1

+

1

-

G7 2

1

1

.

/

G 8 B

F B 8 F97
. F B 8 F
7BA F EF 7F

11
4 7 / 88

7FA 7F 0 9 A8 3 7

Fig 4 Uncertainty of seismic hazard
Total CDF is calculated from seismic hazard information and the conditional core damage
probability (CCDP) at each seismic level. When the uncertainty of seismic hazard isconsidered in uncertainty analysis, the uncertainty bounds of total CDF increases, since theseismic hazard has also significant uncertainty as shown in Fig 4.
Tab 2 Uncertainty analysis result for total core damage frequency
without considering uncertainty ofconsidering uncertainty ofseismic hazard

seismic hazard

5th percentile

1.9E-6

8.6E-7

median1.4E-5

8.0E-6mean

1.9E-5

2.4E-595th percentile

5.9E-5

8.5E-5error factor

5.6

9.9

Using the event trees that define the accident sequences, the SECOM2-DQFM-U code
calculates accident sequence frequencies, an example of which is shown in Tab 3.

Tab 3 Uncertainty analysis result of occurrence frequency of accident sequences

CF
F
65
/
/9
/9
/1
/0
/0 9
/0 1
7
7 9
7 9
7 9
7 1
7 0
7 09
7 01
7
7 9
7 9
7 9
7 9
7 1
7 0
7 09
7 09
7 01
8
89
89
89
89
81
80
80 9
80 9
80 1
D1 2 4

CF
CE
(3
3
. 3
( 3
3
( 3
) -3
3
(3
(3
) 3
3
( -3
) (3
+ 3
(3
3
.3
3
) 3
( +3
. 3
3
(3
+ +3
( -3
) 3
3
( -3
(3
.3
3
3
+3
.3
. 3
(3

E
-

-

.
-

-

.
+

+
+

+
+
+
-

F

3
(3
3
3
) 3
( (3
) 3
( 3
3
3
-3
(3
( 3
( .3
3
3
3
(3
3
.3
-3
.3
+3
) 3
+ )3
) 3
3
. .3
( -3
)3
3
+ 3
.3
)3
-3
. 3
(3

-

-

-

.
-

-

.
+

+

+
+
+
-

FF

DA

E

CF

3
(3
( )3
- +3
3
) 3
.3
) 3
3
( )3
3
(3
( +3
. 3
+ )3
3
) +3
+3
3
(3
3
( -3
- +3
(3
3
+3
- (3
+3
( +3
+ (3
+ .3
) +3
. 3
.3
) (3
) )3
.3

F

.
.

.
.
.
.

-

.
-

+

B
F CD
3
3
3
3
3
3
- 3 (
3
3
3
3
3
3
3
)3
3
+ 3
3
. 3
3
3
3
3
3
(3 .
3
.3 -3 .
.3
) )3
+3 .
3
)3 -3 .
(3 3
- +3

. B
F CD
3 .
3
-3
3 -3 - .3
-3 +
3 ) 3
) 3
3
. .3 .
( -3 (3 +3 ++ 3 ( 3 +
)3
) -3
3
3 3
) .3 +
-3 +
( 3 +
3
.3
) (3 +
3 +(3(3 +. .3 3- +3 +
3 +
)3
- 3

A
- (
. )
.
-)
.

)(
).)
((
(.
+
((
-)
.
+
.
+
+
))(
(
)
(
.
+
()

The error factor (EF) of the total CDF was about 10. But the EFs of individual sequences are
significantly larger than that of the total CDF, especially for the sequences of smallerfrequency. The reason for this was explained as follows. In general, sequences with smallerfrequencies have failures of more redundant systems than the others, then the uncertainty
can be calculated to be large because uncertainties of several redundant systems aremultiplied in those sequences.
Using the same seismic PRA model, importance measures can also be obtained as follows.

IC
PE LC AC PFHC
I CBF

0 OOCHH COCHT I C O CPE LC AC PFHC

- C I FA 3 O H P F 9S FPAET B
4 S
HP DC . - 5 - - +2 - 2 +
2 +.1 . TG +2 - 56+4 S
HP DC . PPC T +2 56 +
2 9 56+. FCOCH6 FH
G +.1 - P H
B +4 S
HP DC + - 5 - - +9I HH46 - +.1 +2 7 IL +7 IL +4 S
HP DC . - 7 - +2 2 +
2 9 7 IL +5 CBF I 46 - +- P H B . FRC FP
3 OP I C P PF
B +3 OP I C P PFAG +9CM C AC
B +
4 DFA
B +
4 S
HP DC + - 7 - +4 DC 46 - +9S FPAEDC +I C DC AT
FA + AFBG
27- 9 5 62 FDE HP DC . PPC T
2 FDE HP DC . - 7 - 3- 5 6
2 9 024 S
HP DC . - 5 - - 2- BC O PC 9P DC
G- 3FC
27- 9 7 I L
27- 9 5 6
2 - 7 IL +7 COO C COOCH LP C
94- 5 6 +- 3- 5 6
94- 7 I L +94+- 3- 7 I L

L F P COPFI PC

A IL

C P

Fig 5 Uncertainty of Fussell-Vesely measure
The mean values showed good agreement with the point estimates. As for uncertainty bounds,
the range of uncertainties in FV measures for almost all components are quite large. But thedifferences between mean values and 95th percentiles are much smaller than the uncertainty
toward lower bounds. This may be interesting for PRA analysts.

4.4 Results of uncertainty analysis with considering correlation
Uncertainty of CDF calculated with consideration of correlation of failure is shown in Table 4.
Tab 4 Uncertainty analysis result for total core damage frequency considering correlationthe same as base casereduced to halfcorrelation

independentconsidered

independentconsidered

point estimate

2.3E-5

3.1E-5

6.9E-7

1.0E-65th percentile

8.6E-7

3.9E-7

5.0E-8

4.1E-8

median7.2E-6

6.4E-6

2.9E-7

4.5E-7mean

2.1E-5

3.3E-5

6.0E-7

1.0E-695th percentile

7.7E-5

1.6E-42.0E-6

2.9E-6error factor

9.4

20.4

6.3

8.5

The results using the same data as the section 4.3 is shown in the left half of Tab 4. The EF
considering correlation is 2 times larger than the EF without correlation. It implies that
uncertainty could be underestimated if correlation is ignored (independence between
component responses).
On the other hand, it is also analyzed using  of all component responses and capacities
reduced to half, shown in the right half of Tab 4. In general, reducing uncertainty ofcomponent responses and capacities makes not only EF of total CDF decrease, but also themedian and mean values of total CDF decrease. In this case, the difference between EFs forindependent case and correlated case is decreased by reducing  of all component
responses and capacities.
Without reducing , importance measures were also quantified as shown in Fig 6.

IC
PE LC AC PFHC
I CBF

0 OOCHH COCHT I C O CPE LC AC PFHC

- C I FA 3 O H P F 9S FPAET B
4 S
HP DC . - 5 - - +2 - 2 +
2 +.1 . TG +2 - 56+4 S
HP DC . PPC T +2 56 +
2 9 56+. FCOCH6 FH
G +.1 - P H
B +4 S
HP DC + - 5 - - +9I HH46 - +.1 +2 7 IL +7 IL +4 S
HP DC . - 7 - +2 2 +
2 9 7 IL +5 CBF I 46 - +- P H B . FRC FP
3 OP I C P PF
B +3 OP I C P PFAG +9CM C AC
B +
4 DFA
B +
4 S
HP DC + - 7 - +4 DC 46 - +9S FPAEDC +I C DC AT
FA + AFBG
27- 9 5 62 FDE HP DC . PPC T
2 FDE HP DC . - 7 - 3- 5 6
2 9 024 S
HP DC . - 5 - - 2- BC O PC 9P DC
G- 3FC
27- 9 7 I L
27- 9 5 6
2 - 7 IL +7 COO C COOCH LP C
94- 5 6 +- 3- 5 6
94- 7 I L +94+- 3- 7 I L

L F P COPFI PC

A IL

C P

Fig 6 Uncertainty of Fussell-Vesely measure considering correlation
In Fig 6, the order of components from left to right is completely the same as that in Fig 5. Fig
6 shows that the values of importance measures were changed, and uncertainty ofimportance measures were also changed by considering correlation, relative to Fig 5. It
implies that the importance of components and its uncertainty can be misunderstood if
correlation is ignored. But the changes due to correlation are not so significant, that is, lessthan an order of magnitude for Fussell-Vesely measures.

5. Conclusions
The authors proposed how to consider correlation and how to set correlation coefficients inuncertainty analysis. Based on this proposal, uncertainty analysis methodology of accident
sequence occurrence frequency and importance measures considering correlation is
introduced into a PRA analysis code, and the effectiveness of the feature is confirmed byapplication to a model plant of a light water reactor.

6. References[1] Oikawa et al., "Development of systems reliability analysis code SECOM-2 for seismic
PSA," Reliability Engineering & System Safety, Vol. 62, pp.251-271, 1998.
[2] Watanabe et al., "Development of the DQFM method to consider the effect of correlationof component failures in seismic PSA of nuclear power plant," Reliability Engineering &System Safety, Vol. 79, pp.265-279 2003.
[3] Uchiyama et al., "Effect of analytical methodology for assessment on seismically induced
core damage," Journal of Power and Energy Systems, Vol. 5, pp.279-294, 2011.
[4] Liu et al, "User’s manual of SECOM2-DQFM: A computer code for seismic system
reliability analysis," JAEA-Data/Code 2008-005, 2008.
[5] Muramatsu et al., "Effect of correlations of component failures and cross-connections of
EDGs on seismically induced core damages of a multi-unit site," Journal of Power andEnergy Systems, Vol. 2, pp.122-132, 2008.
[6] Lambright, et al., “Analysis of core damage frequency: Peach Bottom unit 2 external
event,” NUREG/CR-4550, 1989.
[7] Bohn, et al., “Analysis of core damage frequency: Surry Power Station unit 1 external
events,” NUREG/CR-4550, 1990.
[8] Bohn, et al., “Procedures for the external event core damage frequency analysis for
NUREG-1150,” NUREG/CR-4840, 1990.