components remaining in each segment and the applicable failure modes should
be separately documented on tables designed to accompany the fault trees.
Care must be taken to ensure that systems interactions failure modes which
affect more than one system segment (in one or more systems) be consistently
identified as the same basic event on each fault tree for which it appears.

Once the support-system top events are defined, the support-system fault trees
are developed in a manner analogous to the development of the front-line-
system fault trees previously discussed. However, the support-system fault
trees are developed to reflect only those portions of the system needed to
support the front-line components. These fault trees should include all
supporting systems and components and their failure modes.

ASEP provides fault trees for the front-line and support systems. These fault
trees must be reviewed and revised based on the components that are remaining
in the analysis and the inclusion of identified system interactions and plant-
unique global features. However, by using this ASEP information, the fault-
tree modeling effort will be greatly reduced. Even if the ASEP trees are not
used directly (or are not available for the plant under review) it is strongly
recommended that the analyst review the ASEP fault-tree development techniques
and emulate it in the development of the fault trees for the plant under
review. The simplified yet comprehensive nature of these trees is
particularly suited to the evaluation of seismic margins within the format and
scope of this review process.

Each fault tree should be developed considering those components remaining
after the completion of Step 4 and those components that are directly
intersected with them, the system interactions, and the plant-unique
features. The component list and simplified schematic diagrams developed in
Step 2 and completed in Step 4 should be used to develop the fault trees.

4.5.3 Documenting System Modeling Results

The results of this step are completed event trees for each of the initiating
events defined in Step 2 and associated fault trees and component failure
tables for each of the front-line and support systems that are needed to
perform the Group A functions. A brief description of each of the front-line
and support systems along with a discussion of the modeling assumptions and
criteria should accompany these models.

The systems models will be verified for their correctness and applicability to
the plant configuration and operation during Step 6, the second plant visit.
During Step 6, additional information about component testing, maintenance,
and human factors will be obtained to complete the fault trees. The complete
set of system models will be analyzed for accident sequences and system
failure in Step 7.

4.6 Step 6 - Second Plant Walkdown
This step is difficult to separate from the activities of Step 4. After the
first plant walkdown, structural analysis is performed either by doing a full

reanalysis or by scaling of design calculated responses (forces, moments,
spectra, etc.). Some equipment response analyses might also have been

51


dependencies do not remain undiscovered. The second walkdown will primarily
be a gathering of information to develop the HCLPF value of the components
needing a detailed analysis (Step 8). The result of this Step will be a
categorization of the remaining components by seismic capacity, that is, into
those whose HCLPF value is judged to be high enough, and those for which a
detailed HCLPF determination will be necessary in Step 8 below.

Step 7 - System Modeling Analysis

For those components passed through from Steps 5 and 6, the systems analyst
should determine what accident sequence groups they participate in. From such
determinations, detailed cut sets (Boolean expressions) should be developed
for the end-point of core melt.

Step 8 - Margin Evaluation of Components and Plant

For all the components contained in the Boolean expressions developed in
Step 7, the HCLPF values are developed. Special attention should be given to
any singles or doubles, plus any other cut sets that appear to have HCLPF
values at the lower end of the range under consideration. The HCLPF values
for the combinations of components (all but "singles") may be determined using
one of several methods as discussed in Chapter 4.

In practice, Steps 7 and 8 may be performed in parallel with extensive
interaction between the fragility and systems analysts. These two steps will
build on one another thereby involving an interaction process between the
fragility and system analysis teams.

The result emerging from Step 8 is a HCLPF value for each Boolean expression
leading to the end-point of a core-melt, or at least for each Boolean
expression that is judged to be among the "important" ones by having HCLPF
values potentially lower than the review level. If the plant's HCLPF is a
greater value than the earthquake review level, the quantitative estimate of
the plant HCLPF is not obtained. Rather, a statement can be made that the
HCLPF value is at least as high as the earthquake review level.

The eight steps just outlined comprise the framework for the seismic margins
review methodology. As can be observed, the steps are intended to screen in
(or out) each component, either by itself or ultimately in combination with
related components that support a system or carry out a safety function.

17


NOTICE

This report was prepared as an account of work sponsored by an agency of the United States
Government. Neither the United States Government nor any agency thereof, or any of their
employees, makes any warranty, expressed or implied, or assumes any legal liability of re-
sponsibility for any third party’s use, or the results of such use, of any information, apparatus,
Product or process disclosed in this report, or represents that its use by such third party would
Not infringe privately owned rights.

NOTICE
Availability of Reference Materials Cited in NRC Publications
Most documents cited in NRC publications will be available from one of the following sources:

1. The NRC Public Document Room, 1717 H Street, N.W.
Washington, DC 20555

2. The Superintendent of Documents, U.S. Government Printing Oftice, Post Office Box 37082,
Washington, DC 20013-7082

3. The National Technical Information Service, Springfield, VA 22161

Although the listing that follows represents the majority of documents cited in NRC publications,
it is not intended to be exhaustive.

Referenced documents available for inspection and copying for a fee from the NRC Public Docu
ment Room include NRC correspondence and internal NRC memoranda; NRC Office of Inspection
and Enforcement bulletins, circulars, information notices, inspection and investigation notices;
Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and
licensee documents and correspondence.

The following documents in the NUREG series are available for purchase from the GPO Sales
Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and
NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of
| Federal Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service include NUREG series
reports and technical reports prepared by other federal agencies and reports Prepared by the Atomic
Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items,
such as books, journal and periodical articles, and transactions. Federa/ Register notices, federal and
state legislation, and congressional reports can usually be obtained from these libraries

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference
Proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free, to the extent of supply, upon written request
to the Division of Technical Information and Document Control, U.S. Nuclear Regulatory Com
mission, Washington, DC 20555

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process
are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available
there for reference use by the public. Codes and standards are usually copyrighted and may be
Purchased from the originating organization or, if they are American National Standards, from the
American National Standards Institute, 1430 Broadway, New York, NY 10018.



4.8.2 HCLPF Value of Systems and Plant

As in the case of components, there are two approaches to determine HCLPF of
the plant.

4.8.2.1 Deterministic Approach

This approach is based on the assumption that the HCLPF estimated in Section
4.8.1 are lower bound values.

The systems analysis as described in Section 4.7 is expected to provide a list
of dominant cut sets for core melt. These cut sets can be grouped into
"singles," "doubles," "triples," etc. In general, the singles and doubles
make the most significant contributions to the core melt frequency.

The HCLPF of each component is calculated as described in Section 4.8.1.1. In
each "doubles" cut set, the HCLPF of the cut set is estimated as the higher of
the two component HCLPF values. The HCLPF of a "triples" cut set is estimated
as the highest of the three component HCLPFs. In the event that one of the
components in these cut sets is suspected to be unavailable (because of random
failure, testing or maintenance), it requires further evaluation. If the
random failure probability of the component is less than 0.01, then the
component is not considered in the HCLPF evaluation. Since the emphasis in a
margin review is on estimating the seismic capacity, not seismic risk, a
detailed assessment of component unavailabilities is not necessary and generic
data from NURER/CR-2815 (Ref. 20) should be used.

The HCLPF of the plant against core melt is evaluated as follows:
1. HCLPF of all "singles" are calculated.

2. HCLPF of all "doubles" and "triples" cut sets are calculated using the
above procedure.

3. HCLPF of the plant is the lowest of the HCLPF values of components in
Steps 1 and 2.

Note that if all components have been screened out, then a numerical value of
the plant HCLPF is not obtainable by this procedure.

The HCLPF of the plant may also be obtained directly by studying the Boolean
expressions. For example, the plant level (i.e., core melt, (CM)) Boolean
expression may be

TM =l+2+3*4+5* 6% 7

where the numbers represent component failures, "+" indicates "OR" gate
(union) and "*" indicates "AND" gate (intersection). Assume the HCLPF of the
components are 0.3g, 0.35g, 0.35g, 0.40g, 0.25g, 0.30g, and 0.4g,
respectively. Then the HCLPF of the plant (i.e., for core melt) is calculated
as follows:

60


TABLE 4-3

EXAMPLE ITEMS TO FOCUS ON IN A PLANT WALKDOWN DURING

MARGIN REVIEW FOR

BETWEEN 0.3 AND 0.5G PGA

(Continued)

COMPONENT

ITEM TO BE EXAMINED

COMMENTS

Piping (Cont.)

Brittle connections, eroded
or corroded piping (if it
can be identified), and
brittle cast iron piping.

Valves

Inspect representative
motor-operated valves on
small pipes (less than 2"
in diameter).

Look for cases where the
operator is anchored to the
structure but the valve or
piping immediately adjacent
to the valve is not anchored.

Inspect support
and/or yoke size
of operators.

Check if the yoke
is made of cast
iron.

The concern is that
large piping dis-
placement may
severely strain the
yoke between the
valve and operator
and cause binding
of the operator
stem or leakage
past the stem
seals.

Heat Exchangers

Review details on the supports
(i.e., number, size of anchor
bolts)

Failure (leak or
rupture) may flood
and fail some other
essential equipment
(i.e., potential
systems
interaction).

Tanks

Inspect number of hold-down
bolts on flat bottom tanks.

Document number of bolts,
size, and stiffener details.

7

Look for lack of
stiffeners to
transfer forces
into tanks.


HCLPF greater

than the
review HCLPF smaller than HCLPF greater than
level the review level the review level
Y — N sola Y
A 1 6 5 4
Y
NOT-A 2 3
U
Plant-unique Cc
features Generic & non-generic components
—>| >)

Fig. 2-1 Venn diagram representing the true State-of-Nature. The shaded areas
of this Venn diagram identify the components that will be eliminated by the
Screening. The components of the subset 5 and 6 will be retained for the final
systems analysis.

The following describes the sorting of the components, from the bulk of all
the components and unique features of a plant, to the final partition into

those components screened out and the components retained for the final
systems analysis.

° The state-of-nature is idealized in the Venn diagram of Fig. 2-1, as
described above, where the various subsets are:

U- plant unique features
C - generic and non-generic components
A ~ components serving functions of Group A
NOT-A - components not serving functions of Group A
Y - components and plant unique features with HCLPF above the
earthquake review level

N ~ components and plant unique features with HCLPF below the
earthquake review level

Thus, only subsets 5 and 6 (nonshaded area in Fig. 2-1) would be retained for
the final systems analysis. All components and plant unique features not


TABLE 4-2

EXAMPLE ITEMS TO FOCUS ON IN A PLANT WALKDOWN DURING
MARGIN REVIEW FOR EARTHQUAKES LESS THAN 0.30G PGA

(Continued)

COMPONENT ITEM TO BE EXAMINED COMMENTS

Heat Exchangers Inspect the supports (i.e., Failure (leak or
number, size of anchor rupture) may flood and
bolts) and verify the fail some other
details shown on design essential equipment
drawings. (i.e., potential systems

interaction).

Tanks Inspect number of hold-down Look for lack of stiff-
bolts on flat bottom tanks. eners to transfer forces
Document number of bolts, into tanks.

size and stiffener details.

Inspect how the tank is
anchored to concrete (with
chairs and angles or simply
bolted down).

For elevated tanks which are
supported on slender legs and
with no diagonal bracing,
check the attachment of
tanks to legs; obtain sizes
of support members if a
HCLPF evaluation is required.

Study the weld details at
valve pit location; is there
enough flexibility in piping?
Where is the valve located with
respect to the tank?

Look for potential for syphoning
of tanks by break of connecting

pipe.
Batteries and racks Inspection should focus on Some racks in older
battery support (i.e., plants have low seismic

Spacers and shims), rugged- margin.
ness of racks, and anchorage
details.

66


TABLE 2-3b

FUNCTIONS REQUIRING DETAILED EVALUATIONS IN SEISMIC MARGIN REVIEWS FOR BWRS

Function Screening Requirement Remarks

Initiators: F= Assume Failure
Offsite Power
RCS Integrity (LOCA)
Containment Integrity

Dog Fd

Functional Group A:
Reactor Subcriticality

Normal Shutdown

Emerg. Core Cooling (Early)
Emerg. Core Cooling (Late)
Containment Heal Removal
Cont. Overpress. Prot. (Early)
Cont. Overpress. Prot. (Late)

X = Margin evaluation
for all potential
failure modes is
required.

SOS Oe OS De DO

24


COMPONENT

A general term used for a structural element, system, an electrical or
mechanical piece of equipment, a piping system, or an electrical cable system.

CORE MELT BINS

See "PLANT DAMAGE STATE."

CORE MELT FREQUENCY

An estimate of the annual frequency of occurrence of all accident sequences
involving core melt.

CUT SET (Minimal)

A minimal cut set is the smallest combination of component failures that, if
they all occur, will cause the top event to occur. It is a combination
(intersection) of primary events sufficient for the top event. The
combination is a "smallest" combination in that all the failurés are needed
for the top event to occur; if one of the failures in the cut set does not
occur, then the top event will not occur (by this combination) .

DESIGN ACCELERATION

A specification of the ground acceleration, such as the SSE, at a site in
terms of a single value such as the peak. It is used for the earthquake-
resistant design of a structure (or as a base for deriving a design spectrum).

DESIGN EARTHQUAKE

A specification of the seismic ground motion at a site; used for the
earthquake-resistant design of a structure.

DESIGN EVENT, DESIGN SEISMIC EVENT

A specification of one or more earthquake source parameters, usually magnitude
and the location of energy release with respect to the site of interest; used
for the earthquake-resistant design of a structure.

DESIGN GROUND MOTION

See "DESIGN EARTHQUAKE."
DESIGN SPECTRA
A set of response spectra for design purposes. (See "RESPONSE SPECTRA.")

DOMINANT PLANT DAMAGE STATE

The plant damage state that contributes most to the frequency of core melt.

95


TABLE 3-1

COMPARISON OF SEISMIC MARGIN REVIEWS WITH SEISMIC PRAS

AREA

SEISMIC MARGIN REVIEW

SEISMIC PRA

Purpose

Seismic Hazard

Seismic Hazard
Uncertainty

Output

Plant Walkdown

Use of generic
information

Plant-specific
Evaluation

Safety measure
decisions

Earthquake
input

Use of random

Estimate Seismic Capacity
Beyond SSE

Excluded

Excluded from Consideration

o Plant seismic capacity in
terms of HCLPF

- not related to specific

probability distribution

o Identifies lowest HCLPF
elements

© Two walkdowns ~- level of
detail depands on the end
use

For screening out components

HCLPF calculations for
components; doubles, triples

Decided on HCLPF value of
components and plant

Estimation of HCLPF value is
based on analysis, testing,
experience, and judgement

Needs the earthquake review
level

Care should be taken to
identify this in estimating
the HCLPF for cut sets

Estimate seismic risk

Important part of PRA

Has a major effect on results

o Gives seimic risk,
frequency of core melt

o Identifies lowest capacity
elements

o As currently practiced,
requires a less-detailed
walkdown than a margin
review

For "high" capacity components

Fragility curves for "low"
capacity components

Decided on frequency of core
melt and/or consequences

Estimation of component
fragility parameters

(An 8p By) is more
judgemental than HCLPF
estimation. Large uncertain-
ties in seismic risk estimates
make decisions difficult

Needs seismic hazard curves

The PRA methodology includes
consideration of this issue

31


The systems analyses performed to develop the Boolean expression should be
fully documented. This documentation should include the analysis techniques
and tools used, the method used to "prune" the fault trees and the
justification, and a description of the basic events (their failure modes)
that make up the Boolean expression

4.8 Step 8 - Margin Evaluation of Components and Plant

Steps 7 and 8 are performed concurrently and with close interaction between
the system and fragility analysts.

The components that require margin evaluation, called the "screened in"
components, have been identified during the plant review and the two plant
walkdowns. Design details and actual existing conditions have been recorded
(as far as practical).

The objectives of the analysis in Step 8 are:

o To estimate the HCLPF of these components
o To estimate the HCLPF of the plant.

For each HCLPF evaluation, two alternative approaches are presented.

4.8.1 Capacity of Components

The concept of HCLPF is similar to the traditional notion of using code-
minimum strengths and code~-maximum loads in structural design codes. The
specification of these minimums and maximums was done by code committees using
past performance data, results of analysis and research, and collective expert
judgments. They implicitly or explicitly recognize the uncertainties in loads
and strengths. The capacity of a component calculated using these specifica-
tions was considered to be conservatively low. The HCLPF value calculated
using the procedures described in this report has similar attributes: it is
conservative, and it recognizes the uncertainties based on the Panel's
judgment.

There are two candidate approaches for calculating the HCLPF value of
components: the Conservative Deterministic Failure Margin (CDFM) method
proposed by Kennedy (Ref.7) and the fragility-analysis method. In the CDFM
method, a set of deterministic rules (e.g., ground response spectra, damping,
material strength, and ductility) is prescribed; the capacity of the component
determined using these rules gives a HCLPF value that may be more conservative
than necessary. In the fragility-analysis method, the median ground
acceleration capacity A, and the logarithmic standard deviations BR and By for
which there is less than a five percent probability of failure with 95 percent
confidence. The randomness and uncertainty in the median capacity are assumed
to be lognormally distributed. In the trial plant reviews, both these methods
may require that seismic response analyses separate from the design analyses
be performed. The fragility analyst must review the structural models used in
the plant design to confirm the adequacy of these models and the
appropriateness of scaling the responses. If scaling is not appropriate, the
response analysis becomes a major effort in seismic margin reviews. In the
CDFM method, values for a number of parameters (e.g., system ductility,

56


defined by governing codes such as AISC, ACI, and ASME. Code margin
evaluations are typically performed for structures, systems, and components
selected based on system consideration. Code margin studies are more
conservative than the seismic margin review methods discussed in this
report. For further details, see Ref. 7.

3.3 Probabilistic Seismic Margin Studies

In some instances the results of seismic PRAs have been studied and
interpreted with respect to the capability of nuclear power plants to
withstand earthquakes larger than the original design basis. The seismic
margin study (Ref. 8) conducted using the results of the probabilistic safety
study for Millstone Unit 3 is an example of this approach as described below:

1. Dominant contributors to seismic risk (i.e., accident sequences and
critical structures and equipment) were identified in the seismic PRA.

2. For each critical structure and piece of equipment, the-HCLPF value
was calculated for the structure/equipment at the earthquake level
(i.e., peak ground acceleration) for which there is 95 percent
confidence that the probability of failure is less than 5 percent,
using a lognormal fragility model. The seismic fragility information
was used in quantifying the margin. These HCLPF values ranged from
0.30g to 0.889 for critical structures and equipment at Millstone Unit
3.

3. Although adequate margin for individual structures and equipment was
shown to exist, it was necessary to investigate the seismic levels at
which the plant safety systems or the entire plant would be severely
damaged. These seismic levels may be less than the HCLPF for critical
structures or equipment because the system or plant may be damaged if
one or more critical structures or equipment fail, and the plant may
have several components in series. The HCLPF values for dominant
plant damage states were estimated using the Boolean expressions and
the seismic fragilities of structures and equipment appearing in those
Boolean expressions. The HCLPF for dominant plant damage states
ranged from 0.26g to 0.60g. These capacities were calculated using
the lognormal fragility model and assuming that the component failures
are statistically independent. The component fragility curves were
not truncated (i.e., "cut off") at any lower bound capacities. When
the component failures were assumed to be perfectly dependent, the
capacities of dominant plant damage states ranged from 0.30g to
0.62g. When the fragility curves were cut off at some selected peak
acceleration values (i.e., at probabilities of 2.5% to 0.1%), the
HCLPF of plant damage states did not change significantly from the
previous cases studied.

4, The seismic margins of individual critical components and plant damage
states have been stated in Steps 2 and 3 without reference to the
seismic hazard at the site. One could say with high confidence that
the plant has a low probability of sustaining damage for earthquakes
up to 0.26g. The frequencies of occurrence of dominant plant damage
states were calculated by convolving the plant-damage state

27


contributions of different parameters because the seismic capacity of a
component is a nonlinear function of these parameters; the impact on capacity
of any value of a single parameter depends not only on the significance of the
Parameter on the median capacity but also on the relative variabilities (i.e.,
randomness and uncertainties) of all the parameters. The CDFM method
discussed here may be even more conservative than necessary. Until further
research on calibration is performed (discussed earlier), the degree
conservatism cannot be quantified.

4.8.1.2 Fragility-Analysis Method

One method of describing the fragility of a component is to express it in
terms of three parameters (Ref. 19): median capacity An logarithmic standard
deviations Bp, and By representing, respectively, randomness in the capacity
and uncertainty in the median value. (Fragility Handbook, Ref. 19) Rather
than estimating the median capacity as a product of an overall median safety
factor times the SSE pga for the plant (where the overall safety factor is a
product of a number of factors representing the conservatisms at different
stages of analysis and design), the median capacity is evaluated using median
structural and equipment response parameters, median material properties, and
ductility factors, median static capacity predictions, and realistic
structural modeling and method of analysis. If the fragility analyst is
convinced that the scaling of response is appropriate, the median seismic
capacity may be estimated as the product of the overall median safety factor
and the SSE pga.

The median response of the structure/equipment for the earthquake review
level (REL) is calculated. The median capacity of the structure/equipment is
estimated as the median static capacity multiplied by the median inelastic
energy absorption capacity factor. The median ground acceleration capacity of
the structure/element is approximately estimated as:

Median Normal Design
AL = (REL) Capacity - Load Response
Median Response caused by REL

This is valid because the normal loads have low variability and the normal
design loads are conservatively selected.

In lieu of explicitly determined 8, and 8,,, the HCLPF value for the structure/
equipment may be conservatively estimated’ by assuming BR + By = 0.08 and the
lognormal model: (Ref. 10 and 12)

HCLPF * 0.25 A,

If the HCLPF value calculated as above does not exceed the earthquake review
level, the analyst may revise the capacity by estimating Bp and By using
plant-specific data and PRA methods (i.e., seismic fragilities). nother
option, if this proves to be too conservative, is to revise the median-
capacity estimate by performing further studies such as nonlinear, inelastic
static, or time history dynamic analyses.

59


DOUBLE, DOUBLET, DOUBLETON

A minimal cut set made of the intersection of two basic events (i.e., for the
top event to occur, both basic events have to occur).

DURATION

A qualitative or quantitative description of the length of time during which
ground motion at a site shows certain characteristics (e.g., perceptibility,
violent shaking, etc.).

EARLY MELT

A term used to indicate the time at which the core melt event occurs in
relation to the operation of safety systems designed to prevent it. Early
core melt occurs as a result of failure of safety systems designed to provide
core cooling immediately upon initiation of a severe accident.

EARTHQUAKE SIZE

As used here and in most nuclear-power-plant-related risk studies, the size of
an earthquake is measured in terms of the pga, rather than magnitude,
intensity or any other geophysical parameter. (See Chapter 2 of Ref. 1.)

EVENT TREE

This term defines sequences of system failures that may lead to the release of
radioactive material. Each tree is associated with an initiating event. The
event tree method begins with an initiating event, tracks subsequent events of
various plant systems, and determines the probability of the various accident
sequences.

EXCEEDANCE PROBABILITY

The probability that a specified level of ground motion or specified social or
economic consequences of earthquakes will be exceeded at a site or in a region
during a specified exposure time.

EXPOSURE TIME

The time period of interest for seismic-risk calculations, seismic-hazard
calculations, or design of structures. For structures, the exposure time is
often chosen to be equal to the design lifetime of the structure.

FAILURE MODE

Failures are basic abnormal occurrences. A failure mode specifies exactly
which aspects of component failures are of concern. Failure modes should be
realistic and consistent within the context of the system operational
requirements, environmental factors, and the numerical data base.

96


plants in the United States. This tabulation can be used to indicate those
Group A front-line systems that will need to be studied for any PWR under
consideration.

A table of the two Group A functions and the identified front-line systems
needed to perform these functions should be developed. An example of the
format of this table is given in Table 4-1.

4.2.3 Event Tree Development

From an understanding of the plant configuration and the operation of the
front-line systems gained during the performance of the earlier portions of
this step, the analyst should develop systemic event trees leading to core
melt for each of the defined initiating events. Each event tree should
include only those identified Group A front-line systems that can provide
accident mitigation for the plant conditions resulting from the particular
initiating event group. In addition, for each initiating event group, the
front-line systems should be approximately ordered according to when they will
be called upon to respond. The dependencies among the systems should be
determined. The analyst should also identify where transient-induced LOCAs
transfer into the LOCA systemic event trees. An example of a systemic event
tree for loss of offsite power is given in Fig. 4-1. Excellent discussions of
event tree development are presented in the IREP Procedures Guide (Ref. 11)
(Part II - Sections 2.2 and 2.3 and Part III - Section 2.2) and in the PRA
Procedures Guide (Ref. 12) Sections 3.4.3 and 3.4.4.

ASEP has provided systemic event trees for a large range of initiating events
in both PWRs and BWRs. The BWR trees can be used as presented in ASEP, since
the BWR Group A functions consist of all plant safety functions. For PWRs,
revisions of the ASEP event trees can be used in the analysis by eliminating
those systems that do not pertain to the PWR Group A functions and truncating
the trees at early core melt.

4.2.4 Identify Front-Line Components

Once the front-line systems that perform the needed safety functions are
determined, the components within these systems must be identified and
recorded. It would also be useful to identify the general location of these
components within the plant using the plant configuration diagrams. These
components will be mostly valves, pumps, tanks, piping, and electrical
equipment located in various buildings at certain floor elevations in rooms,
vaults or piping tunnels. Simplified schematics of the front-line systems and
components should be developed. These schematics will be used in Step 4
during the first plant walkdown.

It is highly recommended that the methods discussed in Part II, Section 3.2.1
and Part III, Sections 3.1 and 3.2 of the IREP Procedures Guide (Ref. 11) be
used for this task. Briefly summarized, the guide states that simplification
of the plant drawings should include the omission of instrumentation, omission

37


CHAPTER 5.
RESOURCES AND SCHEDULE

This chapter describes the engineering resources needed to perform a seismic
margin review of a nuclear power plant following the methodology described in
this report. These estimated staffing requirements may be revised based on the
findings of the trial plant reviews. The staffing requirements for performing
the margin review and for an independent peer review are also described.

5.1 Review Team

We assume that a earthquake review level has been defined. The major tasks of
a margin review are:

Collection of design information

Plant walkdowns

Systems analysis

HCLPF calculations for the components and the plant
Internal Review

Report writing

oo0o0o00

The team doing the margin evaluation should consist of engineers experienced
in plant systems analysis and structural and mechanical/electrical equipment
fragility analysis. Their qualifications are described in Section 4.9. Table
5-1 gives an estimate of the manpower requirements for this review. For an
earthquake review level up to 0.3g pga, the total engineering time could be
between 27 months and 39 months. For earthquake review levels between 0.3g
and 0.5g pga the manpower requirement could be 36 to 48 months. The time
requirement depends on the extent of seismic response analysis and the number
of screened-in components requiring detailed HCLPF calculations.

5.2 Independent. Peer Review

An independent peer review is essential for any seismic margin study. Such a
peer review should consist of:

© A review of the seismic margin study report.

o An independent check of the information and plant-specific data used
in the study.

The peer review team is also expected to conduct a plant walkdown concurrent
with the first walkdown described in Section 4.4.

The major tasks of the peer review team are:
° Review of the seismic margin study

- Plant Familiarization
- Report

° Plant walkdown

79




ABSTRACT

This report is the third report of the Expert Panel on the Quantification of
Seismic Margins. The objective of this report is to present detailed
guidelines for the performance of seismic margin reviews of nuclear power
plants. The guidelines presented in this report are based on the Panel's
second report entitled "An Approach to the Quantification of Seismic Margins
in Nuclear Power Plants."

It is intended that these guidelines be used in at least one trial plant
review to demonstrate whether the approach and the quantification techniques
are adequate. Based on lessons learned from these trial reviews, the Panel
can then be more prescriptive about defining guidelines for general use.

ili


further than merely confirming qualitatively whether there is
sufficient seismic margin.

It is, therefore, clear that there exists a trade-off associated with the
choice of a earthquake review level.

For the case when the level for which margin has to be demonstrated is higher
than 0.3g but still below 0.5g, (Note: the screening tools presented here do
not apply above 0.59), the analyst might choose a value of 0.4 to 0.5g.
Choosing a review level above 0.5g will lead to a large analysis effort by the
fragility analyst since few, if any, components would be screened out and many
would require detailed engineering analysis.

4.2 Step 2 - Initial Systems Review

The objective of this step is to identify those systems and components that
are dominant contributors to plant seismic safety. The background information
and basis for this step are given in Chapter 4 of (Ref. 1).

The methodology described in this report is intended to be applied to all
nuclear power plants although the material in Ref. 1 was developed
specifically for PWRs.

The general procedure for this step is as follows:

° Define the initiating events for the Group A functions found to be
most important to seismic induced core melt, i.e., reactor
subcriticality and early emergency core cooling.

© Review the configuration and operation of the plant. Identify the
specific systems (front-line systems) that perform the Group A
functions and identify the components within these systems.

© Develop systemic event trees for the defined initiating events
utilizing the identified front-line systems.

° Identify support systems and components for Group A front-line systems
and components.

° Identify the systems and components supporting the operation of the
support systems.

Oo Document the systems review results.

The results of this step are a set of plant specific components that are
needed to perform the important Group A functions and systemic event trees for
each defined initiating event. The identified components are merged with the
results of Step 3 and carried forward for further review in Step 4. Also asa
result of this step, the systems analyst should gain a good understanding of
the configuration and operation of the plant under review.

The front-line systems that support the functions, and their configuration,
are plant specific as are the support systems and their associated

34


TABLE 4-2

EXAMPLE ITEMS TO FOCUS ON_IN A PLANT WALKDOWN DURING

MARGIN REVIEW FOR EARTHQUAKES LESS THAN 0.30G PGA
COMPONENT ITEM TO BE EXAMINED COMMENTS
Blockwalls Are they reinforced or Walkdown to identify any

laterally supported?

Can arching action
be developed?

potential systems inter-
action.

Piping (typical
safety-related piping
runs that are access—
ible)

Look for piping details
which could be potential
problems including:

Short, stiff pipe sections
between equipment, and
between equipment and
supports (including wall
penetrations).

Long flexible pipe runs
which could swing and impact
other pipes or equipment.

Supports with expansion
anchor bolts. (May have
to be done by reviewing
construction drawings.)

Small pipes connected
between large flexible

pipes.

Piping between buildings.

Brittle connections, socket
welds, eroded or corroded
piping (if it can be
identified), and brittle
cast iron piping.

If equipment moves
(e.g., flexes or slides)
piping could fail.

Valve operators could be
damaged if they impact
other equipment or
structures.

Failure could occur due
to large relative
displacement caused by
rocking or sliding of
buildings.

65


TABLE 4-3

EXAMPLE ITEMS TO FOCUS ON IN A PLANT WALKDOWN DURING
MARGIN REVIEW FOR EARTHQUAKES BETWEEN 0.3 AND 0.5G PGA
(Continued)

COMPONENT ITEM TO BE EXAMINED COMMENTS

Dams, Levees and Dikes If they exist and their
potential failure may have
significant consequence to
plant safety, they should be
inspected to assess their
existing condition and
vulnerability to earthquakes.

Pumps For vertical pumps, verify that
shafts are supported at their
lower ends or the casings have
lateral supports less than
20 feet apart.

Cable Trays and Cables Inspect representative cable
trays:

- Examine lateral support and
anchorage details; focus on
anchor plate weld connections,
taut cables, and sharp edges
at end of cable trays.

- Look for slack in electrical If structures or
cables between structures trays shift, cables
or between cable trays and may break.

building penetration.

Retaining Walls Inspect existing conditions of If wall fails, the
retaining walls which support buried piping may
soil that contains safety- fail.

related lines (e.g., service
water piping).

74


NUREG/CR-4482
UCID-20579

Recommendations to the Nuclear
Regulatory Commission on Trial
Guidelines for Seismic Margin

Reviews of Nuclear Power Plants

Draft Report for Comment

P. G. Prassinos, M. K. Ravindra, and J. B. Savy

Prepared for the U.S. Nuclear Regulatory Commission under the guidance and with the
concurrence of the Expert Panel on the Quantification of Seismic Margins: R. J. Budnitz
(Chairman), P. J. Amico, C. A. Cornell, W. J. Hall, R. P. Kennedy, J. W. Reed, and

M. Shinozuka.

|| Lawrence

National
Laboratory


PLANT LEVEL FRAGILITY

The conditional probability that plant systems would fail and lead to severe
core damage (or release) for a specified earthquake ground-motion-parameter
value.

PLANT SYSTEM AND SEQUENCE ANALYSIS

The identification of the sequences of events signifying the success or
failure of safety systems, beginning with the specified initiating event,
Progressing through a planned reactor shutdown or severe core melt, and
terminating in radiological releases to the environment. The frequencies of
various events in these sequences are estimated using Boolean expressions and
component fragilities.

PROBABILISTIC RISK ASSESSMENT (PRA)

See Ref. 1 Appendix E and Chapter 3 of this report.
RANDOM FAILURE

Those failures that occur normally during plant operation not affected by
seismic events.

RELEASE CATEGORIES

A measure of the type, amount, energy, and timing of radioactive material
released from the plant. These are functions of accident sequences and
containment failure modes.

RELEASE FREQUENCY

Frequency of occurrence of a group of accident sequence resulting in a
specific release category.

RESPONSE SPECTRA

A set of curves calculated from an acceleration time history that give the
maximum values of response (acceleration, velocity, or displacement) of a
damped linear oscillator, as a function of its natural period of vibration for
given damping values.

REVIEW
As described in this report, the review constitutes the act of performing the
necessary operations (i.e., analysis of available data, physical inspections

of the plant, detailed mechanical and structural analyses, and systems
analysis) to assess the seismic margins at the plant.

100




RMIEP

Risk Methods Integration and Evaluation Program. An NRC research program
intended to integrate all available PRA knowledge and apply it (as a
demonstration) to the LaSalle Nuclear Power Plant. The final result will be a
complete PRA of LaSalle (Level 3 PRA, Ref. 4) and an integrated methodology
for use in future PRAs.

SAFE SHUTDOWN EARTHQUAKE (SSE)

A regulatory design requirement defined as follows: that Earthquake which is
based upon an evaluation of the maximum earthquake potential considering the
regional and local geology, seismology, and specific characteristics of local
subsurface material. It is that earthquake which produces the maximum
vibratory ground motion for which certain structures, systems, and components
are designed to remain functional. These structures, systems, and components
are those necessary to assure: (1) the integrity of the reactor-coolant
Pressure boundary, (2) the capability to shut down the reactor and maintain it
in a safe shutdown condition, or (3) the capability to prevent or mitigate the
consequence of accidents which could result in potential off-site exposures
comparable to the guideline exposures of 10 CFR Part 100.

SCREENING
See "FILTER."

SEISMIC CAPACITY

See "CAPACITY.
SEISMIC CATEGORY I

For licensing purposes, nuclear plant structures and equipment are divided
into two categories according to their function and the degree of integrity
required to protect the public. These categories are Category I and non-
Category I. Structures, systems, and components important to safety, as well
as their foundations and supports, are designed to withstand the effects of an
OBE and an SSE, and are thus designated as Seismic Category I. These plant
design features are those necessary to assure: a) the integrity of the reactor
coolant pressure boundary, b) the capability to shut down the reactor and
maintain it in a safe shutdown condition, or c) the capability to prevent or
mitigate the consequences of accidents that could result in potential off-site
exposures comparable to the guideline exposures of 10 CFR Part 100.

SEISMIC HAZARD

Any physical phenomenon (e.g., ground shaking, ground failure) associated with
an earthquake that may produce adverse effects.

SINGLE, SINGLET, SINGLETON

A minimal cut set made of a single basic event.

lol


TABLE 2-2

DEFINITION OF PLANT SAFETY FUNCTIONS

IDENTIFICATION OF SAFETY FUNCTIONS

1. Reactor Subcriticality - shutting down the nuclear reaction such that

2.

the only heat being generated is decay heat.

Normal Cooldown - providing cooling to the reactor core through the use

of the normal power conversion system, normally defined as the main
steam, turbine bypass, condenser, condensate, and main feedwater
subsystems.

Emergency Core Cooling (Early) - providing cooling to the reactor core

in the early (transient) phase of an event sequence by the use of one
or more emergency systems designed for this purpose. The exact timing
of "early" is somewhat plant specific and sequence dependent. However,
for our purposes it can be deemed to be the time period during which
these systems are initially called upon to operate.

Emergency Core Cooling (Late) - providing cooling to the reactor core

in the late (stabilized) phase of an event sequence by the use of one
or more emergency systems designed for this purpose. In context with
the above definition of "early", for our purposes "late" can be deemed
to begin with the switchover to recirculation (for LOCAs) or with the
achievement of residual heat removal conditions (for transients).

Containment Heat Removal - removing heat from the containment to the

ultimate heat sink during the late (stabilized) phase of an event
sequence by the use of one or more safety systems designed for this
purpose.

Containment Overpressure Protection (Early) - controlling the buildup

of pressure in the containment caused by the evolution of steam by
condensing this steam during the early phase of an event Sequence by
using one or more safety systems designed for this purpose. "Early" in
the context of containment functions is not the same as "early" for
core cooling. In this case "early" is deemed to be the time period
commencing when this function is required after the beginning of core
melt when these systems are operating in the injection mode.

Containment Overpressure Protection (Late) - controlling the buildup of

pressure in the containment caused by the evolution of steam by
condensing this steam during the late phase of an event Sequence using
one or more safety systems designed for this purpose. In the context
of the previous definition, "late" in this case is deemed to start when
these systems are operating in the recirculation mode.

IDENTIFICATION OF THE FUNCTIONAL GROUPS FOR PWRS AND BWRS.

PAR
Group A: Functions 1,2,3
Group NOT-A: Functions 4,5,6,7 + All plant functions not related
to Safety
BWR

Group A: Functions 1,2,3,4,5,6, 7
Group NOT-A: All plant functions not related to Safety

22


TABLE 5-1

ESTIMATED STAFFING REQUIREMENTS FOR SEISMIC MARGIN REVIEW

Engineering Months Needed

Systems Fragilities

o Collect Information on Design 1.0 2.0
o Plant Walkdown

- First 1.0 2.0

- Second 0.5 3.0
o Systems Analysis 3.0
oO HCLPF Calculations of Component b

and Plant 0.5 6.07"
o Internal Review 1.0 2.0
o Report Writing 1.0 4.0

8.0 19.0

Total engineering time = 27 engineering-months (see d and e below).

a.

b.

Staffing requirements for future seismic margin reviews may be revised
based on the experience of trial plant reviews.

Depends on the number of screened in components requiring detailed HCLPF
calculations. For earthquake review levels between 0.3g and 0.5g, 30 to 40
additional items (i.e. structures and equipments) may need detailed HCLPF
calculations. An additional 9 engineering months are estimated as needed
for this evaluation.

It is assumed that the design seismic responses can be scaled to obtain the
response for the review level earthquake. If scaling cannot be done,
reanalysis of structures and equipment is a big cost factor requiring an
additional 12 engineering months. For soil sites, this reanalysis is
considered necessary.

For rock sites scaling of design responses is permissible; otherwise, total
engineering time = 39 engineering-months. For review level earthquakes
between 0.3g and 0.5 pga, total engineering time = 36 engineering-months if
scaling of design responses is permissible; otherwise, it is 48
engineer ing-months.

Additional engineering time needed by the utility to assist in data
collection, plant walkdown, project review and coordination is estimated to
be about 6 engineer ing-months.

81


4.9 Seismic Margin Review Team Qualifications

The seismic margin review team should consist of a review team leader, several
systems analysts, several fragility analysts, and at least one representative
from the organization sponsoring the review. This section presents the
general qualifications for the review team members.

Each review team member should have an overall understanding of the seismic
margins review methodology presented in this report including the limitations
and background discussed in Ref. 1.

The review team leader should have the following qualifications:

°

Knowledge and understanding of nuclear plant operations and
components, including having seen and toured a number of nuclear
power plants.

Some understanding of seismic risk assessment of nuclear power
plants.

Some understanding of systems analysis and component fragility-
analysis techniques.

Demonstrated ability to coordinate the activities of the team members
in the performance of the various steps of the review so that proper
information is efficiently processed as the steps are completed.

Ability to organize and coordinate team meetings and make
arrangements for the plant walkdowns.

The team of fragility analysts performing the review should have the following
qualifications:

°

The capability to perform earthquake engineering of nuclear power
plants and/or heavy industrial facilities.

The ability to comprehend and use nuclear design standards and
practices for structures and equipment.

The ability to identify failure modes of equipment and recognize
systems interactions.

Demonstrated capability to perform fragility/margins evaluations
including structural/mechanical analysis.

Participate in the plant walkdowns and be responsible for performing
the HCLPF calculations.

It would also be useful if the fragility analysts have some general under-
standing of systems analysis, and seismic risk assessment.

76


3. Possible vulnerabilities in very small-bore hydraulic systems
associated with sensors and pneumatic systems are not fully covered.

4, Electrical and control systems are not completely covered because
unrecoverable relay chatter and breaker trip cannot be adequately
treated from a systems standpoint at this time.

5. Evaluation of the effects of wear and aging on equipment functioning
is not fully covered.

6. Possible adverse human responses caused by earthquake-induced stress
are not covered.

With the seismic margins quantification approach and its limitations given in
the second Panel report, the objective of this report is to give guidance on
the implementation of seismic margin reviews. In the seismic margin context,
the term "review" pertains to the entire process of screening, inspection, and
analysis detailed in this report. The details of the review process include:

1. The organization and information needed to perform the review,

2. A review of the systems and fragility screening methodology and
seismic margins quantification methodology,

3. The performance of plant walkdowns for screening and data gathering,
4, Guidance on performing component screening and inspections,

5. Systems analysis techniques including the development of event trees
and fault trees,

6. A discussion of the uses and documentation of the results of the
reviews, and

7. A discussion of the limitations of this review methodology and the
relationship of these reviews to other seismic studies.

While these trial seismic margin review guidelines represent the best attempt
at this time, the Panel feels they should be applied to trial plant reviews
and then finalized. These trial plant reviews are intended to demonstrate
whether this approach and the quantification techniques presented herein are
adequate. Based on lessons learned, the Panel can then be more prescriptive
about defining guidelines for general use.

Chapter 2 gives an outline of the margin review process and discusses the
review ideas presented in the previous Panel documents. This is followed by a
discussion, in Chapter 3, of the relationship between these seismic margin
reviews and other seismic studies, in particular, seismic PRAs and the
limitations in the current methodology. The main body of the report is given
in Chapter 4, which contains a step-by-step procedure and explanation for
performing the margin review along with the qualification requirements of the
review team. Chapter 5 describes the resources needed to perform a Seismic
Margin Review and Chapter 6 provides a format for documenting the results.


5.

One objective of the walkdown by the fragility analyst is to confirm
that no weaknesses exist in the components judged to have generically
high capacities and to uncover any systems interactions. In this
first walkdown, the fragility analyst will concentrate on components
supporting Group A functions and systems interaction that may affect
them. The output of this effort will be to assign components into two
categories: one category whose HCLPF is clearly higher than the
earthquake review level and the other requiring further consideration.

By a review of design documents described in Section 4.3.1, the
fragility analyst will have by this stage identified components to
focus on during plant walkdown. He should have become familiar with
the plant arrangement, and details of equipment supports and
anchorage. The items to be inspected in this first walkdown are a
function of the earthquake review level. The number of items
increases with the earthquake review level. Table 4-2 and 4-3 list
the components to be inspected and the items to be focused on in the
Plant walkdown for the earthquake review levels less than 0.3g pga and
between 0.3g pga and 0.5g pga, respectively. Note that the components
requiring review for earthquake levels less than 0.3g pga also appear
in Table 4-3 for earthquake review levels of 0.3g to 0.5g pga, but the
detail of review may vary. If the earthquake review level is higher
than 0.5g pga, all Group A components need to be examined in greater
detail. The detail and extent of such examination is not described
here.

The fragility analyst should record these findings in a data book; the
data should be supplemented by photographs where appropriate,

In general, the survey of screened in equipment may include:

© A photograph of the equipment to show an overall view and
details of auxiliary attachments to the equipment (conduit,

piping).

o If drawings are not readily available, then general dimensions
will be taken of the equipment, including the size of
attachments such as piping or conduit.

The anchorage inspection of the screened in equipment may include:

© Notation of the type and size of the anchorage, and its
arrangement around the base of the equipment.

© Location and description of supports other than floor
anchorage, such as bracing to the nearest wall.

o If the equipment of Group A functions is anchored by bolts, the
type of bolts will be determined if possible (expansion anchors
or embedments) . This may need to be determined through
information on design documents and verified later by field
inspection, if this information is significant to the results
of the margin analysis.

46


TABLE 6-4

:
.
i

Eng. Safety Fact. Act. System

AC Power System

DC Power System

Cooling System

Safety Injection Pump
Cooling System
Reactor Pump Comp.
Coolant Water

Charging Pui

Turbine Pump Comp.

Coolant Water

Circulating Water System

Service Water System

Reactor Protection System

x

Power Conversion System

High Pressure Inj. System

Low Pressure Inj. System

x|x |x |x

Accumulator System

Auxiliary Feedwater System

Recirculation System

Quench Spray System

Primary SRV System

Secondary SRV System

xX |x |x |x |x

RCP Seal Cooling System

* Requires offsite power

88


TABLE 4-2

EXAMPLE ITEMS TO FOCUS ON IN A PLANT WALKDOWN DURING

MARGIN REVIEW FOR

LESS THAN 0.30G PGA

(Continued)

COMPONENT

ITEM TO BE EXAMINED

COMMENTS

Batteries and racks
(Continued)

Check for potential failure
of space heaters, hanging
light, or blockwall enclosures
that could fall and impact the
batteries.

Active Electrical
Equipment

Inspect method and adequacy of
anchorage for motor control
centers, switchgears, instru-
mentation panels, cabinets
and racks and other electrical
components.

Look for slack in cables and
air lines at equipment attach-
ment points.

Look inside electrical cabinets
to determine if relays or other
electrical instruments are
securely mounted.

Inspect lateral restraints
on large breakers.

Look for cabinets
not tied together
which could impact
each other.

If safe to do so,
push on instruments
to check anchorage
and flexibility.

Breakers could
dislodge relative
to cabinet.

HVAC Systems

Fan and cooler units.

Check if the units are
supported on vibration
isolators. If so, needs
a margin review.

Examine if there is a
lateral stop.

67


fragilities with the site seismic hazard. The contribution to these
frequencies from earthquakes below 0.3g was estimated to be very small
regardless of which family of seismic hazard curves was used.

3.4 Current SSE Design Practice

Safety-related structures, equipment, and piping and other systems in a
nuclear power plant are designed to withstand the effects of a Safe Shutdown
Earthquake (SSE) and an Operating Basis Earthquake (OBE). The ground response
spectra for the SSE and OBE of recently designed plants are specified in
Regulatory Guide 1.60. Regulatory Guide 1.61 specifies the damping ratios for
different structures, piping and equipment. The NRC Standard Review Plan
(Ref. 9) describes the procedures for soil-structure interaction analysis, and
structural and piping response analysis. It also describes the seismic
qualification methods for equipment. The load combinations and stress
allowables are specified in the applicable AISC, ACI, and ASME codes and in
the NRC Standard Review Plan. This design practice is intended to assure that
structures and equipment respond essentially within the elastic range and that
the plant can be safely shut down following the SSE.

The earthquake review level used in this report is a performance-check
earthquake, it is not intended to be related to the SSE. The plant has
already been designed for the SSE using conservative methods. The purpose of
the seismic margin review is to estimate an earthquake level for which we have
a high confidence of a low probability of failure of the plant. The HCLPF
point for any component is the earthquake level at which failure is extremely
unlikely. This capacity is expected to be higher than the design capacity
corresponding to the SSE because of conservatisms built into the nuclear power
plant design process. Conservative specification of the earthquake input
(i.e., response spectra), conservative building and component response
calculations, and conservative allowable stress limits all contribute to the
margins that exist. As explained in Section 4.8, more realistic criteria
should be used when evaluating the performance of components for the
earthquake review level than were used in the (SSE) design. In design
practice, all safety-related structures, systems, and components are analyzed
and designed to meet the design criteria. In a seismic margin review, a
screening procedure is adopted to select a subset of these components for
margin evaluation. This screening is based on the importance of the
components to the Group A safety functions and the seismic capacities of
generic categories of components.

3.5 Systematic Evaluation Program

During the 1977-1982 period, some older operating nuclear power Plants were
reviewed under the NRC's Systematic Evaluation Program (SEP). These plants
were designed and constructed during the period when seismic design procedures
were in a state of rapid change. In many cases, these plants were designed to
criteria that are less rigorous than the criteria specified today in NRC
regulatory guides and the Standard Review Plan. Hence, the SEP focused on a
review of these plants in light of current criteria with the objective of
seismic upgrading. The approach in SEP consisted of a detailed inspection of
the plant, review of existing documentation, reports, plans and calculations,
and a reanalysis of critical structures and equipment using less conservative

28


to determine the support-system success criteria needed for each front-line
system. The support-system success criteria are expressed in terms of those
portions of the systems and their operating mode needed to support a front-
line system (or group of front-line systems).

There may be large portions of a support system that do not provide any needed
supporting function. These portions can be eliminated from further
consideration. However, care must be taken not to eliminate any portion of a
system or a component that may render the entire support system incapable of
performing a needed supporting function.

All support system components should be recorded and a simplified schematic of
each system developed in a manner consistent with the front-line system
schematics previously discussed. In addition, a matrix of the front-line
systems and needed support systems should be developed. The general locations
of these components also needs to be recorded.

Many support~-system components also require support. Any additional support
systems and components also need to be identified, recorded, and a simplified
schematic developed in addition to a general description of their location in
the plant. A matrix of the support systems and their supporting systems
should also be developed.

Support systems and their supporting systems are identified by ASEP, which
also provides simplified schematics. This information, if available, can be
used in lieu of performing the above analysis to indicate which systems should
be considered for a particular plant under review. In this case, no further
analysis or justification would be required.

4.2.6 Documentation of Initial Systems Review

The results of Step 2 are a list of components needed to actuate, perform,
control, and support the Group A functions of:

o Reactor Subcriticality and Early Emergency Core Cooling,

o Several simplified schematics of the front-line and support systems
that fullfill these functions, and

o Systemic event trees.
The format for presentation of the results of this step is given in Chapter 6.

The component list should indicate each important component, its designation,
a brief description of its use and operating mode, and a description of its
Plant location. For example, a particular pump might be described as Pump SI-
2a, Safety Injection Pump for delivery of coolant to the primary system with a
shut-off head of 1500 psi and a maximum flow rate of 200 gpm, located on the
219 ft. elevation of the Auxiliary Building between column lines A-B and 1-2.

During the analysis performed in this step, it will become apparent that

additional information and details will be needed on particular systems and
components. This information could include more details about the support

40


RoomX EL -/32!

~

RWST

VTB
out
puss
wi ne Nt
Fig. 4-3.

1077
uereet
ne IS,
sect pall
or Pree tunnel - El -08
P pe Reactor
te hm ale vessel
blG Sacooling wees PP
tron A
QTR AGE
O° cooting (
| TH
Pump A
cooling P~hiee wall
2) |
n
‘um, VTA plook OY VTA TST penerear?
El. = /SJall
ing Coen wally
dut pectin
‘ump C yi ook opt
Lp - pun Wate
PENETEAT ON TB question abl B (Omm D SroRAGE
El.-157% Anchor. AGS
Section e vom B-EL-1S7'
West Wal

An example of an Annotated Simplified schematic. A fragilities

analyst would verify his findings with a hand-drawn schematic like this one.

While inspecting a particular piece of equipment,

if the fragility

analyst verifies that no weaknesses exist, this result should be noted

and can also be indicated on the simplified schematic.

An example of

an annotated schematic resulting from the first plant walkdown is
shown in Fig. 4-3.

45


systems of a component or the operating mode of a particular safety system.
All needed additional information should be recorded and, if possible, the
source for this information should be identified.

The results of this step will be combined with the results of Step 3 to
determine those systems and components that will be studied during Step 4, the
first plant walkdown. This process is best accomplished by a joint meeting
between the fragility analysts who have performed Step 3 and the systems
analysts who have performed Step 2. The objective of this meeting will be to
plan the first plant visit.

4.3 Step 3 - Initial Component HCLPF Categorization
The tasks in Step 3 are the following:
© Gather information on the plant and its systems and components.

© Identify the target areas and strategy for the first visit to the
plant.

o Start screening out.broad classes or groups of components.

This step needs to be performed by a team of analysts who have experience in
the field of structural and mechanical analysis, and determination of seismic
capacities. It is seen as a pre-screening step where some components will be
screened out prior to the first visit to the plant, by using all the available
information on the plant. The plant visit described in Step 4 will verify the
status of the components identified as targets in Step 3.

The next subsection gives some guidance on the type and quantity of
information needed to carry out Step 3 (subsection 4.3.1). Subsection 4.3.2
provides some guidance on how to identify the target areas for the first plant
walkdown.

4.3.1 Gathering of Information

The fragility analyst needs to have the necessary information that describes
the structural features of the plant including buildings, tanks, pipes etc.,
and all the related features which could have an impact on the review. Given
the large amount of documentation available to the owners of any given plant,
the analysts will have to be selective in their requests for information. The
analysts can proceed in two steps to gather the necessary information.

Step A:

The analysts will collect all the basic information of a generic or global
nature necessary to understand the overall functioning of the plant. This is
described by, but is not limited to the following list of items.

4l


TABLE 4-3

EXAMPLE ITEMS TO FOCUS ON IN A PLANT WALKDOWN DURING
MARGIN REVIEW FOR EARTHQUAKES BETWEEN 0.3 AND 0.5G PGA

(Continued)

COMPONENT ITEM TO BE EXAMINED COMMENTS,
Blockwalls Are they reinforced or Walkdown to
laterally supported? identify

Are they near any safety-
related equipment? Can
arching action be developed?

any potential
systems interaction.

Piping (all accessible
runs in selected
safety-related

piping systems)

Look for piping details which
could be potential problems,
including:

Short, stiff pipe sections
between equipment, and between
equipment and supports
(including wall penetrations).

Long flexible pipe runs which
could swing and impact other
pipes or equipment.

Supports with expansion
anchor bolts (may have
to be done by reviewing
construction drawings).

Small pipes connected between
large flexible pipes.

Piping between buildings.

70

If equipment moves
(e.g., flexes or
Slides) piping
could fail

Valve operators
could be damaged
if they impact
other equipment or
structures.

Failure could occur
because of large
relative displace-
ment caused by
rocking or sliding
of buildings.


The peer review team should also consist of engineers experienced in plant
systems analysis, structural and mechanical/electrical equipment, and
fragility analysis.

5.3 Schedule

The seismic margin review is expected to be completed in eight months as shown
in Figure 5-1.

Calendar months

0 1 2 3 4 5 6 7 8
® Collect information a
0 2
@ Plant walkdown 1.5 3.0
— First | 45 6
— Second a
0.5 3.5
®@ Systems analysis
1.5 7
© HCLPF calculations |
- 6 8
© Report writing Ee
. 0 8
© Quality assurance nl

Fig. 5-1 Schedule for Seismic Margin Review.

80


components. Guidance for determining these front-line systems, support
systems and the components along with developing system models can be obtained
in the IREP Procedures Guide (Ref. 11), the PRA Procedures Guide (Ref. 12),
and the methods being developed in the Accident Sequence Evaluation Program
(ASEP) (Ref. 13). An example of the front-line and support systems that
perform the safety functions for the Millstone 3 Plant is given in Ref. 1.

The techniques and results developed by ASEP are particularly applicable to
the performance of the systems analysis steps (3, 5, and 7) presented in this
chapter. ASEP has categorized the safety systems configurations of the
various nuclear plants and developed, for each specific configuration,
simplified schematic diagrams and fault trees for both the front-line and
support systems. In addition, ASEP has developed event trees for both PWRs
and BWRs.

Because the ASEP information and plant models have been reviewed and are well
documented, using this information as a basis for the systems analysis portion
of the seismic margin review is recommended and documenting the development of
the systems models can be made by reference. However, if ASEP does not
provide sufficient information or the analysts prefer to develop the systems
models and schematics independently, documentation of their justification,
development, and analysis must be provided.

To perform this step, plant-specific information and data must be readily
available for the plant under review. This information includes, for example,
the Safety Analysis Report (SAR), system descriptions, plant configuration
diagrams, piping and instrument diagrams (P&IDs), operating procedures, and
any other supporting documentation that gives details of the configuration,
actuation, operation and control of the safety systems, and their supporting
systems at the plant.

4.2.1 Define Initiating Events

Starting with the information given in Table 2-3, the initiating events for
the analysis must be defined in light of the two Group A plant functions that
were found to be most important to seismic induced core melt. There are
several initiating events that should be considered.

The transient events initiated by the loss of offsite power should be
considered. These initiating events will test the reactor subcriticality
function along with the ability of the plant to depressurize and provide
cooling to the reactor vessel. The loss of offsite power initiating event will
be representative of several transient initiators since many plant systems
rely on offsite power for their operation. Other transient initiators that
are not represented by the loss of an offsite power event should be considered
with respect to a seismic event and the performance of the Group A functions
at the plant under review. References 11 and 12 provide lists of transient
initiating events that should be reviewed for their applicability.

The initiating events that result in the loss of reactor coolant system (RCS)
integrity must be considered. These initiating events are the small, medium
and large loss-of-coolant accidents (LOCA). The small LOCA will require the
reactor subcriticality function and portions of the early ECC function. In

35


NRC FORM 336 Us. NUCLEAR REGULATORY COMMISSION [| AFPORT NUMBER (Asiianed bv TIDE 20d Vol No, iV anyT

(206)

boon, 3202" BIBLIOGRAPHIC DATA SHEET NUREG/CR-4482 DRAFT

SEE INSTRUCTIONS ON THE REVERSE. UCI D-20579

TTITLE ANO SUBTITIE @ LEAVE BLANK

Recommendations to the Nuclear Regulatory Commission on

Trail Guidelines for Seismic Margin Reviews of Nuclear

Power Plants zy Se,

Draft Report for Comment wonTH YEAR

5. AUTHORIST December 1985

© DATE REPORT ISSUED

MONTH YEAR

P.G. Prassinos, M.K. Ravindra, J.B. Savy March

7, PERFORMING ORGANIZATION NAME AND MAILING ADDRESS [inclade Bip Code] 7. PROIECT/TASKMORK UNIT NUMBER

Lawrence Livermore National Laboratory —

7000 East Avenue

Livermore, CA 94550 A0398

10" SPONSORING ORGANIZATION NAME AND MAILING ADDRESS Minclade Zip Code] Tio, TYPE OF REPORT

Division of Engineering Technology Technical

Office of Nuclear Regulatory Research
U.S. Nuclear Regulatory Commission
Washington, DC 20555

PERIOD COVERED Wnclusive dates)

12. SUPPLEMENTARY NOTES

13. ABSTRACT (200 words or less]

This report is the third report of the Expert Panel on the Quantification of Seismic
Margins. The objective of this report is to present detailed guidelines for the

performance of seismic margin reviews of nuclear power plants.

The guidelines pre-

sented in this report are based on the Panel's second report entitled "An Approach

to the Quantification of Seismic Margins in Nuclear Power Plants."

It is intended

that these guidelines be used in at least one trial plant review to demonstrate

whether the approach and the quantification techniques are adequate.

Based on lessons

learned from these trial reviews, the Panel can then be more prescriptive about

defining guidelines for general use.

14, DOCUMENT ANALYSIS — o. KEYWORDS/DESCRIPTORS

seismic margins review guidelines

b. DENTIFIERS/OPEN-ENDED TERMS
seismic
seismic design
seismic margins

TS-AVAILABILITY
STATEMENT

Unlimited

he. SECURITY GLASSIFICATION|
Tha pal
Unclassified

Tihs eepord

Unclassified

7. NUMBER OF PAGES

ie PRICE



NUREG/CR-4482
UCID-20579

Saas

Recommendations to the Nuclear
Regulatory Commission on Trial
Guidelines for Seismic Margin

Reviews of Nuclear Power Plants

Draft Report for Comment

OOOO ——————

Manuscript Completed: December 1985
Date Published: March 1986

Prepared by

P. G, Prassinos, M. K. Ravindra, and J. B. Savy, under the guidance and with. the concurrence of the
Expert Panel on the Quantification of Seismic Margins: R. J. Budnitz (Chairman), P. J. Amico, C. A.
Cornell, W. J. Hall, R. P. Kennedy, J. W. Reed, and M. Shinozuka.

Lawrence Livermore National Laboratory
7000 East Avenue
Livermore, CA 94550

Prepared for

Division of Engineering Technology
Office of Nuclear Regulatory Research
U.S. Nuclear Regulatory Commission
Washington, D.C. 20555

NRC FIN No. A-0398


HCLPF

High Confidence of Low Probability of Failure. The concept of the HCLPF is
discussed in Section 2.3 of Ref. 1.

INHERENT RANDOMNESS

The variability observed from sample to sample of a physical phenomenon; it
cannot be reduced by more detailed evaluation or by gathering of more data.

INITIATING EVENTS

Events that exceed the operating allowable limits of a nuclear power plant,
therefore requiring that the plant be shut down. An event tree is associated
with each initiating event. Two major categories of initiating events are
recognized: Pressure-boundary rupture and transient initiation. These
categories are subdivided according to the capabilities of the particular
Plant systems required to maintain the plant in a safe condition. An example
of a pressure-boundary rupture is the rupture of a large pipe. A transient
initiation does not involve rupture (e.g., the trip of a turbine).

INTERNAL INITIATING EVENT

An initiating event that is caused by occurrences or failures that are
internal to the physical systems of the plant. These events are in contrast
to external initiators that result from occurrences external to the physical
Plant systems such as earthquakes, tornados, floods, fires, aircraft impact,
and explosions.

ISAP

Integrated Safety Assessment Program. A pilot program of the NRC intended to
Prioritize safety issues on a plant-specific basis using available analyses
and PRA results.

LATE MELT

A term used to indicate the time at which the core melt event occurs relative
to the operation of safety systems designed to prevent it and the amount of
radioactivity present in the core. Core melt is "late" when it occurs after
the successful operation of safety systems designed to provide core cooling
immediately upon the initiation of a severe accident; and after the failure of
those systems designed to provide core cooling or containment cooling in the
long term.

LOCA

Loss-Of-Coolant Accident. An accident caused by a break in the reactor
coolant system pressure boundary.

98


For structure/equipment qualified by analysis, the response of the equipment.
is calculated using the above structural and equipment response parameters.
Potential failure modes of the equipment are identified. The static inelastic
capacities of the structure/equipment are estimated. If the capacity of the
structure/equipment exceeds the calculated response for the load combination
(Normal + Earthquake Review Level), it is assumed that the component has a
HCLPF value exceeding the earthquake review level peak ground acceleration.
For equipment qualified by test, the floor spectrum for median equipment.
damping is generated using the above conservative structural and/or equipment
response parameters. If the floor spectral values throughout the equipment
frequency range of interest are less than generic equipment ruggedness
spectrum (GERS) for the equipment (Ref. 18), it is assumed that the equipment
has a HCLPF exceeding the earthquake review level PGA. So far, GERS has been
developed for seven classes of equipment (i.e., motor-operated valves, motor
control centers, switchgear, batteries and battery racks, inverters, battery
chargers, and relays). For other equipment, one should use the highest
spectral value for which similar equipment has been qualified as the capacity.

The GERS will be lower than the lowest observed failure level for the
equipment (i.e., the GERS is the highest level for which the equipment did not
fail). For equipment mounted on floors at higher elevations in the structure,
the conservatisms in floor spectra generation and the conservatisms in
structural parameters (i.e., damping and system ductility) yield HCLPF values
that are considerably less than the median capacities. However, for equipment
on grade that do not include significant response conservatism, use of GERS or
experience data may not guarantee that there is no "cliff" in the capacity
beyond the value of HCLPF (i.e., the component may fail suddenly when the peak
ground acceleration exceeds the HCLPF value, instead of a gradual increase in
the probability of failure increases). To avoid this problem, it is
recommended that the capacity determined by experience data for grade level
equipment be reduced by a factor. This factor may be determined during the
trial plant reviews.

By a judicious selection of the values of different parameters, the CDFM
method aims to produce a conservative estimate of the component's HCLPF.
However, the CDFM method is less conservative than the procedures given in the
Standard Review Plan (Ref. 9). The load combination specified is more liberal
compared to the SRP requirements, i.e., no OBE load combination and no LOCA +
review earthquake load combination in the CDFM method. The ground response
spectrum is a 84% nonexceedence probability site-specific spectrum and is
expected to be less conservative than the R.G. 1.60 spectrum. Similarly, the
damping values proposed for the seismic margin review are more liberal than
those specified in the Standard Review Plan.

The basis for the selection of values of different Parameters in the CDFM
methods and how they contribute to the high confidence in the capacity that
assures a low probability of failure should be studied. For example, the use
of 84% nonexceedence-probability site-specific spectrum and conservative
estimates of the median damping are expected to result in a computed capacity
indicating a low probability of failure. ‘The use of material strength at 95%
exceedance value and 84% exceedance value for static capacity prediction
equations is expected to contribute to the high confidence statement about the
capacity. However, this approach cannot be used to determine the

58


3.

4.

o A reactor operator or utility engineer familiar with the plant
systems,

o An electrical technician capable of deenergizing and opening
electrical cabinets for anchorage inspection.

An orientation meeting among the systems analyst, the fragility
analyst, and the plant operating personnel should take place for
exchange of general and plant-specific information.

The walkdown by the systems analyst is expected to:
oO Verify P&ID correctness as to system configuration
© Look for potential systems interactions
© Verify locations of each piece of equipment
o Identify unusual features in the plant

o Advise on the significance of different failure modes of
components identified by the fragility analyst.

For example, the following failure may or may not be significant to
core melt:

© Objects (e.g., roof slabs, adjacent unreinforced masonry walls)
falling on the component or on the electrical cabinets supplying
power and control to the component.

o Tank failures flooding the vicinity of the component.
© Direct seismic failure (e.g., anchorage failure).

Certain valve failure modes may or may not be important. For example,
valve stem sticking may or may not be important depending on whether
the valve has to move or not during an earthquake. Identification of
potential failure modes of a given component will assist in decisions
on the significance of different systems interactions.

During the plant walkdown, the systems analysts should record the
above information directly on the simplified schematics that were
developed in Step 2. The arrangement of the equipment being reviewed
within rooms or vaults should be recorded along with the location of
any other items whose failure may possibly affect the equipment or
components. These items can be drawn directly on the schematic. The
room or vault identification and elevation should be recorded. The
location of electrical equipment, and if appropriate, its attachment
location should be shown. The location of piping penetrations through
walls should also be indicated. Any overhanging piping, ducting,
and/or equipment, such as HVAC, should be indicated along with the
existence of tanks and floor drains within the equipment rooms.

44


GLOSSARY

ACCIDENT SEQUENCE

A combination of failures and/or successes of plant systems or functions
beginning with an initiating event. Accident sequences are branches of event
trees. Several accident sequences are possible for a given event tree, each
describing a different branch. Each accident sequence describes a unique
combination of event failures and/or successes.

ASEP

Accident Sequence Evaluation Program. A long term NRC program intended to
Provide generic models of fault-trees and event-trees for simplified
estimation of accident-sequence frequencies of core melt for U. S. nuclear
power plants.

ATWS

Anticipated transient without scram. Transient initiating event with an
associated failure to effectively stop the fission chain reaction.

BASIC EVENTS

The lowest level of event representation on a fault tree. A basic initiating
fault requiring no further development.

BEST ESTIMATE VALUE

Any reasonable statistic can be considered as the proper choice of estimator
of a given parameter. The question of choosing the best estimator is
ambiguous until "best" is defined. Desirable properties of an estimator could
be, for example, being unbiased or promising the minimum mean square error.
The best estimate fragility is chosen by the Panel as the median curve.

BOOLEAN EXPRESSION

Boolean algebra deals in situations involving dichotomy. Switches are either
Open or closed, valves are either open or closed, events either occur or they
do not occur. It is defined as the algebra of events the product of which is
a set of logic equations that summarize the possible states of a system. A
fault tree can be thought of as a pictorial representation of those Boolean
relationships among fault events that cause the top event to occur.

CAPACITY

The ability of a component to sustain a load measured in terms of the load
level (e.g., stress, moment, or acceleration) below which the component
continues to perform its functions. Not to be confused with fragility. In
Fig. G-1 on the following page, curve 2 is associated with a component having
higher capacity (strong component) than the one associated with curve 1 (weak
component) .

93


TABLE 2-1
SUMMARY OF CAPACITY ASSESSMENT OF NUCLEAR POWER PLANT COMPONENTS

(Taken from Ref. 1, Table 5.1)

Component. Peak Ground Acceleration Range

<0.3g 0.3-0.5g >0.5g

1. Containments
a. Prestressed and reinforced c (1) (2)

concrete
b. Steel (3) (3) (3)

2. NSSS Supports c (4) x

3. Reactor Internals (3) x x

4. Control Rod Drive Mechanisms c x x

(1) The capacities of major penetrations should be evaluated. HCLPF value exists
for containment structure.

(2) The concrete containment structure should be evaluated for pga greater than
0.8g. Minor penetrations should be evaluated for potential leakage for pga
greater than 0.59. Capacities of major penetrations also should be evaluated.

(3) Sufficient data are not available for recommendations to be made by the Panel.

(4) Evaluation should be conducted only for BWR recirculation pumps.

C  HCLPF value is adequate for this acceleration range.

X Margin evaluation for all potential failure modes is required to determine the

HCLPF value. In addition, margin evaluation (or exceptions) is required as
discussed in (1) through (4) above.

18


2.3 Schematic Representation of the Mechanics of the Review

This section provides a flow chart overview of the review scheme. Eight steps
are identified that are likely to be performed in chronological order. A
detailed description of these steps is given in Chapter 4 of this report.

Figure 2.7 describes the flow of tasks to be performed in eight steps. The
purpose of steps 1 through 6 is two-fold. On one hand, the Process screens
"out" the components and systems that do not contribute to core melt at the
review level (either because they do not affect the functions of Group A or
because the estimate of their HCLPF is higher than the review level). On the
other hand, the process provides the information necessary to build the final
fault trees for systems and event trees to develop the cut-sets for the end
point "core melt".

The steps appear to have different emphases. Steps 3, 6 and 8 are mostly
concerned with capacity assessment and are performed by a team of fragility
analysts. Step 3 relies more on judgment and experience than on engineering
analysis while steps 4 and 6 rely on analysis, possibly a detailed engineering
analysis. Steps 2, 5, and 7 are concerned with functions and are performed by
a team of systems analysts.

2.4 Description of the Eight Steps of the Review:

Step 1 - Selection of Earthquake Review Level

It is assumed that some organization (perhaps the NRC staff, or the utility)
has designated the earthquake level for which a margin review is to be
performed. The review process may, however, use a different (higher)
earthquake level referred to as the earthquake review level, as described in
More detail in Section 4.1. The selection of the earthquake review level is
the first step in the review procedure. When this "review level" has been
established, the margin review will require seven subsequent steps, generally
to be taken in chronological order. Note that Steps 2 and 3 must be performed
before Step 4, and that Steps 5 and 6 must be performed before Steps 7 and 8,
but after Step 4. Steps 2 and 3 could be performed in parallel, but most
likely Step 2 would be started before Step 3. Steps 7 and 8 could be
performed in either order (see Fig. 2-7).

Step 2 - Initial Systems Review

Beginning with information in Table 2-3 of this report, the systems analyst
should determine which functions (Group A functions) need be considered
further. These functions are screened in and the systems analyst should
determine which systems are used in the plant to carry out the functions, and
which components support these systems. These Group A components are carried
forward to Step 4.

Step 3 - Initial Component HCLPF Categorization

The fragility analyst should gather the information about the structural,
equipment, and related features of the plant needed to carry out the
fragilities part of the margin review. A key part of this step is the

14


FAULT TREE

A fault tree analysis can be simply described as an analytical technique,
whereby an undesired state of the system is specified (usually a state that is
critical from a safety standpoint), and the system is then analyzed in the
context of its environment and operation to find all credible ways in which
the undesired event can occur. The fault tree itself is a graphic
representation of the various parallel and sequential combinations of faults
that will result in the occurrence of the predefined undesired event.

FILTER

A series of criteria used to sort the components of a nuclear power plant into
different classes. In this report, this filtering process is sometimes called
“a screening operation" or "“sorting." The criteria used to perform the
filtering are based on the capacity level (HCLPF) of the components relative
to the earthquake review level and a determination as to whether they support
Group A functions.

FRAGILITY

Conditional probability that a component would fail for a specified ground
motion or response-parameter value as a function of that value. (See
“CAPACITY.")

FRAGILITY CUTOFF

The lower tail of a fragility curve may be truncated at some peak ground
acceleration (PGA) value on the basis that seismically qualified components do
not fail below this value.

FRONT LINE SYSTEMS

Systems that are necessary to perform a safety (Group A) function.

FREQUENCY (of occurrence)

In this report: rate per unit of time. The mean rate of occurrence of
earthquakes is a measure of frequency.

GROSS _ERRORS

Design and construction errors are those deviations that place the component
capacity outside the range of natural variation; gross errors are those that
have significant impact on components or plant margins.

GROUND ACCELERATION CAPACITY

The seismic capacity of a component measured in terms of the peak ground
acceleration value at which the component would fail.

HAZARD CURVE (seismic)

Frequency of exceeding a pga versus pga, usually expressed on a per-year basis.

97


hazard analysis results and from the fact that the fragility
evaluation relies heavily on analysts' judgment in the absence of
actual fragility test data. Although the total uncertainty in the
seismic risk estimates is considered by some to be larger than the
uncertainties of risks from internal accident initiators, one possible
explanation is that seismic PRA explicitly includes modeling
uncertainties (Ref. 5).

In theory, a seismic PRA can provide complete answers regarding the seismic
safety of the plant. However, a seismic PRA done for risk estimation purposes
is a controversial and cumbersome way to do a seismic margins evaluation. It
is recognized by the Panel that precise risk estimates are not needed to
resolve most seismic margin issues. The concept of HCLPF value avoids some of
the problems associated with the use of seismic PRA. The problem is narrowed
down to the following: given an earthquake review level, the seismic margin
review methodology assesses whether the plant can survive that earthquake with
high confidence. Seismic margin reviews will establish an estimate of the
minimum seismic capacity of the plant. In contrast, seismic PRAs give
additional information on seismic capacity in a probabilistic format.

Both seismic PRAs and seismic margin reviews can identify dominant
contributors to seismic induced risks. In the case of seismic PRA, the need
to upgrade is decided on the basis of significance of contributions to the
overall seismic risk. Because of the relatively shallow slope of the seismic
hazard curves in the region of interest, seismic PRAs have generally indicated
that extremely large increases in seismic capacities are needed to
significantly reduce the seismic risk.

A fundamental difference between the seismic PRA and the seismic margin review
is that the seismic margin review requires an earthquake review level to be
specified. In the seismic PRAs, the random unavailability of components is
treated directly. In a seismic margin review, random unavailability must be
considered as described in Chapter 4. A seismic margin review gives less
information on the seismic safety of a plant than a seismic PRA, a seismic
margin review does provide a high confidence statement of the seismic capacity
of the plant.

Table 3-1 gives a comparison of the seismic margin review methodology
described in this report with the seismic PRA methodology as currently
practiced.

3.2 Deterministic Code Margin Studies

Some nuclear power plants have been reanalyzed for seismic margins when the
definition of seismic hazard, ground motion, or other characteristic was
revised. For example, Midland Station was reevaluated for existing margins
when the ground response spectra and peak ground accelerations were revised
from 0.12g to 0.14g (Ref. 6).

In code margin studies, code (elastic-computed) seismic margins are computed
using possibly less stringent response parameters (e.g., site-specific spectra
and higher damping than RG 1.61 limits) and less stringent load combination
(normal plus seismic) but assuming essentially elastic behavior and capacities

26


4.5.2 Fault Tree Development

A fault tree model should be developed for each of the front-line systems used
in the event trees and their support systems The front-line and support
systems were identified in Step 2 and their applicability to the event trees
was verified in the first task of this step. A detailed technical discussion
of fault tree modeling can be obtained from the "Fault Tree Handbook"
(Ref. 15).

The development of fault trees will be facilitated by the use of piping and
wiring segments. The simplified schematics developed in Step 2 should be
decomposed into piping or wiring segments by placing a node on the drawings at
each point where two or more wires or pipes intersect. Each portion of the
system between nodes is a segment.

The development of fault trees using the system segment approach is presented
in "Modular Fault Tree Analysis Procedures Guide" (Ref.16). Individuals only
slightly familiar with fault tree construction will find this document to be
an exceptionally useful aid to the development of these trees.

The front-line fault trees are developed with consideration of the branch
point conditions in the event tree which they represent. The top-level logic
of the fault trees should be constructed in terms of the piping or wiring
segments. The basic events of the front-line system fault trees should
include the failure modes of each front-line segment that is of continuing
concern and the segments that are intersected with these segments. The failure
modes for components in these remaining segments were determined in Step 4,

When determining the failure modes for each segment, the following failure
causes should be considered:

© Direct seismic failure of the segment,

o Failure of the segment's support system(s),

o Test and maintenance unavailability,

° Human errors,

° Segment failure as a result of a system interaction such as the
shorting of station batteries due to the seismic failure of
ventilation ducting located directly above the battery racks,

o Segment failure as a result of the seismic failure of a unique global
feature such as flooding due to the seismic failure of a nearby dam or
levee,

o Random failures.

The completed front-line system fault trees should be reviewed to ensure that
all support system interfaces are included in the tree. The support system

interfaces will be used to define the top events for the support system fault
trees in the context of the front-line system fault tree. The individual

50


14.

15.

16.

17.

18.

19.

20.

21.

22.

R. M. Czarnecki, "Development of Anchorage Guidelines for Nuclear Plant
Equipment," Presented at ASME 1985 Pressure Vessels and Piping
Conference, New Orleans, LA (June 1985).

U.S. Nuclear Regulatory Commission, "Fault Tree Handbook," NUREG-0492
(January, 1981).

G.B. Varnado, W.H. Horton, P.R. Lobner, "Modular Fault Tree Analysis
Procedure Guide," NUREG/CR-3268 (August, 1983).

R. B. Worrell and D. W. Stack, "A SETS User's Manual for Accident
Sequence Analysis," NUREG/CR-3547 (January, 1984)

ANCO Engineers, Inc., "Interim Report: Generic Qualification of
Equipment Using Test Data," prepared for the Electric Power Research
Institute by C. B. Smith and K. L. Merz (April 1982).

L.E. Cover, et al., "Handbook of Nuclear Power Plant Seismic
Fragilities," NUREG/CR-3558, UCRL-53455 (June, 1985).

Bari, R.A.,et al., "Probabilistic Safety Analysis Procedures Guide,"
NUREG/CR-2815, Revision 12 (August, 1985).

S. Kaplan, "On the Method of Discrete Probability Distribution in Risk
and Reliability Calculation," Risk Analysis Journal, Vol. 1 (1981).

g.W. Reed, M.W. McCann, J. Ihara and H. Hadidi-Tamjed, "Analytical
Techniques for Performing Probabilistic Seismic Risk Assessment of
Nuclear Power Plants," in Structural Safety and Reliability, Proc. of 4th
International Conference on structural Safety and Reliability, Vol. III-
Pp 253-263, Kobe, Japan (May 1985).

104


TABLE 4-2

EXAMPLE ITEMS TO FOCUS ON IN A PLANT WALKDOWN DURING
MARGIN REVIEW FOR EARTHQUAKES LESS THAN 0.30G PGA

(Continued)

COMPONENT

ITEM TO BE EXAMINED

COMMENTS

Control Room Ceilings

Inspect for adequate bracing

Check area above lightweight
control room ceiling units
for heavy reflective panels
or equipment (e.g., air
conditioning equipment).

Reflective panels
may fall through
ceiling and damage
control instruments
or injure operators.

Dams, Levees and Dikes

If they exist and their
potential failure may have
significant consequence to
Plant safety, they should be
inspected to assess their
existing condition and
vulnerability to earthquakes.

68


TABLE 2-1

SUMMARY OF CAPACITY ASSESSMENT OF NUCLEAR POWER PLANT COMPONENTS

(Continued)

Component. Peak Ground Acceleration Range

<0.3g 0.3-0.59 >0.5g

8. Valves c (10) x

9. Heat exchangers (11)x (11)x x

10. Tanks (12)x (12)x x

11. Batteries and Racks (13) (13) x

12. Active Electrical Equipment (14) (15)x x

(capacities given for structural
failure mode. Relay chatter and
breaker trip failure modes must
be evaluated for all earthquakes
selected for screening exceeding
the design basis.)

13. Diesel Generators c (16)xX x

14 Pumps c (17)X x

(10) Evaluation should be conducted only for motor-operated valves on lines
2 in. in diameter or less.

(11) Support and anchorage failure modes should be evaluated.

(12) Except for connecting piping, buried tanks do not have to be evaluated.

(13) Inspection during walkdown may indicate that battery support, racks, and
anchorage are sufficiently rugged and margin evaluation is not required.

(14) Walkdown should be conducted to verify that the cabinets are securely
anchored to the floor or walls, and the instruments are rigidly attached
to the cabinets.

(15) Margin evaluation should focus on cabinet anchorage and attachment of
instruments to cabinet.

(16) Margin evaluation should focus on anchorage and support of peripheral
equipment.

(17) Margin evaluation is required only for vertical pumps with shafts
unsupported at their lower ends or casings with lateral supports greater
than 20 ft. apart. An exception is in cases where the shaft and casing
are less than 20 ft. long. For this case, margin evaluation is not
required for pga less than 0.5g.

c HCLPF value is adequate for this acceleration range.

x Margin evaluation for all potential failure modes is required to

determine the HCLPF value. In addition, margin evaluation (or
exceptions) is required as discussed in (10) through (17) above.

20


TABLE 6-1

DESCRIPTION OF COMPONENTS OF SAFETY SYSTEMS

Seismic
Qualification
System Component. Location Method/Reference
NSss Steam Generator Containment Dynamic Analysis
Lower Support Calculation
El. 538" Package #
Upper Support
El. 573"
Residual Heat RHR Pumps Aux. Bldg. Dynamic Analysis
Removal El. 495! Calculation
Package #
Electrical Power 4160V Switchgear Aux. Bldg. Test Seismic
El. 567° Qualification
Report #
TABLE 6-2
HCLPF VALUES OF CRITICAL COMPONENTS
IN GROUP A FUNCTIONS
HCLPF Values HCLPF Value
Cut set of Components (g) of Cut set (g)
Singles
EGECLPSE 0.30 0.30
EDGOILCL 0.30 0.30
DFCNTBLD 0.39 0.39
Doubles
RWST * COREGEOM (0.30, 0.35) 0.35
EGECLPSE * CRDS (0.30, 0.33) 0.33

86


EXECUTIVE SUMMARY

Recent studies by the nuclear industry and the NRC indicate that nuclear power
plants are capable of withstanding earthquake motion substantially greater
than the safe shutdown earthquake (SSE) acceleration. However, there has not
been any systematic program performed by the industry or the NRC to quantify
the actual seismic capacity of the plants. For several reasons, especially in
light of the changing perception of the seismic hazard, there is a continuing
need to determine this capacity for licensing purposes. The NRC and the
industry are developing soundly based, efficient, and effective methods for
identifying how much margin actually exists in important safety-related
components, structures, systems, and the plant as a whole. These methods are
designed to be applied when questions arise about the seismic capacity of a
plant.

This report is intended to give the details of performing a seismic margin
review of a nuclear power plant. The level of effort and cost associated with
performing a seismic margin review are dependent on its scope and end use.
The objective is to determine whether a plant can resist with high confidence
a specified earthquake level greater than the SSE. To accomplish this
objective, analyses are performed on components, systems, and the plant as a
whole to determine whether there is a high confidence of a low probability of
failure (HCLPF).

The margin review process involves both the screening of components based on
their importance and seismic capacity, and the quantification of HCLPF values
for components, systems, accident sequences, and the plant. Systems analysis
is used to determine those plant systems and components that are important
contributors to plant seismic safety and thus allow focusing of effort on
components requiring a margin review. By studying previous PRA studies, the
Panel found that, for PWRs, there are primarily two plant-safety functions
that were identified as being the major contributors to plant seismic safety:
reactor subcriticality and early emergency core-coolant injection. For PWRs,
the initial candidates for margin review will include those components that
make up the systems that perform and support these two functions. At the
present time, for BWRs, the margin review will include all components and
structures relevant to the plant safety functions.

Concurrently, knowledge of the inherent capacity of components (structures and
equipment) obtained from previous Probabilistic Risk Assessments, and
Presented in NUREG/CR-4334 (Ref. 1), is used to screen out high capacity
items. However, all important components are initially reviewed and inspected
to assure that their seismic capacity can be represented by the generic
information used for this screening before they are dropped from further
consideration. In addition, any potential systems interactions and important
plant-unique global features that are discovered are added to the list of
review items.

The components remaining after the systems and fragility screenings plus the
system interactions and plant-unique global features are then subjected to a
margins quantification. Prior to this quantification, each remaining
component is thoroughly inspected and studied, and system models are developed


TABLE 4-3

EXAMPLE ITEMS TO FOCUS ON IN A PLANT WALKDOWN DURING

MARGIN REVIEW FOR EARTHQUAKES BETWEEN 0.3 AND 0.5G PGA

COMPONENT

ITEM TO BE EXAMINED

COMMENTS

Containment:

Review major penetrations.

NSSS Supports

Review the support details.
Check if any tests

were done to verify that
snubbers can lock up.

Structural Failures

ae

Cc.

Shear walls, diaphragms
footings:

Inspect the connection details
between panels and columns.

Special non-ductile details:
Check if large openings exist,
in shear walls or in floor
(roof) diaphragms.

Inspect the connection details
between panels and columns.

Impact between buildings:
Check if the gap between
buildings is as large as
shown on drawings.

Inspect size of expansion

and seismic joints between
structures.

69

Needed only if ACI
318-71 or ACI 349-
76 requirements are
not met or if the
plant was designed
for less that 0.1g
SSE.

Confirm that joint
size complies with
plans and specs.


4-4

FRAGILITY PARAMETERS OF COMPONENTS IN A HYPOTHETICAL PLANT

Component A, (9) Bp By HCLPF (g) *
1 0.90 0.20 0.45 0.30
2 0.90 0.24 0.43 0.30
3 1.00 0.24 0.33 0.40
4 1.30 0.24 0.49 0.40
5 0.90 0.30 0.36 0.30
6 1.60 0.25 0.43 0.50

* HCLPF = A, X exp

-1.65 (Bp + By)

75


Table

Table

Table

Table

Table

Table

Table

Table

Table

Table

Table

Table

Table

Table

Table

2-3

3-1

4-1

4-2

4-4

5-1

6-1

6-2

6-3

6-4

6-5

LIST OF TABLES
Identification of Group A and Group B Functions.

Summary of Capacity Assessment of Nuclear Power Plant
Components.

Functions Requiring Detailed Evaluation in Seismic Margins
Reviews.

Comparison of Seismic Margin Reviews with Seismic PRAs.
Plant Function vs. Front~line Systems Matrix.

Example Items to Focus On in a Plant Walkdown During Margin
Review for Earthquakes Less than 0.30g PGA.

Example Items to Focus On in a Plant Walkdown During Margin
Review for Earthquakes Between 0.3 and 0.5g PGA.

Fragility Parameters of Components in a Hypothetical Plant.
Estimated Manpower Requirements for Seismic Margin Review.

Estimated Manpower Requirements for Independent Peer Review
of Seismic Margin Review.

Description of Components of Safety Systems.

HCLPF Values of Critical Components in Group A Functions.
Plant Function vs. Front-line Systems Matrix.

Front-line Systems vs. Support Systems Matrix.

Support Systems vs. Support Systems Matrix.

vii


10.

11.

12.

13.

REFERENCES

R. J. Budnitz, P. J. Amico, C. A. Cornell, W. J. Hall, R. P. Kennedy, J.
W. Reed and M. Shinozuka, "An Approach to the Quantification of Seismic
Margins in Nuclear Power Plants," NUREG/CR-4334, UCID-20444 (July, 1985).

G. E. Cummings, J. J. Johnson and R. J. Budnitz, "NRC Seismic Design
Margins Program Plan," UCID-20247 (October, 1984).

N. M. Newmark and W. J. Hall, "Development of Criteria for Seismic Review
of Selected Nuclear Power Plants," NUREG/CR-0098 (1978).

G. E. Cummings, "Safety Report on the Seismic Safety Margins Research
Program," NUREG/CR-4431, UCID~20549 (December 1985).

U.S. Nuclear Regulatory Commission, "Probabilistic Risk Assessment
(PRA): Status Report and Guidance for Regulatory Application," NUREG-
1050 (February, 1984).

D. A. Wesley, and R. P. Kennedy, "A Systematic Approach to Conducting
Seismic Margin Reviews for Nuclear Power Plants," Structural Engineering
in Nuclear Facilities, Vol. I, American Society of Civil Engineers, New
York, NY (1984).

Kennedy, R. P. (1984), "Various Types of Reported Seismic Margins and
Their Uses," Section 2, Proceedings of EPRI/NRC Workshop on Nuclear Power
Plant Reevaluation for Earthquakes Larger than SSE, Palo Alto, CA
(October 16-18, 1984).

M. K. Ravindra, R. H. Sues, R. P. Kennedy, and D. A. Wesley, (1984), A
Program to Determine the Capability of the Millstone 3 Nuclear Power
Plant _to Withstand Seismic Excitation Above the Design SSE, prepared for
Northeast Utilities, NTS/SMA 20601.01-R2 (November 1984).

U.S. Nuclear Regulatory Commission, Standard Review Plan for the Review
of Safety Analysis Reports for Nuclear Power Plants, Office of Nuclear
Reactor Regulations, NUREG/CR-0800, LWR Edition, (July 1981).

R.P. Kennedy and M.K. Ravindra "Seismic Fragilities for Nuclear Power
Plant Risk Studies." Nuclear Engineering and Design, Vol. 79, No.1,
pp 47-68 (May 1984).

D. D. Carlson, "Interim Reliability Evaluation Program Procedures Guide,"
NUREG/CR-2728, SAND82-1100 (January, 1983).

U.S. Nuclear Regulatory Commission, "PRA Procedures Guide," NUREG/CR-2300
(January, 1983).

U.S. Nuclear Regulatory Commission, "Accident Sequence Evaluation Program
(ASEP), Event Tree Development," Draft, Prepared by Sandia National
Laboratory and Science Applications International Corporation (August,
1985).

103


TABLE 4-3

EXAMPLE ITEMS TO FOCUS ON IN A PLANT WALKDOWN DURING

MARGIN REVIEW FOR EARTHQUAKES BETWEEN 0.3 AND 0.5G PGA

(Continued)

COMPONENT

ITEM TO BE EXAMINED

COMMENTS

Active Electrical
Equipment (Cont.)

Look for slack in cables and
airlines at equipment attach-
ment points.

Look inside electrical cabinets
to determine if relays or other
electrical instruments are
securely mounted.

Inspect lateral restraints on
large breakers

If safe to do so,
push on instruments
to check anchorage
and flexibility.

Breakers could
dislodge relative
to cabinet.

Diesel Generators

Inspect peripheral components
necessary for operation of
equipment:

- Concentrate on anchorage

~ Check if the diesel generator
is. shock mounted

For example, diesel
oil day tank,
compressed air
equipment, lube oil
cooler, control
cabinet, fuel oil
transfer pumps,
heat exchangers,
heating and venting
equipment.

HVAC Systems

Fan and cooler units:

Check if the units are supported
on vibration isolators. If so,
it needs a margin review.
Examine if a lateral stop
exists.

Check the adequacy of
anchorage systems.

Control Room Ceilings

Inspect for adequate bracing

Check area above lightweight
control room ceiling units
for heavy reflective panels
or equipment (e.g., air
conditioning equipment).

73

Reflective panels
may fall through
ceiling and damage
control instruments
or injure operators.


MAGNITUDE

Magnitude is a measure of the size of an earthquake and is related to the
energy released in the form of seismic waves. It is given by the logarithm of
the amplitude of the trace of a seismometer, corrected to represent a set of
fixed conditions. There are several magnitude scales that are representative
of different frequency ranges of the incoming seismic energy.

MEAN PEAK GROUND ACCELERATION (mean pga)

In this report, the mean value of the peaks of the two horizontal components
of acceleration.

MEDIAN VALUE

The value of a variable that represents the 50th percentile of the probability
distribution function. That is, for any given subset of the population, it is
equally likely that the result of a trial will yield a value above or below
the median. In this report, the median of a parameter, A, is indicated as Ap.

MINIMAL CUT SET
See "CUT SET."

OFF-SITE RISK

The probability that social or economic consequences of earthquakes will equal
or exceed specified values at a site, at several sites, or in an area, during
a specified exposure time.

OPERATING BASIS EARTHQUAKE (OBE)

An earthquake that, considering the regional and local geology, seismology,
and specific characteristic of local subsurface material, could reasonably be
expected to affect the plant site during the operating life of the plant. It
is an earthquake that produces vibratory ground motion that will allow the
continued operation of those features necessary for continued operation of a
nuclear power plant without undue risk to the health and safety of the
Public. (See 10 CFR Part 100, Appendix A: Reactor Site Criteria.)

PEAK GROUND ACCELERATION (pga)

See "MEAN PEAK GROUND ACCELERATION."

PLANT DAMAGE STATE

A grouping of accident sequences causing similar physical responses in a
Plant. Characteristics of each plant damage state are used to define initial
conditions for the subsequent analysis of containment failure mode and
radiological release (see release categories). Same as plant damage bin, core
melt bin, and core damage state.

99


For equipment qualified by testing, describe the type of test (e.g., sine-
sweep, sine-beat, and complex-wave form; single or multi-directional), and the
difference between the test response spectrum and the required response
spectrum.

The quality and quantity of plant design data available for the seismic margin
study should be described.

6.3 Screening of Systems and Components

The frontline and support systems that provide the Group A plant safety
functions should be identified and presented in a tabular form (See Tables
6-3, 6-4, and 6-5 for examples). The components (i.e., structures, equipment,
piping systems, HVAC systems, cable trays, and cabling) of these systems
should be identified and tabulated (similar to Table 6-1). This list of
components is a subset of the list developed in Section 6.2.

Components that belong in systems supporting Group A safety functions and that
are screened out because of generic high seismic capacities should be
identified. Methods used to confirm that the screened out high capacity
components do in fact have no weaknesses should be documented. This may
consist of review of the Panel recommendations (contained in Table 2-2), plant
walkdown, and some limited plant-specific calculations. The list of
components screened in should be augmented by including plant-unique features
and system interactions identified in a plant review and walkdown.

6.4 Evaluation of Seismic Margins

Event trees and fault-trees developed using the screened-in components should
be described and the accident (core melt) sequences identified. The "singles"
(event) and "doubles" (event) cut sets or the Boolean expression should be
tabulated for these accident sequences.

An estimate of the HCLPF of components that appear in the "singles" and
"doubles" cut sets should be provided (See Table 6-2 for example). The
Procedures used in estimating the HCLPF of singles and doubles should be
described. If a plant-level HCLPF is calculated, the procedure used should be
descr ibed. Also, the methods used in the structural/mechanical analyses
should be documented.

6.5 Plant Review and Walkdown

The results of a review of plant seismic design criteria and seismic design
analyses should be discussed with particular emphasis on how similar the
components in the plant are to those generic categories discussed in
Table 2-1.

The procedure used, the personnel involved (including their background), and
the findings of the plant walkdown should be described. The results of the
first plant walkdown should be reported in terms of confirmation of the
Presence of safety systems per design documents and the absence of weaknesses
in the assumed high seismic capacity components should be reported. Also, any
plant-unique features, systems interactions, and deviations from design

84


conducted before this plant visit. Certain Group A components suspected to
have generically low capacities might have been screened out using simplified
analyses,

The second plant walkdown is primarily carried out by the fragility analyst,
taking into account the results of the first walkdown, preliminary analysis
and the systems analysis results obtained so far. This walkdown will emphasize
actual physical study of plant components requiring detailed fragility
analysis. Systems analysis input will be needed but in a supporting capacity.

The objectives of this walkdown are:
© To obtain additional specific information (i.e., dimensions, number
and size of anchor bolts, support details, estimate of weight, etc.)
for evaluating the HCLPF values of screened in components, and

© To verify the systems models and collect any additional needed
information.

4.6.1 Plant Walkdown Procedures

By this time, the fragility analyst has a good idea of the components that
require margin evaluation. This second walkdown is used to determine whether
additional components may be screened out using plant-specific data. This is
possible because the Panel's recommendations (Table 2-1) are conservative.

Before conducting the second physical walkdown of the plant, the fragility
analyst should study the design details of each screened in component (e.g.,
design criteria used, details of supports and anchorage systems, qualification
method) using stress reports, equipment qualification reports, and other
sources. He should examine the photographs of the component taken during the
first walkdown to assess the as-built conditions. He should also identify the
potential failure modes of the component so that he can concentrate on those
elements (e.g., anchorage) during the walkdown.

Since the event- and fault-trees are not finalized at this stage, the systems
analyst can make preliminary recommendations that certain components be more
thoroughly studied during the walkdown and that others May not require
extensive analysis because of their function in the plant systems.

During the second plant walkdown, the fragility analyst will determine details
of the components; note the type and size of the anchorage and its arrangement
around the base of the equipment; determine the size of piping and overhang of
the motor actuator, and estimate the actuator weight for motor-operated valves
on small pipes. He will make simple analyses to judge, for example, valve
stem binding or the adequacy of anchorage for the earthquake review level. He
may use the screening tables developed earlier (Sec. 4.4.2) to screen out
additional Group A components.

For the remaining components, detailed measurements (additional to those shown
on design drawings) are taken such that their HCLPF can be estimated. In
practice, this is the last chance for the analysts to inspect and obtain field
information on the screened in components.

52


components. Such screening tables can also be used in the plant walkdown to
minimize inspection time by focusing the data collection (e.g., dimensions,
number and size of bolts, etc.) efforts. A peer review team (see Sec. 5.2) is
expected to critically review these screening tables and approve their use.

4.4.3 Walkdown Documentation
The systems analysts should document the following:

© The accuracy of the P&ID's and the systems descriptions for the
various Group A front-line systems and their support systems.

o Any systems interactions or unique-plant global features uncovered
during the walkdown.

In addition, the systems analyst should have a complete set of annotated
schematics of the Group A, front-line, and support systems along with any
additional documents, analyses, and results of discussions with plant
personnel on the configuration and operation of the plant under review.

The fragility analyst should document the following:

o For each class of components judged to possess high HCLPF values
(larger than the earthquake review level),

- state that anchorage and supports are adequate and similar to the
generic component described in Chapter 5 of (Ref. 1).

- provide example photographs showing the overall view and details of
support and anchorage systems of components screened out.

~- state that no weak spots were observed in the local (supporting)
structures that may make the component vulnerable to earthquakes

- state that there are no seismically weak objects (e.g., block
walls) near the equipment, and that there is no potential for
flooding caused by tank failure or fire caused by obvious
electrical problems.

o Any observed systems interactions and their possible effects on the
functioning of Group A components.

o Information needs for components requiring detailed review.

4.4.4 Plant-Unigque Features

Plant-unique features are systems and components of a specific plant that are
not typically found in other nuclear power plants of the same reactor vendor
type and design vintage. The Panel's recommendations (Ref.1) suggest that the
plant review should identify plant-unique features that may potentially reduce
the seismic margin of the plant. Examples of plant-unique features observed
in past seismic PRA studies are the failure of Jocassee Dam at Oconee, impact
between buildings at Indian Point 2, and a potential stack failure at Turkey

48


Y' | N’ >< Y’
7 8 9 LZ 10
T 2 3
U
Plant-unique c
features Generic & non-generic components
+ >|<+—
Fig. 2-3. Venn Diagram Representing the Second Filtering-Seismic

Capacities. Components remaining after first filtering are partitioned
according to the estimate of their minimum seismic capacities by using the
guidance provided in Chapter 5 of Ref. 1 as partially summarized in Table 2-1.
Some plant-unique features are identified while reviewing drawings and all the
general information on the plant. The component and plant-unique features
with estimated HCLPF values greater than the earthquake review level (Subsets
7 and 10) are identified by the symbols Y' and A. The components with
estimated HCLPF values potentially lower than the earthquake review level
(Subsets 8 and 9) are identified by the symbols N" and A).

10


RWST

Reactor
vessel
VTA
VTB
Cooling pq ( LI
x Pump A
Cooling
Pump B VTA VTA
Cooling
VTB Pump C
VTB VTB

Fig. 4-2. Simplified Schematic of a High Pressure Injection System.

4.2.5 Determine Support Systems and Components

For each front-line component identified in the previous step, the systems and
components that provide support for their operation must be identified. The
systems that provide this support are called support systems. These support
systems provide cooling, lubrication, power, fuel, actuation, and control.
Pumps require cooling and lubrication for their bearings and are driven by AC
or DC motors or with turbines that require pressurized steam. Valves are
pneumatically, hydraulically, or electrically driven. Diesel generators
require cooling, lubrication, fuel oil, intake air, and exhaust. Most
components are actuated and controlled by AC or DC circuits. These circuits
are made up of relays, circuit breakers, and electrical cabling. Some
components are controlled by pneumatic or hydraulic actuators. While these
are some of the more common supporting functions, the systems that provide
these functions and their interface must be determined for each of the front-
line components.

Once the necessary support systems have been determined, they must be reviewed
to identify those portions of the systems (and each component) that support
the front-line components. A Failure Modes and Effects Analysis (FMEA)
similar to IREP (Ref. 11) (Part II - Section 1.3.1 and 3.2.1) can be performed

39


4.4 Step 4 - First Plant Walkdown
The objectives of the first plant walkdown are:

1. To confirm that no weaknesses exist in the plant structures and
equipment that would make their HCLPF lower than the generic values
shown in Table 2-1, and to look for signs of abnormal aging or poor
maintenance that would invalidate the use of Table 2-1.

2. To confirm the accuracy of system descriptions found in Plant design
documents (e.g., FSAR, general arrangement drawings, piping and
instrumentation diagrams, and line diagrams for electrical equipment).

3. To identify any system interactions, system dependencies and plant
unique features not already identified in Steps 2 and 3
(Section 4.4.4).

4. To gather information on certain potentially weak components for
further HCLPF calculations (i.e., Group A components that do not pass
initial screen - Table 2-1).

In defining these items, the system analyst should consider those components
that comprise systems supporting Group A functions. He must also consider
potential systems interactions, i.e., component and system failures of non-
Group A functions that can lead to failure of systems performing Group A
functions. He should mark these items on general arrangement drawings, piping
and instrument diagrams and line diagrams, for electrical equipment. By
reviewing such marked up drawings, the fragility analyst is able to identify
the plant areas that require inspection.

4.4.1 Plant Walkdown

In Section 4.3.2 we have described the review to be performed by the systems
and fragility analysts to become familiar with the plant systems, structures,
and components and to identify areas of the plant requiring physical
walkdown. The objectives of the first physical walkdown conducted by a team
of systems and fragility analysts are stated above. It is expected that the
systems analyst will review all areas of the plant and provide advice to the
fragility analyst on the function of any component in the safety systems and
the consequences of its failure.

The steps in performing the first physical walkdown are described below:

1. A pre-plant visit meeting between system and fragility analysts to
Plan the plant walkdown and discuss areas to concentrate on should
take place.

2. Necessary arrangements must be made with the plant management
regarding radiation protection, badging, and scheduling the walkdown
activities to create minimal conflict with normal plant operations.
The walkdown team should either include or have access to the
following:

43


TABLE 4-3

EXAMPLE ITEMS TO FOCUS ON IN A PLANT WALKDOWN DURING

MARGIN REVIEW FOR EARTHQUAKES BETWEEN 0.3 AND 0.5G PGA

(Continued)

COMPONENT

ITEM TO BE EXAMINED

COMMENTS

Tanks (Cont.)

Inspect how the tank is
anchored to concrete (with
chairs and angles or simply
bolted down).

For elevated tanks which are
supported on slender legs and
with no diagonal bracing,
check the attachment of
tanks to legs; obtain sizes
of support members if

HCLPF evaluation

is required

Study the weld details at
valve pit location; is there
enough flexibility in piping?
Where is the valve located with
respect to the tank?

Look for potential for syphoning
of tanks by break of
connecting pipe.

Batteries and racks

Inspection should focus on
battery support (i.e., spacers
and shims), ruggedness of
racks, and anchorage details.

Check for potential failure
of space heaters, hanging
light, or blockwall enclosures
that could fall and impact the
batteries.

Some racks in older
plants have low
seismic margin.

Active Electrical
Equipment

Inspect method and adequacy of
anchorage for motor control
centers, switchgear, instru-
mentation panels, cabinets

and racks and other electrical
components,

72

Look for cabinets
not tied together
which could impact
each other.


CHAPTER 2.

OUTLINE OF THE REVIEW PROCESS

2.1 Concept of Screening

The screening process developed in this report includes the use of a series of
filters that enable the reviewer to sort the relevant elements (components and
functions) into several classes.

Some of these filters were developed by a Panel of experts, as described in
(Ref.1) They were designed to be conservative with regard to assessing the
seismic margin of a plant. The purpose of these filters is to eliminate from
the analysis the components that have seismic capacity conservatively
estimated as being above the earthquake review level, and those components
that are judged not to be important contributors to seismic-induced core melt
(or both).

One filter sorts the components into two classes having HCLPF either higher or
lower than the earthquake review level. This sorting is performed with the
guidance of Chapter 5 of Ref.1, which is partially summarized in Table 2-1 of
this report. Fragility values in Table 2-1 are consistent with spectra
specified in Ref. 3.

A second filter, also conservatively developed, sorts the components into two
different classes depending on the nature of the plant functions they serve.
One class includes components associated with the functions of Group A as
described in Ref. 1 (summarized in Table 2-2) and the other class contains the
remaining elements. This second filter presented in the form of a table,
Table 2-3, appears in Ref. 1 as Table 4-13. It is only applicable to PWRs.
For BWRs, all plant safety functions are treated as belonging to Group A. It
should be noted that there are many plant functions that are not important to
Plant safety. These functions are not-considered as belonging to Group A.

These two filters are not sufficient, however, to segregate all relevant
components, especially when dealing with plant-unique features or borderline
components.

Thus, we have developed a multi-step screening procedure using a combination
of plant walkdowns and engineering analyses to isolate all the functions and
components of importance to the seismic margins review. The material in
Chapters 4 and 5 of Ref. 1, (summarized here in Tables 2-2 and 2-3 is used as
guidance to identify the components that fall clearly into one of the
classes. A component that is screened out is a component that has been
identified in the sorting either as not being associated with any Group A
safety function, or has HCLPF value higher than the earthquake review level,
or both. This component is eliminated from the review process and is not
considered further in the analysis. The remaining elements may require a more
detailed structural and mechanical analysis and/or a more detailed walkdown to
finalize the screening. In the end, the screened-in components (i.e. those
not eliminated in the screening process) are considered in the final systems


o A demonstration that anchor bolts are properly installed. (Not
needed for plants that have met the IE Bulletin 79-02 or have
satisfactorily addressed the Task Action Plan A-46 issues).

© Photographs will be made of selected anchorages where possible.

6. At the conclusion of the first plant walkdown, the following
objectives will have been achieved:

o The plant system configuration is verified in order to proceed
with event tree and fault tree analyses.

o Systems interactions, other types of dependencies or plant
unique features are identified.

© Certain Group A components that are judged to generically
possess high capacities (i.e., larger than the earthquake
review level) have been verified to contain no weaknesses.

o Further analyses needed to establish the capacities of
remaining Group A components are identified and necessary field
data are obtained.

oO Information on components is obtained to assist in HCLPF
evaluation and peer review of the seismic margin study.

4.4.2 Simplified Analysis

Following the first plant walkdown, the fragility analyst may screen out
certain potentially low capacity Group A components using the data collected
in the design review and walkdown. This is accomplished by performing some
simplified analysis.

The first step in this analysis is to estimate the response that the component
experiences at the earthquake review level. As explained later (Sec. 4.8) two
candidate approaches--conservative deterministic failure margin method and
fragility-analysis method--are proposed to estimate the HCLPF values of
components. In both methods, some reanalysis of structures and equipment may
be needed to calculate the seismic responses. Such reanalysis (of structures
at least) should be done before the second plant walkdown is conducted.
Details of structural analyses are given in Sec. 4.8. If the structural
responses (e.g., floor spectra) calculated for the plant SSE can be scaled to
the responses at the earthquake review level, the effort of seismic margin
studies would be considerably reduced. For this purpose, the fragility
analyst should review the structural models to confirm the adequacy of the
models and the appropriateness of scaling the responses. Next, he will make
analyses to judge if the components' seismic capacity exceeds the earthquake
review level.

The screening can be aided by using tables such as those for anchorages being

developed by URS/J. A. Blume for EPRI (Ref. 14). The fragility analyst is
expected to develop such rules of thumb to assist in screening of

47




TABLE 4-1

PLANT FUNCTIONS vs FRONT LINE SYSTEMS MATRIX

aepTooD Tees dung yUeTooD 107zIeeR

wezSks AUS ATepuodss

wezskS AUS AaeutTIg

x

Wazsks Aeads qousnd

WSzSAS UOTETNoATOSg

Wazsks JozyEMpoog ATETT TXny

WSzSkS AozeTMUNIOy

Waysk§ UOTJOSlUl Sanssdig MOT

WazSkS UOT}OSLUl oanssead GIT

X|X| xX) xX

WeSkS UOTSISAUGD TSMog

WSSkS UOT}IS}OIg JopIeST

Subcriticality

Reactor

Normal

Cooldown

Emergency Core
Cooling (Early)

Emergency Core
Cooling (Late)

Containment

Heat Removal

Containment
Overpressure

Protection (Early)

Containment
Overpressure

Protection (Late)

64


TABLE 2-1

SUMMARY OF CAPACITY ASSESSMENT OF NUCLEAR POWER PLANT COMPONENTS

(Continued)
Component Peak Ground Acceleration Range
<0.3g 0.3-0.5g >0.5g

5. Structure Failures

a. Shear Walls, diaphragms and c (5) x

footings

b. Special non-ductile details c (6) x

c. Impact between buildings Cc (7) x
6. Block Walls x x “x
7. Piping (8) (8) (9)X

(5) Evaluation is required only for structures that do not comply with the
requirements of either the ACI 318-71 or ACI 349-76 concrete building

codes or have not been designed for a SSE of 0.1g or greater.

(6) Review of construction drawings, design criteria, and simplified analyses

should be conducted to determine if a margin evaluation is required.
(7) Potential for relay chatter caused by impact should be evaluated.

(8) Walkdown of example piping-system runs should be conducted. Also, piping
between buildings should be inspected and margins evaluated if problems

are found.

(9) Margin evaluation should include detailed walkdown of all critical piping

systems.

C HCLPF value is adequate for this acceleration range.

X Margin evaluation for all potential failure modes is required to determine

the HCLPF value. In addition, margin evaluation (or exceptions)
required as discussed in (5) through (9) above.

19


1.00

0.80

0.60

0.40

Conditional probability of failure

0.20

0.05 }—

0.00 | ! !
0.00 0.26 0.40 0.80 1.20 1.60 2.00

Peak ground acceleration (G)

Fig. 4-4 Plant Level Fragility Curves.

stiffness, and the use of engineering judgment in lieu of plant specific data,
it is expected that all the components will be affected to some degree by
these uncertainties. Therefore, some probabilistic dependence between
component median capacities may be expected. Perfect dependence in
uncertainty is an extreme case.

Dependence in the randomness arises from a common earthquake generating the
responses in different components and common structural/material properties.
Assumption of dependence in the randomness means that if the fragility
(probability of failure) of a component for a given peak ground acceleration
is known, the Probability of failure of the other components is somewhat
modified by that knowledge.

62


Excellent discussions of the merging of front-line and support-system fault
trees are given in Refs. 1, 11, and 17.

The completed fault tree for each front-line system is then analyzed to
develop the Boolean expression for the system failure. The Fault Tree
Handbook (Ref. 15) discusses fault tree analysis and the associated Boolean
algebra. Section 6.5 of Ref. 12 gives a brief discussion of some of the
computer codes that can perform this analysis.

The basic events that will appear in the system Boolean expression will be the
failure modes of those important low-capacity components/segments that have
not been screened out in the Previous steps as well as retained random
failures and human errors. For each front-line system, the Boolean expression
can be arranged as an ordered list of cut sets or as a reduced, factored
equation. A complete description of each of the basic event should accompany
this list of cut sets.

The cut sets for each of the front-line systems will be quantified in Step 8
to give the HCLPF values for each of these system failures.

4.7.3 Accident Sequence and Plant Analysis

Each accident sequence will contain an initiating event and one or more system
events. Each system event is the success or failure of the associated front-
line system. The Boolean equation for each accident sequence is determined by
the logical combination of the Boolean equations for each system success or
failure that is contained in that accident sequence. The Boolean expression
for each accident sequence should be divided into a list of minimal cut sets
or left in reduced factored form. This will be used in Step 8 to quantify the
HCLPF value for each of these sequences.

The system successes in the accident Sequences are included in the analysis to
eliminate minimal cut sets that are precluded by the logic associated with the
system successes. Any minimal cut set of an accident sequence fault tree that
causes the failure of a system defined to be in a success state should be
eliminated. A system success that is independent of the system failures need
not be considered. The complimentary events analysis usually requires the use
of a computer code and is briefly discussed in Ref. ll.

The Boolean expression for the plant will be quantified in Step 8 to give a
HCLPF value. Examples of Boolean equations for accident sequences and the
plant are given in Appendix B of Ref. 1.

4.7.4 Documenting Systems Analysis

The results of the systems analysis are Boolean equations and/or cut sets for
each front-line system failure and accident sequence that leads to seismic
induced core melt. ‘These will be used in Step 8 to indicate those components
and failure modes for which a HCLPF value will need to be determined. The
Boolean expression will be used to determine a HCLPF value for each systems
failure, accident sequence, and for the plant.

55


L~—_y"" N” >| y”
| 15 16 17 18
a 2 3
U
Plant-unique Cc
features Generic & non-generic components

Fig. 2-5. Venn Diagram representing the Fourth Filtering-Second Walkdown. A
detailed analysis, following data collection during second walkdown, will lead
to further adjustments in the partition. The Subsets 11, 12, 13 and 14 become
15, 16, 17 and 18 which, if the screening process is correct, are equal to the
Subsets 1, 6, 5 and 4, respectively, of Fig. 2-1 (which represents the true
State-of-nature). Subsets 15 and 18 are screened-out. The final systems
analysis is performed with the remaining components of Group A, which have an
estimated HCLPF values lower than the review level represented by the
intersection of A and N" (Subsets 16 and 17). In the event of having empty
Subsets 16 and 17 (Group A components having an estimate of their HCLPF
greater than the earthquake review level), no numerical capacity value would
be obtained in the margin assessment except that it is greater than the review
level.

12


criteria than the Standard Review Plan for ground response spectra, damping,
ductility, etc. (Ref. 3).

A seismic margin review, as discussed in this report, is an extension of the
Systematic Evaluation Program. A seismic margin review is expected to serve
the intent of SEP updated by about 10 years of additional industry
experience. Also, during these years the industry has collected data on
equipment performance in actual earthquakes and qualification tests. The
seismic PRAS conducted so far have also identified the important risk
contributors (i.e., structures or equipment) and low capacity components so
that seismic margin reviews can concentrate on them. At the time of SEP, the
selection of systems and components to review was based on the NRC's safety
classification. The deterministic criteria for the HCLPF calculations in
seismic margin reviews are similar to those adopted in the SEP.

An important feature of a seismic margin review is the recommendation of two
plant walkdowns. In the SEP, the walkdown was not as detailed as recommended
in seismic margin reviews. Also, the earthquake review level contemplated in
seismic margin review is higher than the levels used in the SEP.

3.6 Addressing the Limitations of Seismic Margin Methodology

For the purpose of determining seismic margins, the seismic margin methodology
described in this report is suggested as an alternative to the performance of
a seismic PRA. It also circumvents the difficulties of describing the
seismic hazard at the site. The methodology cannot provide risk estimates,
although with further development it can give risk insight. As such, the
definition of acceptable seismic margin (or the earthquake review level) is
subjective. Other limitations of the methodology are discussed below.

3.6.1 Ways to Verify Seismic Margin Review Methodology

a. By performing the trial reviews on one or two selected plants followed
by seismic PRAs, the validity of the proposed margin evaluation
methodology can be checked. In order to accomplish this validation,
the fragility analysis of critical ("screened in") structures and
equipment must be more detailed than currently done in seismic PRAs.
The comparison would help to ascertain that the screening procedures
(both components and systems) are adequate and appropriately
conservative and that HCLPF values calculated for components and the
plant are valid.

b. The methodology could also be verified by having the trial reviews
performed on the same plant by two independent groups. Do the two
groups screen out or screen in the same components and systems? Do
they obtain the same HCLPF values?

3.6.2 Comparative Studies on HCLPF Evaluation Methods

There have not been enough studies done to compare the HCLPF estimated
using the CDFM (Conservative Deterministic Fauilures Margin) method
(Ref. 7) and the fragility-analysis method (Ref. 10) for different
components. The objective of comparison studies would be to identify

29


Point. In the plant review and walkdown, the analysts should consider such
plant-unique features.

4.5 Step 5 ~ Systems Modeling

The objective of this step is to develop the systems models for the plant. The
tasks of Step 5 are the following:

o Review the event trees developed in Step 2 and revise, if necessary.

© Develop fault trees for the front-line systems used in the event trees
and for their support systems.

© Document the systems modeling results.

The event trees developed in Step 2 are reviewed and revised, if needed, based
on the increased understanding of the operation of the plant gained in the
performance of Step 4, the first plant walkdown. The fault trees are
developed for the front-line systems that appear in event trees incorporating
those Group A components whose fragility values have been assessed in Step 4
as being of continuing concern and including any discovered system
interactions and plant-unique global features. Fault trees for the support
systems are developed along with those for the front-line systems.

4.5.1 Finalize Event Trees

Using the increased understanding of the plant configuration and operation and
any additional information gained from the performance of Step 4, the event
tree models developed in Step 2 should be verified and finalized. This
requires the examination of each event tree to verify that at each branch
point the operational characteristics of the associated system are consistent
with the initiating event and the accident behavior of the plant. For
example, it may have been discovered during Step 4 that a certain plant system
is not called upon to respond to a particular initiating event.

The initial ordering of the systems in each event tree should be reviewed.
There is often a given ordering of systems that will minimize the number of
potential outcomes. This is particularly true if the same system is involved
with differing success criteria in combination with other systems to perform a
given function. For example, it may have been discovered that the operational
characteristics of a certain system will render it incapable of performing any
mitigative function given the plant conditions expected to occur as a result
of the preceding sequence of system success/failure choices.

Once the event trees are finalized based on their review and any revision, the
system failure definitions and modeling conditions particular to each
initiating event must be developed. Each system fault tree developed in the
next task must be constructed with the assumptions and criteria used to
develop the event tree in which that system is used.

49


(i) @ Generic and non-generic components not (i) ? Generic and non-generic
necessary for Group A functions. components not screened
out. (i.e. necessary for
Group A functions and for
which the HCLPF has been
estimated to be potentially
lower than the review level.)

(ii) @ Unique features not necessary
for Group A functions.

(iti) @ Generic components necessary for
Group A functions but whose HCLPF
has been determined using Ref. 1 and
verified in the first walkdown to be
greater than the earthquake

review level.

(iv) @ Unique features necessary for
Group A functions, whose
HCLPF has been determined in
the first walkdown to be greater
than the earthquake review level.

(v) @ Generic and non-generic components (ii) ’ Same as (i)
necessary for Group A functions for for plant
which 2nd review and walkdown unique features

ascertained the HCLPF to be greater
than the earthquake review level.

Same as (v) for

(vi)
tee yy ppm \ 4}

Screened OUT Screened IN
components components
Will not appear in the final systems analysis Will be used in the final systems analysis

SCREENED IN AND OUT COMPONENTS

Fig. 2-7 Review Scheme.

15


TABLE 5-2

ESTIMATED STAFFING FOR_IND!
PEER REVIEW OF SEISMIC MARGIN REVIEW

Engineering Months Needed

Systems Fragilities
Review of Seismic Margin Study
~ Plant Familiarization 1.0 2.0
- Review of Report 0.5 1.5
Plant Walkdown 0.5 1.0
Presentation of Review Results 0.5 1.0
2.5 5.5

Total engineering time = 8.0 engineering-months.

82


particular, plant cooldown, depressurization, and high pressure injection will
be included. The medium LOCA may not need to be considered because its
consideration is dependent on the configuration and operation of the plant
safety systems. The large LOCA initiating event will not require the reactor
subcriticality function but will require the early ECC function. This is
because the fission process will be shut down upon core voiding and reactor
depressurization will not require further action. In addition, small ECC flow
May not be sufficient to provide adequate core cooling. However, this
initiating event will test those systems that provide large amounts of coolant
to the reactor vessel following a large LOCA. Some of the transient event
Sequences will result in loss of coolant from the plant caused by safety and
relief valves or primary coolant pump seal failure.

The remaining initiating events that should be considered are those that
result in loss of containment integrity. The loss cf containment integrity of
interest here is the initial loss of the containment isolation function caused
by the seismic event. These initiating events should be considered for their
effect on the performance of the Group A functions. Dependent on the plant
under review, a containment isolation failure may render a system that
performs a Group A function inoperable.

The initiating events should be grouped by their effect on the Group A
function or by system response. This grouping reduces the number of event
trees that represent the initiating events. Each initiating event in a group
should require the same set of system actions. The groups of events can be
refined further by examining the specific system responses and associated
temporal considerations.

4.2.2 Identify Front-Line Systems

For PWRs the two Group A functions found to be most important to plant seismic
safety as indicated in Table 2-3 are reactor subcriticality and early
emergency core cooling. The plant-specific information is reviewed to
determine those front-line systems that perform these two functions. For each
of these systems, the analyst should determine how the system operates and
interfaces with other systems, the instrumentation and control for the system,
and how it is tested and maintained:

The reactor subcriticality function is performed by those systems that shut
down the nuclear chain reaction within the core of the reactor. This function
requires the detection and actuation of systems that provide negative
reactivity to the core such as the insertion of control rods or the injection
of soluable neutron poisons into the primary coolant system.

The early ECC function is intended to provide sufficient coolant to the
reactor coolant system so that the core is continuously covered or to
immediately recover the core if uncovery should occur as a result of a
postulated accident. There are several systems that perform this early ECC
function. Examples are high pressure coolant injection, low pressure coolant
injection, accumulator tank injection, RCS depressurization, and auxiliary
feedwater cooling.

ASEP has tabulated the front-line safety systems for the various nuclear power

36


The team of systems analysts performing the review should have the following
qualifications:

° Experience in nuclear power plant design and analysis.

° Familiarity with nuclear power plant systems configurations and
operations, and a good understanding of the characteristics and
operation of nuclear power plant components.

° Previous participation in the performance of at least one nuclear
power plant probabilistic risk assessment with experience in accident
behavior and the development and analysis of fault trees and event
trees.

It would also be helpful if the systems analysts have a knowledge of system
interactions as well as knowledge of seismic risk assessment.

77


equations determined in the next task will be combined to give the Boolean
expression for the accident sequences that lead to seismic induced core melt.

4.7.2 System Failure Analysis

The fault trees for each of the front-line systems developed in Step 5 are
finalized as a result of Step 6 and analyzed to determine the Boolean
expression that describe their failure. These Boolean expression are the
single basic events or combination of basic events that must occur for the
occurrence of the top event, system failure. A basic event refers to the
failure of components and wiring or piping segments, human actions, etc., that
were used to develop the fault trees.

The system fault trees developed in Step 5 should be reviewed and revised, if
necessary, based on any additional information gained during the second plant
walkdown. Additional information concerning plant-unique features and systems
interactions should be added to the trees. Component test and maintenance,
and operator error information should be used to complete the failure causes
for each of the basic events. In addition, each fault tree should be reviewed
to ensure that common equipment and common faults among different systems have
been given the same name. This review is of particular concern between front-
line and support-system trees.

The finalized fault trees can then be "pruned". This pruning will eliminate
(set equal to a zero chance of failure) "AND" gates where one of the input
basic events is a high capacity component with a low random failure
Probability. These high capacity/low random failure Probability components
are those that have been reviewed and determined to have a HCLPF value above
the review level and a random failure probability less than about 1E-2. This
pruning process can be accomplished in two ways.

The first pruning method is to locate on the fault trees each occurrence of an
"AND" gate that has a high capacity/low random failure component contributing
to it. The analyst can physically eliminate the above event and its following
subtree from further consideration. This method will reduce the size of the
trees that will need to be analyzed.

The second pruning method is performed after the fault trees have been
analyzed to give the minimal cut sets for the system failure. Any cut set
that contains a high capacity/low random failure component can then be
eliminated from further analysis. This elimination will include those low-
capacity components contained in these cut sets that are not also contained in
any other cut set that has all low-capacity components.

Whether the pruning process is performed before or after the fault trees are
analyzed, the front-line and associated support-system fault trees must be
combined into a single tree that models the failure of each front-line
system. This combination process is accomplished by attaching the support-
system fault trees to the front-line-system fault trees at the associated
interface nodes. The result is a set of complete front-line fault trees, one
for each event-tree heading. A drawing of each of these fault trees should be
made and thoroughly checked for consistency of event names, compatibility with
failure definitions, and the absence of logic loops and dangling gates.

54




TABLE 2-3a

FUNCTIONS REQUIRING DETAILED EVALUATIONS IN SEISMIC MARGIN REVIEWS FOR PWRS

(Taken from Ref. 1, Table 4.13)

Function

Screening Requirement

Remarks

Initiators:
Offsite Power
RCS Integrity (LOCA)
Containment Integrity

Functional Group A:
Reactor Subcriticality

Normal Shutdown
Emerg. Core Cooling (Early)

Functional Group NOT-A:

Emerg. Core Cooling (Late)
Containment Heal Removal
Cont. Overpress. Prot. (Early)
Cont. Overpress. Prot. (Late)

De bs Fy

A

PPP py

F= Assume Failure

X = Margin evaluation
for all potential
failure modes is
required.

A= Assume failure if
core melt occurs
resulting from failure
of Functional Group A,
assume successful if
functional Group A is
successful in prevent-
ing core melt.
Conditional on plant
walkdown not finding
any extremely gross
plant-specific
differences.

23


PREFACE

The Nuclear Regulatory Commission has requested that a technical basis be
developed to resolve regulatory needs relating to Seismic Margins. This work
is being conducted under the guidance and with the concurrence of the Expert
Panel on
Technical

report

is

Panel and

PY
M.
J.

Je
J.
De.
L.
c.
G.
Pp.
Le
A.

G.
K.
B.

J.
J.
A.
J.
Pp.
We

the Quantification of Seismic Margins. The Panel is supported by
Support Personnel and a Working Group provides NRC liaison. This
a collective effort and presents the ideas and views of the Expert
the authors.

AUTHORS OF “THIS REPORT

Prassinos, LLNL
Ravindra, EQE, Inc.
Savy, LLNL

EXPERT PANEL

Budnitz (Chairman), Future Resources Associates, Inc.
Amico, Applied Risk Technology Corporation

Cornell, CAC, Inc.

Hall, University of Illinois

Kennedy, NTS/Structural Mechanics Associates

Reed, Jack R. Benjamin & Associates, Inc.

Shinozuka, Columbia University

Cc.
E.
J.

E.
Pe

ADDITIONAL TECHNICAL SUPPORT
Murray (Project Manager), LLNL
Cummings, LLNL
Johnson, NTS/Structural Mechanics Associates
NRC_WORKING GROUP

Richardson (Co-Chairman)
Knight (Co-Chairman)

Guzy (Project Manager)
Beratan

Grimes

Lear

Ke

Niyogi

Reiter
Thadani

The findings of this report are being presented for peer review and comment by
interested parties. Comments should be addressed to:

Mr. Dan Guzy

Mechanical/Structural Engineering Branch
Division of Engineering Technology
Office of Nuclear Regulatory Research

U. S. Nuclear Regulatory Commission
Washington, DC 20555

ix


Reactor Consequential Auxiliary Feed
protection small feedwater and
system loca* system bleed
| ]
| | |
| | | |
|
I
| | | i
f | |
: | Success OK
| No
| Success OK
: Failure
| Success Failure Core damage
Loss of
offsite Yes Small loca
Power
Failure ATWS

*PORV/SR valve opens and fails to reclose or RCP seals fail
Fig. 4-1. Example of a Systematic Event Tree for Loss of Offsite Power.

of pipe segments that do not have a significant impact on the system
performance (e.g., piping less than one-third the diameter of the main system
piping), and omission of supply lines for which credit is not taken in the
analysis. In addition, lines containing normally closed manual valves that
could only improve system performance if opened may be conservatively omitted
unless procedures specify their opening in response to accidents.

The simplified schematics should contain all piping segments and components
included in the analysis. ‘They should show the state of the components just
prior to system actuation and identify components corresponding to the plant
equipment labels for such components. The Plant system descriptions should
address these components and specify which components change state upon system
actuation. The systems may also be decomposed into piping or wiring segments
to facilitate the analysis. An example of a simplified drawing for a High
Pressure Injection System is shown in Pig. 4-2.

ASEP provides simplified schematics of the front-line systems tabulated for
each plant. These schematics were Produced using the guidance just discussed
and can be used directly in Step 4 without further modification or
justification.

38


Figure
Figure

Figure

Figure
Figure
Figure
Figure
Figure
Figure
Figure
Figure

Figure

2-4

2-5

4-3

4-4

5-1

LIST OF FIGURES
Venn Diagram Representing the True State of Nature.
Venn Diagram Representing the First Filter ing-Systems.

Venn Diagram Representing the Second Filtering-Seismic
Capacities.

Venn Diagram Representing the Third Filtering-First Walkdown.
Venn Diagram Representing the Fourth Filtering-Second Walkdown.
Screened IN and Screened OUT Components.

Flow Chart of Review Scheme.

Example of a Systemic Event Tree.

Simplified Schematic of a High Pressure Injection System.
Example of an Annotated Simplified Schematic.

Millstone 3 - Damage State TE Fragility curves.

Schedule for Margin Evaluation.

vili




yr Ng al« y"
ry
A 1 13 14 12
_Y
ry
NOT-A 2 3
U
Plant-unique c
features Generic & non-generic components

Fig. 2-4. Venn Diagram Representing the Third Filtering-First Walkdowmn. A
first walkdown leads to adjustments in the results of the pre-screening
performed by filters one and two. Some components thought to have sufficient
capacities will be found to have a lower capacity, as a result of their
anchorage for example, or some system interactions will be discovered which
were not identified earlier. On the other hand, some components will be found
to have a capacity higher than previously estimated. ‘Thus, the partition of
Subset A (which included the Subsets 7, 8, 9 and 10 after the second
filtering) will change its partition into the Subsets 11, 12, 13 and 14. A,
N° for components with the estimate of their HCLPF values potentially lower
than the earthquake review level and A, Y" for estimated HCLPF greater than
the earthquake review level.

11


analysis where it is determined whether there is a high confidence that the
plant has a capacity greater than the earthquake review level.

Section 2.2 describes the sorting process in a diagrammatic fashion. This
description does not necessarily follow the actual chronological order in
which the review will be performed.

Section 2.3 describes briefly the mechanics of the review organized
chronologically into 8 steps including 2 walkdowns and the final step
consisting of the quantification of the HCLPF values for the screened-in
components, accident sequences, and the plant.

2.2 Screening of Elements

This section discusses the classification of components of a nuclear plant
according to their relationships with Group A functions, their commonality
with components at other plants, their seismic capacity, and their uniqueness.

The Venn diagram in Fig. 2-1 represents the actual state-of-nature where the
components of a nuclear plant are segregated according to their true
relationship to the functions of Group A and their true seismic capacity.
Figs. 2-2 to 2-5 are Venn diagrams that idealize the classes obtained by using
the different tools of the screening process. The process of screening,
described by the series of Figs. 2-2 to 2-5, converges towards the final
classification which, in theory, is the state-of-nature, as symbolized by
making the final Fig. 2-5 identical to Fig. 2-1. The steps of the review
Process described in Figs. 2-2 to 2-5 do not necessarily proceed in the
chronological order in which the actual review of the plant will be
performed. They are only a means of explaining the sorting (or segregation)
of the components of the plant into different classes.

It is noteworthy that a component that has been screened~out after the first
walkdown of the review process will not be revisited later. However, a
component screened-in at one step may or may not be screened-out in a
subsequent step.

The term "component" includes pumps, pipes, tanks, and electrical gear found
in a nuclear power plant. The term also includes the civil structures as well
as all of the equipment of the plant. The term "generic component" is used
for components that are commonly found in nuclear plants. They are the usual
or customary types of components that have been investigated (see Ref.1 and
Table 2-1 of this report) and for which a lower bound estimate of the HCLPF is
likely to be available.

By default, a component for which little or no fragility information is
available, even if it is a commonly used component, is a “non-generic"
component. It will require some detailed structural and mechanical evaluation
or use of test and experience data to estimate its HCLPF. These latter types
of components are not to be confused with "“plant-unique features" that are
unusual features of the plant that may lead to common mode failures. They can
be, for example, an adjacent dam upstream of the plant, an adjacent industrial
facility, or an adjacent stack above the plant level.


Abstract

TABLE OF CONTENTS

List of Tables 2... 1 6 ee ee ee ee ee ee
List of Figures... 2 eee eee ee ee ee ee

Preface .

Executive Summary . «6 6 ee ee ee ee ee ee ee

Chapter 1. Introduction... .... 4.2.2 ee ee eee

Chapter 2. Outline of the Review Process .........

Chapter 4

ab
NE

Concept of Screening... 1... 54-2. ee eee
Screening of Elements ........-2.0.2+06.8
Schematic Representation of the Mechanics of th

Description of the Eight Steps of the Review. .

Relationship of Seismic Margin Review to other Seismic Studies

Comparison with Seismic PRAS.........6.
Deterministic Code Margin Studies .......
Probabilistic Seismic Margin Studies ......
Current SSE Design Practice ..... 2.2. eee
Systematic Evaluation Program ......2.24..
Addressing the Limitations of Seismic Margin Meth

. Further Research Needs .........

Review .

odology .

3.6.1 Ways to Verify Seismic Margin Review Methodology .
3.6.2 Comparative Studies on HCLPF Evaluation Methods . .
3-6-3

Detailed Description of the Seismic Margin Review Process

Step 1 - Selection of the Review Earthquake Level
Step 2 - Initial Systems Review ........

4.2.1 Define Initiating Events ........
4.2.2 Identify Front-line Systems .......
4.2.3 Event Tree Development .........
4.2.4 Identify Front-line Components .....
4.2.5 Determine Support Systems and Components
4.2.6 Documentation of Initial Systems Review .

Step 3 - Initial Component HCLPF Categorization

+3.1 Gathering of Information ........
3.2

Step 4 - First Plant Walkdown .........

4.1 Plant Walkdown .. 1... 2.2... eee
4.2 Simplified Analysis. ..........
«4.3 Walkdown Documentaion..........
4.4 Plant-Unique Features .......2.20.6.

Determination of Target Areas for First Plant

14
14

25

25
26
27
28
28
29

29

30

33

33
34

35
36
37
37
39
40

41

41
42

43

43
47
48
48


SORTING

See "FILTER."

SQUG

Seismic Qualification Utility Group. A group of utilities joined together to
gather experience data on component behavior in past earthquakes.

SSMRP

The Seismic Safety Margins Research Program was a U.S. Nuclear Regulatory
Commission program conducted by Lawrence Livermore National Laboratory. It
developed a complete, fully coupled analysis procedure for estimating the risk
of an earthquake-induced radioactive release from a commercial nuclear power
plant. The procedure traces the seismically induced failure modes in a
reactor system down to the individual component level and takes into account
the common-cause earthquake~induced failures at the component level.

SSRAP

Senior Seismic Review and Advisory Panel. A Panel comprised of: R.P. Kennedy
(chairman), Paul Ibanez, Ansel Schiff, Walt von Riesemann, and Loring Wyllie,
whose function is to review and interpret the SQUG data.

STATION BLACKOUT

Total loss of all (on-site and off-site) AC power sources.

SUPPORT SYSTEMS

Systems that are necessary for the operation of front line systems (e.g.,
cooling systems, lubrication oil systems, pneumatic systems, hydraulic
systems).

TOp EVENT

The undesired event on the top of a fault tree. A fault tree is constructed
for each system. Under seismic excitation, components fail, leading to the
system's inability to serve its functions. The system's inability to serve
its functions is the top event for the fault tree.

WALKDOWN

A step in the review process during which data is gathered, assumptions on
component capacities are checked, and analysis is performed. The two plant
walkdowns described in this report rely on physical inspection of the plant as
well as a review of written documentation, drawings, and the performance of
mechanical and structural analyses.

102


HCLPF of CM = MIN 0.30, 0.35, max (0.35, 0.40), max (0.25, 0.20
and 0.40)
= 0.3g

If random (non-seismic) failures remain in the equation or cut sets, they
should be reduced as much as possible to a HCLPF value (for the seismic terms)
times the random terms. For example, the cut set A*B*RC, where RC is a random
failure and A and B have HCLPF values of 0.2 and 0.25, respectively, should be
shown as 0.25g*RC.

4.8.2.2 Probabilistic Approach

In this approach, a Boolean expression for core melt is developed using the
event- and fault-trees described in Section 4.7. The fault trees would
include both the generically high capacity (screened out) components and the
screened in components. Fragility parameters for the "high" capacity
components are taken from the fragility data base. Fragility parameters for
the screened in components, Ay 8pr Bye are estimated as described in
Section 4.8.1.2.

For example, the Boolean expression for core melt could be:
M=1+2+34+44+5%* 6

where the numbers represent failure of the corresponding component whose
fragility parameter values are given in Table 4-4. The notation "+" indicates
probabilistic addition (union) and "*" indicates probabilistic multiplication
(intersection). Following the rules of Boolean algebra, the individual
component fragilities are combined, using a numerical procedure (e.g., the
Discrete Probability Distribution approach (Ref. 21), and/or Monte Carlo
simulation). Figure 4-4 shows a plot of the plant level (core melt) fragility
curves in which the family of curves is reduced to the 5%, 50%, and 95%
confidence fragility curves. From this plot, the HCLPF (defined as peak
ground acceleration corresponding to 5% probability of failure at 95%
confidence) for core melt is obtained as 0.26g. In the above analysis, the
component failure events are assumed to be statistically independent (both in
randomness and uncertainty). This may be a realistic assumption because the
components involved in the plant level Boolean expression are generally
dissimilar items of structures and equipment (e.g., buildings, tanks,
electrical equipment, control rod drive system, RCS piping, and service water
pumps), their locations in the plant and within the structures are found to be
different, and their dynamic characteristics are also judged to be
different. Hence, correlation in the seismic responses and in the seismic
capacities of these components may be assumed to be minimal.

In some instances, correlation in the component failures may be expected.
Assumption of perfect dependence in both uncertainty and randomness is an
extreme case. Assumption of perfect dependence in the uncertainties of
different component fragilities means that the median ground acceleration
capacities of all components are known if the median ground acceleration
capacity of one component is given. Since the uncertainty arises from
insufficient understanding of structural material properties, approximate
modeling of the structure, inaccuracies in the representation of mass and

61


information contained in Chapter 5, Ref. 1, and partially summarized in
Table 2-1 of this Report. Using the earthquake review level the analyst
determines which broad classes or groups of components have estimated HCLPF
values greater than the "review level," and which have estimated HCLPF values
potentially lower than the review level. These latter components, if
necessary for the Group A functions will require a more detailed fragility
analysis. This information is carried forward to Step 4.

Step 4 - First Plant Walkdown

The first plant walkdown is performed in Step 4. This walkdown consists of a
review of the plant structures documentation (e.g., drawings, specifications,
FSAR, and design analysis reports), walkdown of the plant and discussions with
plant personnel. The objectives of this walkdown are the following:

1. To gain a general understanding of the plant layout and relationships
of the components.

2. To verify the validity of the decisions made in Step 3 to screen out
components with generically high HCLPFs.

3. To identify plant-unique features which must be considered in the
margins review.

4. To gather information needed to perform more detailed reviews of
components that potentially have HCLPFs less than the earthquake
review level.

5. To identify systems interaction and other types of dependencies not
identified during Step 2.

Step 5 - System Modeling

Taking the results from Step 4, the systems analysts should revise the systems
relationships established in their earlier work in Step 2. Fault tree
development for systems, event tree development to establish relationships,
and other similar systems analysis work should be accomplished. The objective
of this step is to provide a nearly complete set of fault and event trees that
incorporate all of the Group A components and plant-unique features whose
fragility values have been preliminarily assessed in Steps 3 and 4 as being of
continuing concern.

Step 6 - Second Plant Walkdown

This task is the "second plant walkdown", and is primarily carried out by the
fragilities analysis team, taking the results of the first walkdown and the
Step 5 systems analysis into account. Prior to this walkdown some fragility
analysis should have been done. It is intended that this walkdown emphasizes
actual physical study of those plant components requiring detailed fragility
analysis. Systems analysis input will be needed but in a supporting
capacity. Although most systems interactions and similar dependencies will
have been discovered in Step 4, it is likely that a review of systems
interaction in this Step will be necessary to assure that other such

16


to describe the possible seismic-initiated accident behavior of the plant.
The quantification is then accomplished by calculating the HCLPF values for
each of these components using structural/mechanical analyses based on the
results of the detailed studies and inspections, and then analyzing the
minimal cut sets derived from the systems analysis. The results of the
quantification are the HCLPF values for each important low capacity component,
important systems, accident sequences, and the plant as a whole, which provide
information that can be used to make decisions about the seismic capacity of
the plant in relation to the selected earthquake review level.

While these trial seismic margin review guidelines represent the best attempt
at this time, the Panel feels they should be applied to trial plant reviews
before being finalized. These trial plant reviews are intended to demonstrate
whether this approach and the quantification techniques presented herein are
adequate. Based on lessons learned, the Panel can then be more prescriptive
about defining guidelines for general use.


TABLE 2-1

SUMMARY OF CAPACITY ASSESSMENT OF NUCLEAR POWER PLANT COMPONENTS

(Continued)
Component Peak Ground Acceleration Range
<0.3g 0.3-0.5g >0.5g
15. Soil liquefaction (18)X (18)x (18)x
16. HVAC Systems
a. Fans & Cooler Units (19) (20)x x
b. Ducting c (21) (20,21)X
17. Cable Trays & Cabling c (22)x x
18. Control Room Ceilings (23) x x
19. Dams, Levees, and Dikes x x x
(18) Margin evaluation is required only for plants judged to be susceptible
to potential liquefaction.
(19) Review is required for units supported on vibration isolators to
establish lateral stability.
(20) Margin evaluation should focus on anchorage systems.
(21) For ducting that spans between buildings, potential failure caused by
large relative displacements should be evaluated.
(22) Margin evaluation should focus on anchor plate weld connections, taut
cables, and sharp edges at ends of cable trays.
(23) Inspect for adequate bracing.
c HCLPF value is adequate for this acceleration range.
x Margin evaluation for all potential failure modes is required to

determine the HCLPF value. In addition, margin evaluation (or
exceptions) is required as discussed in (18) through (23) above.

21




CHAPTER 6.

FORMAT FOR A TYPICAL SEISMIC MARGIN REPORT

In this chapter we describe the contents and format of a seismic margin
report. The objective of this format is to outline clearly the information
that should be included in a typical margin report. The report should give a
description of the plant safety systems and their design bases, the
methodology utilized in the margin review, and the conclusions of the study.
The information to be included in different sections of a margin report is
discussed below.

Documentation of the trial plant review methods and results should be more
extensive than in a typical seismic margin report as discussed in Section 6.8.

6.1 Purpose of Study

The report should describe the earthquake review level selected for margin
review of the plant.

6.2 Plant Safety Systems and their Seismic Design Bases

The plant safety systems should be described with particular reference to
their required performance during and after a large earthquake. The plant
description should include a brief discussion of the principal design
criteria, operating characteristics, and safety considerations for the nuclear
steam supply system; the engineered safety features and emergency systems; the
instrumentation, control, and electrical systems; the power conversion system;
the fuel handling and storage systems; and the cooling water and other
auxiliary systems. The components that comprise these systems should be
tabulated as shown in Table 6-1.

The seismic design basis of the plant should be summarized; as a minimum, the
following items should be covered:

© Applicable design codes, standards and specifications (e.g., ACI 349,
AISC Specifications, and ASME Boiler and Pressure Vessel Code).

o Conformance to NRC Regulatory Guides (e.g., R.G. 1.60 and 1.61).

o Seismic Design Ground Response Spectra; SSE and OBE peak ground
acceleration values along with damping values for structures, systems,
components and soil.

o Seismic Qualification Methods. For equipment qualified by analysis,
describe the methods of analysis (e.g., response-spectrum, time-history,
static), of combining modes, of combining earthquake responses of
directional components, of soil-structure interaction analysis, and of
floor spectra generation.

83


CHAPTER 1.

INTRODUCTION

In May of 1984, The U.S. Nuclear Regulatory Commission (NRC) formed an "Expert
Panel on the Quantification of Seismic Margins" to provide technical guidance
and advice on the subject of seismic margins of nuclear power plants. The
members of the Panel are on contract to the Lawrence Livermore National
Laboratory and supported by technical personnel. ‘The Panel is charged to work
closely with the NRC staff's "Working Group on Seismic Margins" to address
regulatory needs in the area of seismic margins. The Panel's function has
been primarily to develop an approach for the quantification of seismic
margins in nuclear power plants.

This report is the third document produced by the Panel. The first report,
entitled "NRC Seismic Design Margins Program Plan" (Ref. 2) outlines a
Proposed NRC program in the area of seismic margins and plans how the Panel's
work is to be accomplished, including schedules, tasks, and milestones.

The second Panel report, "An Approach to the Quantification of Seismic Margins
in Nuclear Power Plants" (Ref. 1), presents a comprehensive review and
analysis of the various methods, data, and results of available seismic risk
assessments of nuclear power plants and other seismic studies. Its aim is to
establish seismic margin review guidelines. This second Panel report includes
insights about seismic margins, an assessment of the importance of plant
functions and systems to seismic safety, an assessment of available component,
structure, and equipment fragility information and its categorization, and
outlines an approach to seismic margins quantification. The information given
in this second Panel report provides the technical basis for the development
of the Seismic Margin Review Guidelines contained in this report.

During the seismic margin study, the Panel adopted the following general:
definition of "seismic margin":

A general definition of seismic margin is expressed in terms
of the earthquake motion level that compromises plant safety,
specifically leading to melting of the reactor core. In this
context, margin needs to be defined for the whole plant. The
margin concept also can be extended to any particular
structure, function, system, equipment item, or component, for
which "compromising safety" means sufficient loss of safety
function to contribute to core melting if combined with other
failures.

Also, during the course of its work, the Panel recognized that this approach
to the quantification of seismic margins has the following limitations:

1. The "systems screening" part of the approach presently applies only
to Pressurized Water Reactors (PWRS).

2. Design and construction errors are not covered.


TABLE 6-5

SUPPORT SYSTEMS VS SUPPORT SYSTEMS MATRIX

4
4 5
+]
+ >
| | Ff
fl a} ety
12) 2) .}
a
3 4 4 3
a 9 8
a 3 63] lO
1 2 3 3
aaa
a oe
Engineered Safety Features Actuation System
ee x
AC Power System
XK | ** x
DC Power System
**
Charging Pump Cooling System
X| xX xX
Safety Injection Pump Cooling System
x|X| xX
Reactor Plant Component Cooling Water System
xX|X|X
Turbine Plant Component Cooling Water System
x|x| xX
Circulating Water System
«1X
Service Water System
X|X| xX] **

* Requires offsite power
** Not applicable

89


1.0 T T
og Curve 1 NY,
(weak 2
component) Curve
o (strong
5 component)
=
*
°
> 0.6 7
u 8
zs
=o
zs
e 3
§
= 04;- +
a]
i=
fo}
s)
0.2 7
G1 G2
0 J ! ! !

0 2 4 6 8 10

PGA (g)

Fig. G-1. Fragility Curves. For a pga equal to Gl, the weak and strong
components both have a low probability of failure (i.e., low fragility). At
level G2, the weak component (i.e., the one with low capacity) has a high
Probability of failure (i.e., high fragility) and the strong component (i.e.,
high capacity) has a low probability of failure (i.e., low fragility).

CODE MARGIN

Margin computed as follows:
a) using structural response parameters (such as damping) less stringent
than those used in the Standard Review Plan,
b) using only normal loads plus seismic loads,
ec) assuming essentially elastic behavior, and
d) assuming capacities defined by code and the Standard Review Plan.

COMMON CAUSE FAILURES

The primary failures (of components) on a fault tree are not necessarily
independent. There may be a single cause for multiple component failures. When
this cause is not intrinsic to the components, but is a result of an external
effect, it is a common cause failure (e.g., an operator may miscalibrate all
the sensors, a steam line break may cause all instrumentation to fail in a
control panel or an earthquake may cause multiple component failures).

94


damping, and response spectra) need to be selected. In the fragility-analysis
method median values Bp and By need to ber estimated by the fragility
analyst. There have not been enough studies done to compare the HCLPF
estimated using these two candidate methods for different components.
Additional comparison studies should be conducted to identify situations where
both methods would yield comparable results and those where the results would
widely differ. A review of such results would also lead to a "calibration" of
the parameter values of either or both methods so that the two methods give
essentially identical capacity estimates. The final goal of such studies
would be to provide a set of deterministic rules in the CDFM method for
calculating the HCLPF of screened in components. Until such research is done,
it is recommended that both the candidate methods be used to calculate the
HCLPF of components in trial plant reviews. The trial plant reviews should be
viewed as providing further basis and guidance on research towards calibration
of the two candidate methods.

4.8.1.1 Conservative Deterministic Failure Margin (CDFM) Method

In this method a failure margin is computed using conservative material and
response parameters but taking credit for conservatively defined failure
capacity and inelastic energy absorption capability of structures and
components. The following parameter values have been proposed (Ref. 7) and
might be more conservative than necessary:

Load Combination:

Ground Response Spectrum:

Damping:

Structural Model:
Soil-Structure Interaction:
Material Strength:
Static Capacity Equations:
System Ductility:
(Inelastic Energy

Absorption)

Floor Spectra Generation:

Normal + Earthquake Review Level

84% Non-Exceedence Probability Site-Specific
Spectrum

Depending on the earthquake review level,
the following are the conservative estimates
of the median values:

Structure: 7%

Piping: 5%

Cable trays: 15%

Best-estimate ~ median

Envelope expected parameter variation

95% exceedance actual strength

84% exceedance by test data or code equation
Conservatively selected to be between 1.0
and 1.5. For shear wall structures, should
not be less than 1.3.

Median damping value for equipment

Frequency shifting of floor spectra rather
than peak broadening.

57


The plant-level fragility and, therefore, the HCLPF, depend on the degree of
dependence in randomness and uncertainty between the component fragilities.
For example, when the component failures are assumed to be perfectly dependent
(in both the randomness and uncertainty), the HCLPF value for core melt is
calculated to be 0.30g. It is recommended that bounding cases of perfect
independence and perfect dependence be studied to establish the lowest plant-
level HCLPF. If partial dependence between component failures must be
quantified, plant-level HCLPF could be obtained using the method in Ref. 22.

For active equipment that has a chance of being unavailable (i.e., the result
of random failure or testing or maintenance outage), the probability of
failure given an earthquake peak ground acceleration is given by the
Probability of the union of the events, i.e., earthquake induced failure of
equipment and the unavailability of the equipment.

4.8.3 Final Results
The results of this margin evaluation may be summarized as:

© Some components of Group A functions have capacities generically
larger than the earthquake review level (Sec. 4.4 and 4.6).

o On the basis of plant-specific information and employing the methods
described in Section 4.8.1, some other components have HCLPF values
larger than the earthquake review level.

o If the plant level HCLPF is calculated to be larger than the
earthquake review level (determined using the methods described in
Section 4.8.2.), the plant has adequate seismic margin against the
earthquake review level.

° If the plant level HCLPF is found to be lower than the earthquake

review level, a numerical value of the plant seismic capacity at a
high confidence and low probability of failure level will be provided.

63


serving the functions of have been screened out (subsets 2 and 3) and among
those remaining, all those with a HCLPF above the earthquake review level
(subsets 1 and 4) have been screened out (shaded area in Fig. 2-1).

In practice, the process of screening in (and out) is performed by a series of
operations. These successive operations consist of applying a series of
filters to the set of components. The chronological order of applying these
may differ from the order shown in Figs. 2-1 to 2-5.

° The first filter represented in Fig. 2-2 partitions the complete set
of components and plant-unique features into those which serve the
functions of Group A (subset A) and those which do not (subset NOT-
A). The components in subsets 2 and 3 are immediately screened out.

° The second filter partitions the remaining subsets according to the
estimate of their minimum seismic capacities by using the guidance
Provided by Table 2-1 and the material in Chapter 5 of Ref. 1. This
is a conservative filtering that requires verification by a
walkdown. This filter also includes performing a review of the
plant unique features associated with the Group A functions. Some of
these unique features may be identified by the analyst from a review
of the drawings and all general plant information available, but
others may also be discovered at the time of the first walkdown,
which is part of the next filtering operation. The outcome of this
filtering is shown in Fig. 2-3, in which the Subsets 7 and 10
represent the elements screened out and Subsets 8 and 9 represent.
those remaining.*

° The third filtering includes a first walkdown that is designed to
confirm the pre-screening performed by the second filter. In this
walkdown, some components that were thought to have sufficient
seismic capacities will actually appear to have a lesser capacity
for.a number of reasons (e.g, anchorage, or some systems interactions
will be discovered, which were not identified earlier). Thus, the
boundaries of the Subsets 8 and 9 will move to their new location
shown in Fig. 2-4 to become Subsets 13 and 14.*

° The fourth and final filtering, which includes a second plant
walkdown concentrating on components for which a further detailed
structural and/or mechanical (fragility) analysis is required,
finalizes the sorting by screening out the components and plant-
unique features for which the HCLPF has been estimated to be above
the earthquake review level. Thus, the boundaries of the subsets 13
and 14 move to become the boundaries of subsets 16 and 17 which
approximate subsets 6 and 5 of Fig. 2-1.*

At this stage, the final screening has been performed and only the components

“The prime (") and double prime (") used on the venn diagram indicate that the
subsets N' and Y', N" and Y" are not necessarily the final subsets N and Y. As the
successive filters are applied, the subsets (N',¥'), (N",Y") converge toward (N,Y).


GLOSSARY

91


Start

Time axis

Gather information
on systems and sort
Group A functions.
Use information

on Table 2.3 and =|"
Ref.1. ft

KEY: Task is performed by:

Systems Analyst

Si

Fragility Analyst

bat

Interaction
<-—————. i

1 ) Select an earthquake review level

Gather information on

the plant. Determine which
broad classes or groups of
components have HCLPF
values greater than the review
4 level. Possibly identify plant-
unique features.

First plant walkdown:

Concentrate on identification of problems.
Emphasize systems interaction. Confirm
applicability of screening tools. Complete
identification of plant-unique features.

Revision of systems
relationships established
in Step 2. Develop fault
trees and event trees,

Second plant walkdown:

7, Primarily fragility analyst for checks.
Collect specific data (size and other
physical characteristics) of components

requiring detailed analysis.

Determine minimal
cut sets for end-
point core melt.

Finalize HCLPF value for
components in final cut sets

YY (components not screened out).

y

Margin

complete

assessment

Fig. 2-6. Graphic Representation of the Screening Operations.

13


List of Initial Information Request:

- Sections of the FSAR or other documents (e.g., PSAR, utility reports)
that describe the seismic design criteria and the site soil
conditions.

- Plant general arrangement drawings including floor elevations and
equipment locations, to become familiar with the plant.

- List of drawings.
- Information on available reports.

The analysts will review the initial information to evaluate whether a
reanalysis is necessary based on the design analysis and the earthquake review
level. The general arrangement drawings will be reviewed for structural items
that may require examination (e.g., large cutouts). If necessary, the
reanalysis of some selected structures will be started at this point. Then,
the team of fragility analysts will meet with the team of systems analysts to
Marrow down their scope of analysis and to formulate their additional needs
for information as described in Step B.

Step B

In Step B, a second, more specific, information request will be made to carry
out the reanalysis needs identified in Step A. This specific information is
listed below but is not limited to the following items:

Second Request for Specific Information Needs:

- Selected structure and foundation drawings.

- Tank drawings and tie-down provisions.

- Soil property information.

- Seismic Qualification Review Team (SQRT) forms (if available).
- Selected equipment anchorage details.

- Selected calculations and design reports

4.3.2 Determination of Target Areas for First Plant Visit

The fragility analyst will prepare a list of components of the Group A
functions, prior to the first plant visit: then develop a list of items to be
reviewed carefully at the time of the visit (first walkdown). This list will
include a precise description and location of the items in the field.
However, this list is not exhaustive and is intended to be a minimum of what
must be inspected. The analyst will use his judgment in the field in
selecting other items that deserve attention. An example of a partial list is
given in Tables 4-2 and 4-3.

The first visit to the plant (first walkdown) is described in Step 4. It will
confirm the pre-screening performed in Steps 2 and 3.

42


TABLE 6-3

PLANT FUNCTIONS VS FRONT LINE SYSTEMS MATRIX

TsO) Tees ding UeTOoD 30zeSy

WozSkS AUS Aaepuoses

weysks AUS ATeWTId

xX} xX] xX

wezsks Aeads qouend

WeySkS WOTPETHoIITOON

waysks Joyempoay ATETTIXny

WazSskS JozeTMINOOy

wezskE UdTFIe—ul sainsseig MOT

Wezsks UOT}IeLUl Sanssead Q3tH

X|X| xXx

WezSkS WOTSISAUOD TOMO"

Weysks UOTII9R0Ig 10zyIeag

Reactor

Subcriticality

Normal

Cooldown

Emergency Core
Cooling (Early)

Emergency Core

Cooling (Late)

Containment

Heat Removal

Containment

Protection (Early)

Overpressure
Containment

Protection (Late)

Overpressure

87


CHAPTER 3.

RELATIONSHIP OF SEISMIC MARGIN REVIEW TO OTHER SEISMIC STUDIES

Seismic margin review methodology described in this report has similarities
with and differences from other seismic studies such as seismic PRAS,
deterministic and probabilistic seismic margin studies, and the Systematic
Evaluation Program. A seismic margin review is also fundamentally different
from the Safe Shutdown Earthquake (SSE) design or reevaluation for the SSE.
In this chapter we discuss these similarities and differences with the
objective of highlighting the merits and limitations of the recommended
seismic margin review methodology. Finally, we describe some limitations of
the seismic margin review methodology.

3.1 Comparison with Seismic PRAs

In recent years, seismic PRAs for eight nuclear power plants (Zion, Indian
Point 2 & 3, Oconee, Limerick, Midland 2, Seabrook, and Millstone 3) have been
Published. Many others are underway. In addition, the NRC funded the Seismic
Safety Margins Research Program (SSMRP, Ref. 4) at Lawrence Livermore National
Laboratory (LLNL) to develop seismic risk analysis methods. The SSMRP
methodology was first applied to the estimation of seismic risk of the Zion
Nuclear Generating Station. Presently, LLNL is estimating the seismic risk of
LaSalle County Station as part of an overall risk assessment being performed
by Sandia National Laboratories under the Risk Methods Integration and
Evaluation Program (RMIEP).

The key elements of a seismic PRA are:

o Seismic hazard analysis

° Seismic fragility evaluation

o Plant system and accident analysis

o Evaluation of consequences

The outputs of a seismic PRA may include:

o Frequencies of occurrence of core melt and consequences to the public
(e.g., early fatalities, potential adverse health effects, and
Property damage).

o Identification of dominant seismic risk contributors - if the plant
seismic risk is not acceptable, these elements may be upgraded to
reduce the risk.

© Identification of the range of earthquake peak ground accelerations
that contribute significantly to plant risk. In the seismic PRAs

completed to date, the uncertainties in the risk estimates have been
quite large. These arise from the large uncertainties in the seismic

25


of subsets 5 and 6 are considered in the systems analysis. An alternative
graphic representation of the screening operations is given in Fig. 2-6 where
each component is described by its association with the functional group and
the value of its estimated HCLPF. This figure represents the classes of

components screened out and the components remaining for the final systems
analysis.

NOT-A 2 3

U
Plant-unique . c ,
features Generic & non-generic components
a

Fig. 2-2. Venn Diagram Representing the First Filtering System. Components
(U & C) are separated into those serving functions of Group A (Subset A) and

those not serving functions of Group A (Subset NOT-A). ‘The Subsets 2 and 3
are screened out.


4.7 Step 7 - System Model Analysis

The objective of this step is to analyze the event trees and fault trees to
determine the Boolean expression for front-line system failures, accident
sequences, and the aggregation of accident sequences. Step 7 is performed
concurrently with Step 8 and requires significant interaction between the
systems analysts and fragility analysts. The general tasks to be performed
are the following:

o Analyze the event trees to determine the accident sequences that lead
to seismic induced core melt.

o Analyze the fault trees to determine the Boolean expression for each
front-line system failure.

© Determine the Boolean expression for the seismic induced core melt
accident sequences.

o Document the results of the system model analysis.

The system failure, accident sequence, and overall plant Boolean expression
will describe the single basic events or combinations of basic events that
must occur for the occurrence of the top event, system failure, or core
melt. The system models analyzed in this step were developed in Step 5 and
reviewed and finalized as a result of Step 6.

There are many computer codes available for the analysis of event trees and
fault trees. The computer code SETS (Ref. 17) is widely used for the analysis
of both event trees and fault trees. Section 6.5 of the PRA Procedures Guide
(Ref. 12) describes a number of computer codes currently available for the
qualitative and quantitative evaluation of system and plant logic models.

4.7.1 Accident Sequence Selection

The event trees developed in Step 2 and completed in Step 5 are analyzed to
determine those accident sequences that lead to seismic induced core melt. An
accident sequence is a sequence of events, all of which must occur for the
occurrence of the end state of the sequence. Each event in an accident
sequence is either the success or failure of the front-line system associated
with the branch points in the event tree or the initiating event. It is
important to include both system success and failure in the accident
sequences. The occurrence of each of the system events in an accident
sequence is determined by analyzing the fault tree for that system.

The accident sequences identified in the event trees must be assessed to
determine those sequences that lead to seismic induced core melt. For PWRs,
these sequences will involve the failure to remove core heat, whether it is
decay heat or heat produced during power operation, early in the accident
(during the injection phase). For BWRs, the sequences will involve a number
of functional failures, both early and late in the accident progression.

Any sequence that does not result in core melt should be eliminated from
further analysis. The core melt accident sequences and the system failure

53




4.9

Chapter

Glossary

References

Step 5 - Systems Modeling ....

4.5
4.5
4

Step 8 - Margin Evaluation of Components and

Finalize Event Trees ...
Fault Tree Development . .
Documenting System Modeling
~ Second Plant Walkdown . .
Plant Walkdown Procedures .

~ System Model Analysis . .

Accident Sequence Selection
System Failure Analysis . .

Results

Accident Sequence and Plant Analysis ...
Documenting Systems Analysis

4.8.1 Capacity of Components ..

Plant

4.8.1.1
8.1.2

-8.1.

4.8.2 HCLPF Value of Systems and Plant ....

-l Deterministic

4.8.
8.2.2 Probabilistic

2
+8.2
4.8.3 Final Results...

Seismic Margin Review Team
5 Resources and Schedule . .
Review Team ..... eee

Independent Peer Review ..
Schedule... 6... 2.

6. Format for a Typical Seismic

Purpose of Study ......

Plant Safety Systems and their

Approach .....
Approach . 2. 6. eee

Qualifications ...

Margin Report . . .

Seismic Design Bases

Screening of Systems and Components .......
Evaluation of Seismic Margins ........24.6.6

Plant Review and Walkdown .
Conclusions ..... es.
Documentation of Trial Plant

Reviews . 2... eee

Conservative Deterministic Failure Margin
Fragility-Analysis Method .....

4g
49
50
51
51
52
53
53
54
55
55
56
56

57
59

60

61
61

63
76
79
79
79
83
83
83
84
84

85
85

91

103


documents should be documented. The results of the second plant walkdown
should be described in terms of the physical data used for HCLPF evaluation.

6.6 Conclusions
The final chapter of the seismic margins report should contain the following:

© Tables showing the screened out systems and components and basis for
such screening.

© Table showing the HCLPF values of screened-in components and estimate of
plant level HCLPF.

© Identification of low capacity elements in the plant and results of any
studies performed to confirm their seismic capacities.

o Statement as to whether the plant has capacity beyond the earthquake
review level.

6.7 Documentation of Trial Plant Reviews

The objectives of trial plant reviews are to test the applicability of this
seismic margin review methodology and to improve the methodology based on the
results and insights gained in such trial plant reviews. In order to
accomplish these objectives, the procedures used and the results obtained in
the trial plant reviews should be thoroughly documented for the Expert Panel's
peer review and subsequent refinement of seismic margin review guidelines.

Documentation should include, in addition to the items previously described in
this chapter, the following items:

© Basis for selection of the plant(s) for trial review and how the review
Proves the applicability of the seismic margin review methodology for
other plants.

© Screening tools used in plant reviews (e.g., screening tables and
simplified analyses).

© Assumptions made in the HCLPF calculations.

o Comparisons between HCLPF values obtained using different candidate
methods.

© Detailed description of design review and plant walkdowns; include
design documents, system descriptions, field notes, photos of equipment
and sketches.

© Engineering hours spent on various tasks of the trial plant review(s).

o Any difficulties experienced in following the Panel's guidelines and
deviations taken in the review.

o Further specific guidelines and procedures needed.

85


3.6.3

situations where both methods would yield comparable results or where
the results would differ widely. A review of such results may also
lead to a "calibration" of the parameter values of either or both
methods so that they would give essentially identical capacity
estimates. This should also lead to improved HCLPF determinations.

Further Research Needs

The Panel could not make specific recommendations on BWR system
screening criteria. When more seismic PRAS on BWR plants are
published, the Panel recommendations will be revised to include them.

The effects of potential design and construction errors, relay
chatter, and operator errors are not well understood at this time.
Further research is needed in these areas to assess their impact on
the proposed seismic margin review methodology. (See Chapter 7 of
Ref.1).

30




CHAPTER 4
DETAILED DESCRIPTION OF THE SEISMIC MARGIN REVIEW PROCESS

The seismic margin review process is divided into eight steps as outlined in
(Ref. 1) and briefly discussed in Chapter 2. This chapter gives the details
of the performance of each of these steps. The results of this review process
are the HCLPF values for components, systems, accident sequences, and the
overall plant that can be used to make decisions about the seismic capacity of
the plant for the earthquake review level.

The next eight subsections give the details of the eight steps. Several of
these steps can be performed concurrently. Section 4.9 gives the
qualification requirements of the review team.

4.1 Step 1 - Selection of the Earthquake Review Level

The choice of the review level is a critical one since it is used as a basis
for screening out components. The review level should be specified in terms
of pga and enough spectral information to assure the applicability of the
material of Chapter 5 in Ref. 1 which is partially given in Table 2-1 of this
report. If the review earthquake spectral content is not consistent with the
assumptions made in Ref 1, then this difference needs to be taken into
account. Table 2-1 was constructed to cover most spectra generated by
magnitude 6.5 earthquakes or less. In addition, spectral information will be
needed to calculate HCLPF values.

If the level for which the existence of a seismic margin must be demonstrated
is substantially lower than 0.3g (0.2g, for example) there is no need to
perform the review for a level higher than 0.3g. Yet because the guidance
given in Table 2-1 is based on only two acceleration values (0.3g and 0.59),
the analyst might choose a review level of 0.25 to 0.3g. This choice would
still enable him to generically screen a maximum number of components out of
the analysis.

If, on the other hand, the level for which margin must be demonstrated is
about 0.3g, the analyst is presented with two alternatives:

1. The first alternative is to perform the review for 0.3g (using the
first column of Table 2-1) recognizing that a substantial amount of
conservatism was considered in the development of the screening tools
(Tables 2-1 and 2-3). However, this alternative will lead to
screening out a large number of components without requiring special
detailed analysis and may lead quickly to a conclusion that there is
sufficient margin with only minor additional required quantification.

2. The second alternative is to choose a review level larger than 0.3g
(use the second column of Table 2-1). The drawback of this
alternative will be that fewer generic components will be screened out
in Steps 3 and 4. Consequently, more components will need a detailed
engineering analysis to determine their actual HCLPF value. On the
other hand, the analyst will probably have the advantage of being able
to quantify the overall HCLPF of the plant, thereby going one step

33