NUREG/CR-7237

Correlation of Seismic

Performance in Similar 

SSCs (Structures, Systems, 

and Components)

Office of Nuclear Regulatory Research

NUREG/CR-7237

Correlation of Seismic 

Performance in Similar 

SSCs (Structures, Systems, 

and Components)

Manuscript Completed: March 2015

Date Published: December 2017

Prepared by: 

Robert J. Budnitz1, Gregory S. Hardy2

, David L. Moore3, and M. K. Ravindra4

1 Lawrence Berkeley National Laboratory

Energy Geosciences Division

University of California, Berkeley, CA 94720

2

 Simpson Gumpertz & Heger

4695 MacArthur Court

Newport Beach, CA 92660

3

 David L. Moore Consulting

9721 SE 43rd Street

Mercer Island, WA 98040

4 MK Ravindra Consulting

15 Fortuna West

Irvine, CA 92620

Jose Pires, NRC Project Manager 

Office of Nuclear Regulatory Research 

iii

ABSTRACT 

This report describes an improved and more refined and insightful methodology for analysis of 

correlation or dependency as part of the overall methodology of seismic PRA (SPRA) for

nuclear power plants. The focus is on those classes of structures, systems, or components

(SSCs) for which the way correlations or dependencies are analyzed in SPRA makes an 

important difference to the SPRA results or to the safety insights derived from those results.

The fundamental question is what is the joint probability of seismic-caused failure of two or more 

SSCs conditional on the occurrence of an earthquake of a given size, and how and why that

joint probability may be different from the situation in which those failures are essentially

independent. An improved and more refined and insightful methodology is identified and

presented, its rationale is explained, and examples are provided to demonstrate how the

methodology can be used in practice.

v 

FOREWORD

Appendix A, “General Design Criteria for Nuclear Power Plants,” to 10 CFR Part 50, General 

Design Criterion (GDC) 2, “Design Bases for Protection Against Natural Phenomena,” requires, 

in part, that nuclear power plant structures, systems, and components (SSCs) important to 

safety must be designed to withstand the effects of natural phenomena (such as earthquakes) 

without loss of capability to perform their safety functions. Such SSCs must also be designed to 

accommodate the effects of, and be compatible with, the environmental conditions associated 

with normal operation and postulated accidents.

Probabilistic risk assessment (PRA) is an analysis tool that is now routinely used by both the 

NRC staff and the operators of nuclear power plants to analyze aspects of the safety of nuclear 

power plants, and is a required analysis methodology under certain circumstances. This 

includes the aspect of PRA known as seismic PRA that analyzes accident sequences initiated 

by earthquakes. Although seismic PRA is a mature analysis methodology, one important 

element of SPRA, the analysis of dependencies or correlations in the seismic capacities of 

SSCs and in their responses to earthquakes, has for many years been a source of concern. 

Specifically, many seismic PRA experts have believed for a long time that the method for 

analyzing these dependencies or correlations could be improved, but there has been no 

consensus about what the improvement might entail. This issue is important because whether 

these capacities and responses are independent or partially (or even totally) dependent, 

especially for identical or nearly identical SSCs that are co-located or nearly so, can make a 

difference to the insights derived from many seismic PRAs. 

The U.S. Nuclear Regulatory Commission (NRC) initiated the current research to explore this 

correlation-dependency issue and, if feasible, to recommend one or more advanced, more 

refined and more insightful analysis approaches. Specifically, although several methodologies 

for dealing with this issue are in the literature and have been proposed or promoted by their 

developers as an improvement, no explicit evaluation of them had been accomplished. Also, 

there had not been a directed review of the SSC-failure database that might support any such 

improvement. This research project has had as its aim to accomplish those review and 

evaluation tasks, leading to a proposal for an improved methodology.

The NRC research program on this topic has been conducted by the NRC’s Office of Nuclear 

Regulatory Research at the Lawrence Berkeley National Laboratory. LBNL’s in-house expertise 

was supplemented by a team of highly experienced outside experts. That team, in turn, sought 

and received input, review, and advice from a larger group of seismic PRA experts, including 

some of the most experienced and accomplished seismic PRA practitioners.

The research program focused on several technical topics and the resulting findings and 

recommendations are included in this document. The major work included (1) evaluations of all 

of the existing and proposed methodologies, (2) a review of a select set of seismic PRAs in the 

literature, and (3) an evaluation of the existing SSC-failure database. These evaluations and 

review lead to a methodology based on a modification to the well-known and widely-used 

“separation-of-variables” approach for analyzing seismic fragility for SSCs. The “separation of 

variables” approach is well-suited to support the analyst’s goal of developing the fragility curves 

for the joint failure of components based on what are seen to be the common and independent 

variabilities among the factors that affect the seismic capacity and response of these 
vi

components. That tool should be capable of analyzing seismic correlation-dependency in a way 

that can produce more refined and insightful results with a more defensible technical basis.

The focus of the report is a presentation of the technical work leading up to the recommendation 

of this improved methodology, along with an evaluation of several other approaches deemed 

less suitable. As noted, the recommendation made herein is supported by a review of several 

existing seismic PRAs in the literature and a review of the existing test and earthquakeexperience database relevant to the correlation-dependency issue. The report also contains 

simple examples that illustrate the proposed methodology.

With further demonstrations and if it achieves widespread use by the community of PRA 

practitioners, the new methodology described in this report will provide an improved and more 

refined and insightful approach to seismic PRA, one with a strong technical basis and less 

uncertainty, and hence seismic PRA methodology that would better inform safety decisionmaking. The results of the evaluation of existing methodologies, the review of the related SSCfailure database, and the attributes of the proposed analysis methodology also can inform staff 

reviews involving the treatment of seismic correlations and dependencies in seismic PRAs for 

operating reactors and new reactors.
vii

TABLE OF CONTENTS

ABSTRACT...............................................................................................................................iii

FOREWORD ..............................................................................................................................v

EXECUTIVE SUMMARY ..........................................................................................................xv

ABBREVIATIONS and ACRONYMS .....................................................................................xxv

ACKNOWLEDGMENTS........................................................................................................xxvii

1 INTRODUCTION.................................................................................................................1-1

1.1 Project Scope and Scope of this Report........................................................................... 1-1

1.2 The Work Reported Herein – Four Different Activities ..................................................... 1-2

1.3 Why Undertake this Project?............................................................................................ 1-3

1.4 The Terms “Correlation” and “Dependency”..................................................................... 1-3

1.5 History and Current Practice ............................................................................................ 1-4

1.6 The Project’s Major Product: a New Methodology ........................................................... 1-4

1.7 Summary of Project Execution ......................................................................................... 1-5

1.7.1 Summary of Systems Analysis Work..................................................................... 1-5

1.7.2 Summary of Seismic Capacity-Fragilities Work ..................................................... 1-5

1.7.3 Results of the Workshop in June 2011 .................................................................. 1-6

1.7.4 Pessimism about Major Reliance on the Existing Test or Experience Data 

Base........................................................................................................................1-7

1.7.5 The Second Workshop in November 2012............................................................ 1-7

1.8 Importance of Seismic Dependency................................................................................. 1-8

1.9 Expectations on the Impact of Results Arising from Using the Proposed Method ........... 1-9

1.9.1 Case A – Apparently Very Highly Dependent SSCs.............................................. 1-9

1.9.2 Case B – Apparently Independent SSCs............................................................. 1-10

1.9.3 Case C – 3 or More SSCs ................................................................................... 1-11

2 LITERATURE REVIEW – TREATMENT OF CORRELATIONS AND 

DEPENDENCIES IN SEISMIC PRA....................................................................................2-1

2.1 Summary of Literature Review ......................................................................................... 2-1

2.1.1 Background............................................................................................................ 2-1

2.1.2 Single Unit.............................................................................................................. 2-1

2.1.3 Numerical Methods for Seismic Risk Quantification Accounting for 

Dependency............................................................................................................2-4

2.1.4 The Issue of a Multi-Unit Site............................................................................... 2-15

2.2 Differences Between Internal Events and Seismic Events............................................. 2-16

3 TEST DATA BASE AND EARTHQUAKE EXPERIENCE DATA BASE – 

USEFULNESS ....................................................................................................................3-1

3.1 Introduction and Summary ............................................................................................... 3-1

3.2 Earthquake Experience Data............................................................................................ 3-1

3.3 Seismic Test Data ............................................................................................................ 3-4

4 REVIEW OF SPRA LITERATURE CONCERNING THE IMPORTANCE OF 

DEPENDENCIES OR CORRELATIONS.............................................................................4-1

LIST OF FIGURES.........................................................................................................................xi

LIST OF TABLES.........................................................................................................................xiii
viii

4.1 Introduction....................................................................................................................... 4-1

4.2 The Review ...................................................................................................................... 4-1

4.3 Insights from the Review .................................................................................................. 4-2

4.3.1 Major Systems Insights.......................................................................................... 4-2

4.3.2 Insights Concerning SSC Types............................................................................ 4-3

5 SPECIFIC CLASSES OF SSCs – ASSESSMENTS BY THE EXPERTS............................5-1

5.1 Background .......................................................................................................................5-1

5.2 Workshop Observations for Various Classes of SSCs......................................................5-2

5.2.1 Large Tanks: Condensate Storage Tanks or Other Similar Tanks .........................5-2

5.2.2 Electrical Motor Control Centers .............................................................................5-3

5.2.3 Mechanical: Long Shafted Service-Water Pumps, Horizontal Aux Feedwater 

Pumps (Motor and Turbine Driven).........................................................................5-3

5.2.4 Batteries and Racks................................................................................................5-4

5.2.5 Masonry Walls ........................................................................................................5-5

5.2.6 Small Tanks: Diesel-Generator Fuel-Oil Day Tanks ...............................................5-5

5.2.7 Heat Exchangers, Such as Component Cooling Water Heat Exchangers .............5-6

6 RESPONSE CORRELATION .............................................................................................6-1

6.1 Introduction....................................................................................................................... 6-1

6.2 Probabilistic Seismic Response Analysis ......................................................................... 6-2

7 METHODOLOGIES FOR CALCULATING THE FRAGILITY OF JOINT FAILURES ..........7-1

7.1 Correlation Coefficient Method......................................................................................... 7-1

7.2 Conditional Probability of Failure Method......................................................................... 7-2

7.3 Split Fraction Method........................................................................................................ 7-2

7.4 Separation of independent and Common Variables Approach ........................................ 7-3

7.5 Selection of Preferred Procedure ..................................................................................... 7-7

8 ILLUSTRATIVE DESCRIPTION OF THE PROPOSED METHODOLOGY FOR 

CALCULATING THE FRAGILITY OF JOINT FAILURES...................................................8-1

8.1 Introduction....................................................................................................................... 8-1

8.2 Examples.......................................................................................................................... 8-2

8.2.1 Case 1: Identical Components Located Next to Each Other ................................. 8-2

8.2.2 Case 2: Identical Components on Different Floors ................................................ 8-3

8.2.3 Case 3: Different Components Located Side-by-Side ........................................... 8-3

8.2.4 Case 4: Different Components on Different Floors ................................................ 8-3

8.2.5 Case 5: Union of Components............................................................................... 8-4

8.3 Example of 2 Out of 4 Success Criteria............................................................................ 8-5

8.4 Assessment of Common Variables .................................................................................. 8-6

8.5 Generalization of Reed and McCann Procedure for Multi-Component Correlation.......... 8-7

9 CONSIDERATIONS ON USING THE NEW METHODOLOGY IN SEISMIC PRA...............9-1

9.1 Introduction....................................................................................................................... 9-1

9.2 How the analysis will likely proceed ................................................................................. 9-1

9.3 Caveats When Using the New Methodology.................................................................... 9-2

10 SUMMARY .......................................................................................................................10-1

10.1 Introduction.....................................................................................................................10-1

10.2 How the Results of This Research Project can be Used in Future Seismic PRAs .........10-2

10.3 How an Application of the Methodology Will Likely Proceed..........................................10-2
ix

10.4 Recommendations for Future Work................................................................................10-3

11 REFERENCES .................................................................................................................11-1

APPENDIX A REPORT ON THE LBNL SEISMIC CORRELATIONS WORKSHOP

16 – 17 JUNE 2011, NEWPORT BEACH CA.....................................................A-1

APPENDIX B REPORT ON THE LBNL SEISMIC CORRELATIONS WORKSHOP 

1 – 2 NOVEMBER 2012, NEWPORT BEACH, CA.............................................B-1

APPENDIX C SELECTED MODELS TO TREAT SEISMIC CORRELATION 

BY M. K. RAVINDRA (20 OCTOBER 2012).......................................................C-1

APPENDIX D SAMPLE CALCULATIONS.................................................................................D-1

xi 

LIST OF FIGURES

Figure 2-1 Discretization of Lognormal Distribution ............................................................ 2-20

Figure 2-2 Uncertainty Discretization.................................................................................. 2-20

Figure 2-3 Powers n2, n3 and n4 as a Function of the Correlation Coefficient and the 

Single Component Failure Probability P1 ........................................................... 2-21

Figure 2-4 Example Hazard Curve for Two Sites................................................................ 2-21

Figure 3-1 Vertical Pump Performance Summary from the SQUG Earthquake 

Experience Database (from EPRI, 1996).............................................................3-2

Figure 7-1 Conditional Probability of Failure vs. PGA/HCLPF ..............................................7-8

Figure 7-2 Conditional Probability for Different Split Fractions..............................................7-8

Figure 7-3 Conditional Probability of Two Components Failing Using Separation of 

Independent and Common Variables ..................................................................7-9

Figure 7-4 Conditional Probability of Component B Failing given Failure of A using 

Different Methods................................................................................................7-9

Figure 8-1 Fragility Curves for Joint Failure of A, B and C, Case 1.......................................8-8

Figure 8-2 Fragility for Joint Failure of Three Components (Case 1) for Three Models: 

Zero Dependency, 100% Dependency, and Reed-McCann Method....................8-8

Figure 8-3 Fragility of Joint Failure of Three Components in Different Configurations ..........8-9

Figure 2-5 Fragility Curves for Different Cut Sets.................................................................2-22

xiii

LIST OF TABLES

Table 2-1 Rules for assigning Response Correlation ρR1R2.............................................. 2-17

Table 2-2 Power nK as a Function of P1 and ρRS [Pi is the probability of failure of 

component i] ................................................................................................... 2-18

Table 2-3 Sensitivity of Cut Set Frequency (per year) to Load Roughness Factor .......... 2-18

Table 2-4 Fragilities of Cut Sets with Independent Failures ............................................ 2-19

Table 2-5 Comparison of Failure Frequency of Two Independent Identical 

Components (Cut Set A*A) with Failure Frequency of a Single 

Component (A) ............................................................................................... 2-19

Table 7-1 Annual Frequency of Joint Failure of A and B ................................................. 7-10

Table 7-2 Cut Set (A*B) Frequency vs. Split Fraction...................................................... 7-10

Table 7-3 Sample of Median Capacity Values ................................................................ 7-11

Table 7-4 Mean Annual Frequency of Joint Failure of Two Identical Components A 

and B using Different Models .......................................................................... 7-11

Table 8-1 Mean Annual Frequency for Three Component Failures for Different 

Configurations................................................................................................. 8-10

Table 8-2 Mean Annual Frequency of 2 out 4 System Failure......................................... 8-10

xv 

EXECUTIVE SUMMARY

Background 

Seismic Probabilistic Risk Assessments (SPRA) have been conducted for a large number of 

nuclear power plants worldwide in the last 35 years. The methodology has progressed during 

that period of time and is currently well established with several technical references 

documenting the methodology. Seismic PRA is different from an internal-event PRA in two 

important ways: (a) All possible levels of earthquakes along with their frequencies of 

occurrence and consequential damage to plant systems and components should be considered, 

and (b) Earthquakes can simultaneously damage multiple redundant components or even 

multiple co-located nuclear units. This major common-cause effect should be properly 

accounted for in the risk-quantification.

The fact that the frequency of occurrence of earthquakes near a nuclear power plant and the 

conditional probability of failure (commonly known as “fragility”) of structures, systems and 

components vary with the “size or intensity” of earthquake is properly accounted for in the 

quantification by convolving (i.e., integrating) the conditional probability of accident sequences 

(e.g., core damage sequences) over the earthquake hazard frequencies. However, no 

satisfactory method is in widespread use to analyze how to treat the dependencies or 

correlations in the seismic capacities of SSCs and in their responses to earthquakes. The 

analysts assume that identical redundant components located next to each other which are 

subjected to the same seismic responses would fail simultaneously. This approach “one fails, 

all fail” has been known sometimes to be conservative and contributes to the uncertainty in 

seismic risk estimates. Conversely, for diverse components or for similar components that are in 

different locations in the plant, the analysts assume that their seismic capacities and responses 

are fully independent (or uncorrelated), which can sometimes be non-conservative. The 

absence of a reliable method for analyzing such dependencies means that in some places our 

current seismic PRAs are conservative and in others non-conservative, neither of which is 

satisfactory if a better approach can be made available.

Scope of the research project

The U.S. Nuclear Regulatory Commission (NRC) initiated the current research to explore this 

correlation-dependency issue and, if feasible, to recommend one or more improved analysis 

approaches. Specifically, although several methodologies for dealing with this issue exist in the 

literature and have been proposed or promoted by their developers as an improvement, no 

explicit evaluation of them has ever been accomplished. Also, there has never been a directed 

review of the SSC-failure data base that might support any such improvement. This research 

project has had as its aim to accomplish those review and evaluation tasks, leading to a 

proposal for an improved and more realistic methodology.

The NRC research program on this topic has been conducted by the NRC’s Office of Nuclear 

Regulatory Research at the Lawrence Berkeley National Laboratory. LBNL’s in-house expertise 

was supplemented by a team of highly experienced outside experts. That team, in turn, sought 

and received input, review, and advice from a larger group of SPRA experts. 
xvi

Initial sensitivity studies

Seismic fragility is a function of acceleration, or more generally of seismic ground motion. At 

large ground motions, the probability of failure (the ordinate on the fragility curve) could be as 

high 0.9 or even 0.99. The joint failure probability of redundant components at the large ground 

motions with perfect independence may not be much lower than that obtained with the 

assumption of “one fails all fail,” which is in stark contrast to sequences in the internal events 

PRA, where the addition of a redundant component will usually dramatically reduce the accident 

sequence frequency. It is in the region in the lower half of the typical fragility curve, specifically 

at ground motion levels above which some damage may occur but below levels where damage 

is almost certain to occur, that there is the greatest potential sensitivity to whether the joint 

failure probability has an important dependency element. Our review of existing SPRAs 

revealed that sensitivity studies have not been systematically conducted for the assumptions of 

perfect independence and perfect dependence. During the current research, we performed 

several sensitivity studies of two and three component cut sets with different fragilities and 

hazards. The results convincingly demonstrate that correlation (dependency) cannot be 

ignored. Hence there is a need for a method for treating dependency more realistically. 

Review of existing seismic PRAs

A review was done of several seismic PRAs (SPRAs) in the open literature, to ascertain how 

correlations and dependencies were dealt with in each of them and how sensitive the bottomline results and the safety insights were to the approaches taken. The most important outcome 

of this review has been the identification of a list of those (few) categories of SSCs that make a 

“difference” if the approach made in the SPRA to analyzing correlations would be different from 

the customary assumptions of full dependence or perfect independence. 

An expert team conducted reviews of the results from past SPRAs to identify categories of 

structures and equipment that met the following two criteria:

1. They were observed to be within the group of dominant seismic risk contributors to a

number of past SPRAs, and

2. They were judged to have a high degree of potential correlation importance based on their

numbers within the plant and their typical locations within the plant.

The outcome of this work, which used expert judgment to examine the SPRAs, is that the 

following SSC categories are judged to be those where, at least in many SPRAs, the approach 

to analyzing correlation or dependency would make a difference to baseline seismic CDF or to 

the safety insights:

1. Masonry walls

2. Electrical: motor control centers

3. Large tanks: condensate storage tanks or other similar tanks

4. Small tanks: diesel generator fuel oil day tanks

5. Heat exchangers: such as component cooling water heat exchangers

6. Mechanical: long shafted service-water pumps, horizontal auxiliary feed water pumps

7. Batteries and racks
xvii

Review of the technical literature

The earliest attempt to treat the dependencies between seismic responses and between 

seismic capacities of components was in the seismic risk methodology developed from 1977 to 

1982 under the Seismic Safety Margins Research Program (SSMRP) at the Lawrence 

Livermore National Laboratory. The local responses of different components located at different 

elevations in various buildings were represented by a joint lognormal distribution; similarly, the 

capacities of these components were also represented by a joint lognormal distribution. The

parameters of these distributions are the means, logarithmic standard deviations and the 

correlation coefficient. The cut set failure is defined as all responses exceeding their associated 

capacities. The probability of the cut set failure is calculated by integrating the multi-lognormal 

distribution over the region where the response exceeds the capacity. Computer codes called 

SMACS and SEISIM were developed to perform the seismic response calculation and the 

seismic risk quantification, respectively. Because the application of this methodology was both 

computationally intensive and data intensive, it was not used in almost any subsequent SPRAs. 

However, it laid the foundation for seismic PRA as practiced today. Using the results of the 

SSMRP methodology to perform two SPRAs as trial applications (for Zion and LaSalle), Michael 

Bohn developed thumb rules for assigning the response correlation coefficient, thus bypassing 

the case-by-case computations. The researchers at the Japan Atomic Energy Research 

Institute have also applied and improved the SSMRP methodology for applications to Japanese 

nuclear power plants. 

When identical components are located on the same floor slab, the calculation of their 

correlated failure probability could be performed using a model proposed by Mankamo. He 

derived an expression for probability of failure of multiple redundant components as the single 

component failure probability P1 raised to the power nk. The value of nk approaches 1 for 

perfect dependence between component failures.

Reed et al. described a procedure to estimate dependency between component failures by 

searching for common sources of variability in the response and strength calculations. The 

dependency in the structural parameters can be quantified by examining the process in which 

the individual factors of safety in a fragility assessment are developed. This procedure, herein 

called the “Reed-McCann Procedure” was identified by the project team as the most promising 

and the most easily adapted for SPRA purposes. This method is discussed in detail with 

examples. 

More recently, Pellissetti and Klapp have proposed an approach that uses the traditional 

Common Cause Failure (CCF) model for internal events PRA employing beta factors. The beta 

factor approach, discussed in detail in the main text, is derived by equating the joint probability 

of failure of components in the cut set to the probability of a cut set represented in the CCF 

model. The authors have not applied the procedure to identical components located next to 

each other (making the response correlation coefficient equal to 1).

Review of earthquake data and qualification and fragility data

Part of the project scope has been to examine the test data and earthquake experience data to 

determine whether they can provide adequate support for determining dependencies, if only 

perhaps for some classes of SSCs. A review of these data, supplemented by consultation with 

other experts whose familiarity with the data is extensive, led the project team to conclude that 

the data are inadequate for the purposes of supporting an informed approach to analyzing 
xviii

dependencies. This conclusion was reinforced when the project team discussed this issue with

a group of outside experts during the first project workshop in June 2011; it was reinforced 

again during the second project workshop in November 2012.

Workshops

The first project Workshop was held in June 2011. Several invited experts were asked to 

provide review and feedback on the project’s progress up to that time. The main emphasis was 

on identifying possible data bases that might help the project team on the correlation issue. 

Among the Workshop’s conclusions were: 

o Based on the review of about 10 SPRAs, it was agreed that for some nuclear power plants,

the SPRA analysis results can be quite sensitive to the way the analyst treats correlations

among the failures. For many PRAs, the baseline core-damage frequency (CDF) numbers

are not very sensitive to the correlation issue, but the risk insights are sensitive to the

correlation assumptions in the analysis.

o General agreement emerged that the part of the SPRA analysis where the sensitivity to the

correlation assumptions is greatest is in the region of the seismic fragility curve between

about 5% and about 25% or 35% probability of failure. There is a lot of judgment

supporting this general conclusion, and the numerical values (5% and 25%-35%) are not

particularly robust. The reasoning that supports this is that at the very low-end tail on the

fragility curve, the failure modes tend to be highly idiosyncratic and not similar from one

seemingly identical item to the next one, so correlations/dependencies are not likely to play

much of a role. At the high end of the fragility curve, two (or several) items will be failing

anyway, correlated or not, so the numerical results of the analysis will not differ much,

whether correlated or not.

o Seismic experience data: a broad consensus emerged that these data are not particularly

useful for this project’s purposes except in a few targeted areas. This is because the

experience data do not include many data (either failures or successes) at the higher

earthquake levels that are of most interest in the SPRAs. Another reason is that the few

data that are available are typically very difficult to interpret.

o Seismic qualification tests: There is an extensive data base of qualification tests, and the

Workshop discussion examined the usefulness of this category of data. The broad

consensus was that there is rather little in the way of data about correlations among failures

in this literature, because of the way the tests were conducted and documented, including

the fact that much of the testing did not test an item up to shaking levels leading to failure,

and that often only a single item was tested. Hence, except for some very narrowly

focused test runs on a few subcomponents, there is little to be gained from examining this

data set in depth.

The second project Workshop was held in November 2012. Six invited experts, some of whom 

were also participants in the first Workshop, were asked to provide their expert judgments about 

the best way to analyze correlations or dependencies for SPRA. At this Workshop, some 

specific questions were posed to the invited experts, which then resulted in a discussion of each 

followed by an attempt to ask each expert for his judgment or interpretation of the evidence. As 

discussed below, the experts were asked for their individual and then their collective judgments 

or interpretations about what they believed to be the dominant issues affecting the correlation or 

dependency between two SSCs or among more than two SSCs. The idea at this Workshop 
xix

was to assure that, for each “problem,” the experts had enough time for discussion that they 

could agree on the available relevant evidence. Each was then asked for his own recommended 

approach, and this was followed by group discussion, leading to individual judgments that the 

other experts might or might not agree with. The approach used for each SSC category was to 

discuss the “split fraction,” a number between 0 and 1. As it turned out, there was broad 

agreement that the “split fraction” approach was not necessarily the best way to express the 

experts’ judgments about the correlations among SSCs in any given SSC category. Instead, 

the group settled on what it considered a better approach, the so-called “separation of 

independent and common variables” method.

The “separation of independent and common variables” methodology, also known as the 

“Reed-McCann” methodology

Reed et al.. describe a procedure to estimate dependency between component failures by 

searching for common sources of variability in the response and strength calculations. The 

fragility analysis method uses factors of safety to derive the median fragilities and related 

logarithmic standard deviations (β values*

), which are separately characterized in terms of 

epistemic uncertainty (βU) and randomness (βR). As an example, the dependency in the 

structural parameters can be quantified by examining the process in which the individual factors 

of safety in a fragility assessment are developed. For example, two components in a building 

are dependent on each other and on the building through the building response factors (i.e., 

soil-structure interaction, spectral shape, frequency, damping and mode shape). Thus, the 

corresponding epistemic uncertainty and randomness β values for each of these factors will be 

the same for both components if they are perfectly dependent. One exception may be the β 

values for the building modeling factors (i.e., frequency, damping, and mode shape), which are 

a subset of the building response factors and which could be different if the components are 

located in different parts of the building where support motion comes from different dynamic

building modes.

The seismic fragility of a SSC is typically expressed in terms of a lognormal seismic fragility 

function described by its median value, βU) and βR. With this approach, the SSC fragility 

consists of a family of lognormal probability distribution functions each one corresponding to a 

specific confidence level. Each one of these curves has the same logarithmic standard 

deviation βR and a median value that depends on the epistemic βU and the confidence level. 

The procedure for developing the system fragilities consists of two stages that sequentially 

explore the common sources of variability in the epistemic uncertainties (affect the median of 

the curve for each confidence level) and randomness in the response and strength calculations. 

The analyst’s goal is to develop the fragility curves for the joint failure of components (cut sets) 

based on what are seen to be common variabilities and independent variabilities among these 

components. The first stage of the approach derives a new set of median values for the 

dependent SSCs that involves redefining a reduced epistemic uncertainty, βU′, using the 

following expression:

βU' = (βU 2

 -∑ βU*2)

1/2

* The notation involving β (beta) is the common way to express uncertainties and variabilities in the

analysis of seismic fragilities in seismic PRA. The details are explained in Reed and Kennedy, 1994.
xx 

In this equation, the βU* is a common epistemic logarithmic standard deviation which exists 

between the component under consideration and other components. Several βU* values are 

generally required to represent different groups of correlation. For example, if components 1, 2 

and 3 have a common building response βU* value (i.e., because they are in the same building) 

and components 1 and 4 have a common βU* value because of capacity (e.g., they are both the 

same type pumps); then, by using the above equation, the calculation of βU' for component 1 will 

require that two values of βU*2 be subtracted from βU2

. After the sets of median capacity values 

are obtained using the reduced βU' values for the various components, additional modifications 

are made in a second step to account for the effects of dependency. 

The second stage addresses the random logarithmic standard deviations, βR*, common to 

components. In this stage, for each set of correlated median capacity values and for a given 

accident sequence, a single system fragility curve is calculated which reflects the dependency in 

the capacity values conditional on known correlated median values. Obtaining the fragility of an 

accident sequence (typically a cutset) consists of calculating the fragility conditional on the given 

value of the common dependent variable and then integrating this fragility over the probability 

distribution of the common variable. Each variable has a reduced randomness β value and the 

common variable has the common logarithmic standard deviation βR*. This is generally a 

multiple integration over the common variables; such integration could become highly 

intractable when higher order integrations (i.e., four or more) are to be evaluated. The project 

team proposes using statistical simulation and, specifically, a Latin Hypercube Sampling 

approach, to calculate this integration for these cases. 

In the above analysis, the dependencies between groups of components are treated as pairwise dependence only. However, it is feasible that dependencies exist among multiple 

components (e.g., 3, 4 and more). During the review process, Dr. Mohamed Talaat of SGH 

proposed a generalized methodology for treating such dependencies among multiple 

components. It is noted that this generalized methodology requires the fragility analyst to 

identify the common variables and assess their randomness and epistemic uncertainty 

variabilities among groups of components.

This identification and assignment of common variables depends on several aspects: 

component type, failure mode, plant-specific analysis and design, as-built conditions etc. There 

are no rules or empirical data to use to assign the fractions of dependent variabilities. Fragility 

analysts did not focus on the question of partial dependence in the past (the need rarely arose); 

we wish to note here that the methodology of separating the common variables is evolving and 

needs to be vetted with real applications during the next phase of this research.

Examples of typical cut sets

The proposed method has been applied to several component combinations that are 

encountered in the SPRA; two, three and four order cut sets with varying degrees of 

dependency between component failures. As an example, Table ES-1 below shows the mean 

annual frequency for three component failures for different configurations. The component 

fragilities (expressed in terms of median acceleration capacities and logarithmic standard 

deviations βR and βU) and the seismic hazard curves at the site were selected from 

representative seismic PRAs.
xxi

Cases 1, 2, and 3 show clearly the effect of using the new proposed method. When the 

components are different and are located on different floors (Case 4), the impact of dependency 

is minimal. The separation of variables approach gives a mean annual frequency value very 

close to that obtained assuming the components are fully independent. There is a minor 

difference that is attributed to the numerical integration procedure used. For the union of 

components (Case 5), the theoretical upper bound on the frequency is obtained when the 

components are fully independent. The assumption of full dependency provides the lower 

bound on the frequency. The separation of variables approach provides the frequency value in 

between these bounds. 

 It is seen that the proposed method of treating the partial dependency produces more refined 

cut set frequencies for all the cases, meaning that the frequency estimates are a clear 

improvement over the approach using the thumb rules discussed above and described in more 

detail in the main text, even though judgment is still necessary in applying the proposed new 

method.

Table ES- 1 Mean Annual Frequency for Three Component Failures for Different 

Configurations

(This table is identical to Table 8-1.)

Case Description

Zero 

Dependency

Separation of 

Independent 

and Common 

Variables 

Method

100% 

Dependency

Case 1

Identical 

Components 

located side by 

side 1.02 E-6 1.15 E-6 4.16 E-6

Case 2

Identical 

Components on 

Different Floors 6.14 E-7 6.65 E-7 2.12 E-6

Case 3

Different 

Components 

located side-by 

side 3.56 E-7 5.32 E-7 7.22 E-7

Case 4

Different 

components on 

different floors 2.42 E-7 2.27 E-7 5.41 E-7

Case 5

Union of 

Components 7.79 E-6 6.49 E-6 4.34 E-6
xxii

Suggested procedure

The project team recommends adopting the “separation of independent and common variables” 

methodology (also referred to as the Reed-McCann methodology) for treating the dependency 

between component failures. It requires the fragility analyst to develop the fragility curves for 

the joint failure of components (cut sets) based on what are seen to be common variabilities and 

independent variabilities among these components. The fragility analyst is well equipped to 

make this judgment because he/she has an intimate knowledge (acquired through the review of 

design documents and from the plant walkdown) of how the components are designed, qualified 

and installed. Using this method the joint failure fragility of the cut set is derived. In the format 

of seismic PRA, this joint failure fragility is presented in terms of a family of fragility curves with 

associated subjective probabilities. The mean fragility curve can be convolved with the mean 

seismic hazard curve to obtain a point estimate of cut set frequency. The distribution reflecting 

the uncertainty in this frequency can be obtained by convolving the family of fragility curves with 

the family of seismic hazard curves. The PRA analyst can use the fragilities of cut sets directly 

in the quantification of accident sequences.

It is envisioned that the methodology to treat the dependency between component failures in a 

SPRA will usually be used in an iterative fashion as follows:

Phase 1 would be a traditional SPRA study that identifies the significant accident sequences 

and cut sets, using an analysis that includes today’s usual assumptions on dependency (i.e., 

“one fails, all fail” for identical redundant components that are co-located, and total 

independence for the rest of the components). This is followed in Phase 2 by a determination 

by the PRA team’s systems analyst of which (if any) of the accident sequences would be 

different, and by how much, depending on the sensitivity of the results to the dependency 

assumption. (Specifically, the analyst would need to treat the identical redundant components 

located next to each other as independent for this sensitivity study, and to make whatever other 

sensitivity assumptions are deemed important to illuminate the issues.) The results would be 

communicated to the fragility analyst(s) within the PRA team.

Phase 3 is undertaken by the fragility analyst, working with the failure modes of interest and the 

success criteria at issue (e.g., 1 out of 2, 1 out of 4, 2 out of 3, 2 out of 4 etc.), and using the 

methodology herein to do a “better job” on those few SSC dependencies where it “matters.”

This would lead to an iteration in which the SPRA systems analyst team re-quantifies the 

analysis, and then determines anew which accident sequences and cut sets are important (and 

why.) Whether this leads to still another iteration by the fragility analysis team will depend on 

the results and/or on the application of those results.

Recommendation for future work

The purpose of this study has been to assess whether an improved methodology for 

incorporation of correlation/dependency could be recommended for future SPRA applications. 

A new and more refined and insightful approach to incorporate correlation/dependency has 

indeed been recommended as a result of this study. To implement this new approach requires 

the participation of both the SPRA fragility analysts and the SPRA plant logic 

model/quantification analysts. 

Some simple scenarios have been examined as a part of this study. However, to understand 

the actual challenges with the implementation on a full SPRA as well as to ascertain the 
xxiii 

cost/benefit of the new approach, follow-on studies are warranted. The most important followon work is that a few trial applications be undertaken of the new methodology described in this 

report. Specifically, it is necessary that the method be used in a few real ongoing seismic PRA 

studies. 

The U.S. nuclear industry is currently developing new SPRAs in response to the NRC’s postFukushima Near Term Task Force 2.1 seismic recommendation. As such, state-of-the-art 

SPRAs are being developed for a number of U.S. NPPs that could serve as potential sensitivity 

studies for the proposed new approach. The objectives of these trial applications would be:

• First, to determine how readily the methodology can be understood and adopted by the

most experienced SPRA practitioners;

• Second, to identify whether there is a need for further methodology guidance both for the

most experienced practitioners and also to assist those who would be new to these

methods, and

• Third, to identify the cost/benefit inherent in this new approach so as to guide the industry

and the NRC on the benefits of incorporation of this new method.

In addition to these trial applications, we recommend that consideration be given to forming a 

peer review panel representing both the NRC and the utility industry to provide comments and 

suggestions on this approach; to provide recommendations for new research that could assist in 

refining specific aspects of how correlation/dependency is analyzed (e.g., increased use of 

testing and experience data in the applications); and to provide peer review for the pilot 

applications.

xxv 

ABBREVIATIONS AND ACRONYMS

AM accident management

CDF core damage frequency

DOE U.S. Department of Energy

DPD discrete probability distribution

EPRI Electric Power Research Institute

ESW emergency service water

GMRS ground motion response spectrum

HCLPF high confidence of low probability of failure capacity

HVAC heating, ventilation, and air conditioning

JAERI Japan Atomic Energy Research Institute

LBNL Lawrence Berkeley National Laboratory

LHS Latin hypercube sampling

LTSP Long Term Seismic Program

LWR light water reactor

MCC motor control center

MCS Monte Carlo simulation

NPP nuclear power plant

NRC U.S. Nuclear Regulatory Commission

PGA (or pga) peak ground acceleration

PRA probabilistic risk assessment

PWR pressurized water reactor

RG NRC Regulatory Guide

RHR residual heat removal

SF split fraction

SPRA seismic probabilistic risk assessment

SQUG Seismic Qualification Utility Group

SSC structure, system, or component

SSI soil-structure interaction

SSMRP Seismic Safety Margins Research Program

ZPA zero period acceleration

xxvii 

ACKNOWLEDGMENTS

The authors wish to acknowledge the support of Annie Kammerer, Richard F. Rivera-Lugo, and

Jose Pires of the US Nuclear Regulatory Commission’s Office of Nuclear Regulatory Research,

who served as the technical contacts on the NRC staff. We also wish to acknowledge the very

valuable technical input that the project team received from the participants in our two 

Workshops, the first in June 2011 and the second in November 2012. These participants

included:

Robert P. Campbell, consultant (Huntington Beach CA)

Nilesh C. Chokshi, US NRC (Rockville MD)

Walter Djordjevic, Stevenson & Associates (Woburn MA)

Katsumi Ebisawa, Central Research Institute of the Electric Power Industry (Japan)

Shinjiro Hidaka, Japan Nuclear Energy Safety Organization-JNES (Japan)

Rosemary Hogan, US NRC, retired (Rockville MD)

James J. Johnson, J. J. Johnson & Associates (Alamo CA)

Annie Kammerer, Annie Kammerer Consulting (Portsmouth NH, formerly of the US NRC) 

Robert P. Kennedy, RPK Structural Mechanics Consulting (Oceanside CA)

Larry Lee, Erin Engineering (Campbell CA)

Martin W. McCann, Jack Benjamin & Associates (Menlo Park CA)

Kelvin L. Merz, Simpson Gumpertz & Heger (Newport Beach CA)

Robert G. Roche-Rivera, US NRC (Rockville MD)

Robert T. Sewell, consultant (Louisville CO)

Peter Zinniker, ENSI, Swiss Federal Nuclear Safety Inspectorate (Switzerland)

In addition, the project team received very useful feedback and technical suggestions from

Mohamed Talaat of Simpson Gumpertz & Heger, which we gratefully acknowledge.

This project was supported by the U.S. Nuclear Regulatory Commission under a Federal Interag 

ency Agreement with the U.S. Department of Energy (DOE).

This manuscript has been written by authors at Lawrence Berkeley National Laboratory under

Contract No. DE-AC02-05CH11231 with DOE. The U.S. Government retains a non-exclusive,

paid-up, irrevocable, worldwide license to publish or reproduce the published form of this

manuscript, or allow others to do so, for U.S. Government purposes. While this document is

believed to contain correct information, neither the U.S. Government nor any agency thereof,

nor The Regents of the University of California, nor any of their employees, makes any 

warranty, express or implied, or assumes any legal responsibility for the accuracy,

completeness, or usefulness of any information, apparatus, product, or process disclosed, or

represents that its use would not infringe privately owned rights. Reference herein to any

specific commercial product, process, or service by its trade name, trademark, manufacturer, or

otherwise, does not necessarily constitute or imply its endorsement, recommendation, or

favoring by the United States Government or any agency thereof, or The Regents of the 

University of California. The views and opinions of authors expressed herein do not necessarily

state or reflect those of the United States Government or any agency thereof or The Regents of

the University of California. Lawrence Berkeley National Laboratory is an equal opportunity

employer.

1-1

1 INTRODUCTION

1.1 Project Scope and Scope of this Report

This report provides the results of a project carried out at the University of California’s Lawrence 

Berkeley National Laboratory, supported by the U.S. Nuclear Regulatory Commission’s Office of 

Nuclear Regulatory Research. The project is entitled “Correlation of Seismic Performance in 

Similar SSCs (Structures, Systems, and Components).” NRC designates this project with 

number N6397.

The broad aim of the project has been to provide an improved methodology for analysis of 

correlation or dependency as part of the overall methodology of seismic PRA (SPRA) for 

nuclear power plants (NPPs). In particular, the aim has been to focus on those classes of SSCs 

(structures, systems, or components) for which the way correlations or dependencies are 

analyzed in SPRA makes an important difference to the SPRA results or to the safety insights 

derived from those results. As discussed in more detail in the body of the report, the 

fundamental question is what is the joint probability of seismic-caused failure of two or more 

SSCs conditional on the occurrence of an earthquake of a given “size,” and how and why that 

joint probability may be different from the situation in which those failures are essentially 

independent.

The objectives of the project, as stated in the original proposal to the NRC, are as follows:

Today’s seismic probabilistic risk assessment (SPRA) methodology makes very broad-brush 

assumptions about how much correlation exists in the response of nuclear-power-plant SSCs 

in earthquakes. The community of SPRA analysts has for a long while believed that a 

technical basis should be developed to support a more sound approach. The first objective 

of the research project is to assess the impact that the correlation assumptions made in 

typical modern seismic PRAs have on the ultimate risk estimates (concentrating on coredamage frequency, CDF); and specifically to determine if they could lead to seriously 

incorrect insights. The second objective is to identify the data sources and analysis methods 

that could be developed to provide better correlation estimates leading to more realistic CDF 

estimates. Finally, the third objective is to recommend how those data and methods can be 

developed, so that improved correlation analysis will become a standard part of seismic 

PRAs. The result should be the technical basis for an improved methodology for seismic 

PRA in this area.

This report fulfills these objectives. Crucially, the main result or “product” is the identification 

and discussion of an improved and more refined and insightful methodology for analyzing how 

much correlation or dependency exists between the seismic-caused failures of two or more 

SSCs in NPPs. The body of this report explains this improved methodology and provides 

technical support for it. That improved methodology is described in Section 8. 

The project scope envisioned the work occurring in two major technical areas, namely work by 

SPRA systems analysts and work by SPRA fragility analysts. This was accomplished. 

Specifically, the systems-analysis work consisted at first of reviewing several existing SPRAs to 

ascertain how these studies dealt with correlations or dependencies, and also determining 

which classes of SSCs are particularly sensitive to the way correlation or dependency is 

analyzed. The fragility-analysis work consisted at first of understanding the existing formal 

methodologies for analyzing correlation, and studying the existing data base (test data and 
1-2

earthquake experience data) to ascertain whether it could be useful in supporting an advanced 

approach. The two teams worked together to determine which of several proposed new 

approaches showed the most promise in advancing the way that SPRA analysts deal with this 

issue. As noted, the final result has been the identification of an improved methodology, based 

in a major way on a method first proposed by Reed et al., (1985) that has been adapted here 

with some important modifications.

A major part of the project was running two Workshops, each of which gathered together 

several internationally known experts on correlation-dependency, who were asked to review the 

project team’s work, to advise on promising approaches, and to help the project team to 

understand several earlier studies and journal articles related to the topic. The first Workshop 

was held in June 2011 and the second one in November 2012. These Workshops, taken 

together, provided major information, insights, and review that assisted the project team

immeasurably in its work. The reports developed after each of these Workshops are found in 

Appendices A and B of this report. 

When the project began, the project team believed that major benefit could be derived from a 

careful review of existing seismic shake-table test data and earthquake experience data. The 

report explains why the original idea of relying heavily on these types of data sources was found 

not to be a fruitful approach.

1.2 The Work Reported Herein – Four Different Activities

The first activity reported herein was a review of several seismic PRAs (SPRAs) in the literature, 

to ascertain how correlations and dependencies were dealt with in each of them and how 

sensitive the bottom-line results and the safety insights were to the approaches taken. (See 

Section 4.)

The second activity reported herein was a review of the existing literature on seismic correlation 

and dependency analysis, to understand the various methods that have been used (or 

proposed) over the years by others. The most common current practice for treating correlations 

and dependencies in seismic PRA was also reviewed. (See Sections 2, 6, and 7.)

The third activity reported herein was a review of the existing data on correlations and 

dependencies (both data from testing and data from earthquake-experience) to understand 

whether it would be useful enough to support this project. (See Section 3.)

The fourth activity reported herein was the identification by the project team of a recommended 

new analysis approach for treating dependencies in seismic PRA. (See Sections 7 and 8.) This 

activity also involved reviewing several specific categories of SSCs to understand how the 

proposed new methodology might apply to each of them. (See Section 5.)

Both the third and fourth activities were substantially advanced by insights gained during the two 

Workshops discussed above. The advice and review by other experts outside of the project 

team has given the team confidence that the recommendations herein are both useful and 

practical.
1-3

1.3 Why Undertake this Project?

As noted above, the overall objective of this project is to develop an improved approach for 

analyzing correlations and dependencies in seismic PRA (SPRA). As helpful background, it is 

worth noting that in the overall field of PRA, “correlation” is a term unique to seismic PRA. It is 

not a term commonly used in internal event PRA, where the similar concept is usually dealt with 

through the idea of “common cause failures.” The fundamental question is what is the joint 

probability of two or more basic events. In the SSMRP (Ref. 1), the first study that developed a 

fully probabilistic analysis method for earthquake risk in NPPs, this joint probability was 

expressed as a multi-normal probability distribution; the parameters of this distribution are 

mean, standard deviation and correlation coefficient. When the correlation coefficient is zero, 

the two responses (or capacities) are independent. Otherwise, they are dependent. From this, 

the popular use of the term “correlation” arose. Equivalently, one could ask, “What is the 

conditional probability of the second component failing given that the first component has failed 

at a particular seismic acceleration?” In the standard internal event PRA methodology, the 

answer to this question, usually posed (as noted) in terms of a common-cause failure 

probability, is expressed as a “split fraction.” Below, the approach that has been selected as a 

result of the research in this project will be explained. First, however, a clarification of the two 

terms “correlation” and “dependency” is required.

1.4 The Terms “Correlation” and “Dependency”

In the introductory material thus far, the term “correlation” has been used to describe the central 

issue addressed in this project. Here a distinction will be noted between the term “correlation” 

and the term “dependency,” which latter term will be used frequently in the subsequent text. An 

explanation of the distinction between these two terms is important to provide here.

As noted above, the fundamental question being addressed here is what is the joint probability 

of two or more seismic caused failures, conditional on the occurrence of an earthquake of a 

given “size,” and how and why that joint probability may be different from the situation in which 

those failures are essentially independent.

If the two (or more) failures are “independent,” it means that the probability of the second (or

third etc.) failure does not depend on whether or not the first failure has occurred. If any 

dependency exists, then the two (or more) failures are not “independent” but “dependent.” In 

slightly more technical terms, if the conditional probability of the second failure is enhanced, it is 

said that the second failure “depends” on the first (or better, that the two failures “depend” on 

each other), to a greater or lesser extent. In this way of explaining the issue, the word 

“dependency” is the natural term to use.

For clarity, in the body of this report, the term “dependency” will generally be used. The use of 

the term “correlation” will generally be reserved for the discussion of the mathematical 

formulation of a multi-normal probability distribution or other similar concepts, and for the 

discussion of response correlation. However, sometimes the term “correlation“ will be used for 

simplicity to describe both terms.
1-4

1.5 History and Current Practice

The first important research work that led to the development of the methods for seismic PRA 

was the “Seismic Safety Margins Research Program” sponsored by NRC at Lawrence 

Livermore National Laboratory in the late 1970s (Cummings 1986; Wells et al. 1981). The 

SSMRP program involved many of the “leading lights” in the relevant technical areas around the 

country as collaborators and consultants. One of the major research projects within the SSMRP 

program was a detailed investigation of the extent of correlation in response and in seismic 

capacity of various types of SSCs. The SSMRP also provided the framework that demonstrated 

which data are needed and why. A mathematical formulation for the determination of response 

correlation was developed and demonstrated. While the SSMRP was successful and laid the 

foundation for seismic risk analysis, its routine application in the industry was limited because of 

the methodology’s data and computational demands. A few years later, the Diablo Canyon 

Power Plant carried out what became one of the most extensive and widely-cited SPRAs ever 

completed, the SPRA for the so-called LTSP (long term seismic program) (Pacific Gas and 

Electric Company, 1988). This Diablo Canyon work included another extensive exploration of 

seismic correlations or dependencies, although in the end the detailed correlations-dependency 

work was not used in the SPRA quantification for Diablo Canyon.

However, an important general set of insights emerged from the SSMRP and its early 

applications. The work underlying these insights, led by Michael Bohn, became the basis for 

the “standard assumptions” about correlation made ever since in almost every SPRA. Bohn, 

based on the insights from the SSMRP work, concluded that a reasonable thumb rules could be 

used in SPRA without significantly compromising the insights or integrity of the analysis (Bohn, 

1984). His thumb-rule approach was originally more complex, but after some back-and-forth 

with other practitioners Bohn proposed to assign perfect (100%) correlation or dependency to 

the seismic response and capacity of identical SSCs if they are co-located or nearly so, and 

zero correlation or dependency otherwise. It was recognized early-on (a) that the 100%-

correlation assignment is surely conservative for most situations in which it is applied, albeit 

perhaps not by much for many situations; and (b) that “zero correlation otherwise” is likely to be 

non-conservative in some situations. However, it was also generally thought that the 

differences are typically not likely to be important nor to compromise the major safety insights. 

This project is re-visiting this general conclusion.

Specifically, although this thumb-rule approach has been used over the years by most SPRA 

practitioners, including the Japanese (Watanabe et al. 2003; Ogura et al. 2006), few have really 

accepted the thumb rules without some concern. Nevertheless, absent any new evidence to 

supplement the old SSMRP findings that Bohn used, his thumb-rule fallback assumptions are 

essentially all that anybody has ever used in SPRA studies.

1.6 The Project’s Major Product: a New Methodology

As mentioned above, the major product of this project is a proposed new methodology for 

analyzing correlations or dependencies in seismic PRA. That methodology is described in 

Section 8 herein.
1-5

1.7 Summary of Project Execution 

Members of the project team have two different types of expertise, although all team members 

have been involved with the whole spectrum of SPRA methods for a few decades. Some 

members of the project team have worked mainly on the “systems” engineering” aspect of 

SPRA, while others have worked mainly on the “seismic capacity” or “seismic fragility” aspect, 

and those different areas have been the areas of concentration among the team.

1.7.1 Summary of Systems Analysis Work

Section 4 further elaborates on the work summarized here. 

The most important outcome of the “systems” work is that the project team has identified a list of 

those (few) categories of SSCs that, from an examination of several past SPRAs for large 

LWRs, make a “difference” if the approach made in the SPRA to analyzing correlations would 

be different from the “usual thumb-rule assumptions.” (See Table 2-1 and the associated 

discussion in Section 2.1.) The identification of this list of SSC categories has relied a good 

deal on the team’s experience over the years, supplemented by some study of the sensitivity 

analyses found in a few of the SPRA reports.

The outcome of this work is that the following SSC categories are judged to be those where, at 

least in many SPRAs, the approach to analyzing correlation or dependency “makes a 

difference,” meaning in the project team’s mind “makes a difference to baseline seismic CDF” or 

to the safety insights. Not every one of the SSC types in the list below appears in each SPRA 

as being an issue vis-à-vis the correlation assumption, but the SSC types in this list seem to 

appear over and over, and seem to be those where it could really make a difference if a different 

and more realistic approach to analyzing correlation or dependency were used.

1. Masonry walls

2. Electrical: MCCs (motor control centers)

3. Large tanks: condensate storage tanks or other similar tanks

4. Small tanks: diesel generator fuel oil day tanks

5. Heat exchangers: such as component cooling water heat exchangers

6. Mechanical: long shafted service-water pumps, horizontal aux feedwater pumps (motor

and turbine driven correlation)

7. Batteries and racks.

1.7.2 Summary of Seismic Capacity-Fragilities Work

Section 2 and Section 3 further elaborate on the work summarized here. The most important 

work within the capacity-fragility aspect of this project is in three areas:

a) The project team reviewed the test data base and the earthquake-experience data base,

and consulted with several other experts who have an intimate familiarity with those data

bases. (See Section 3.)

b) A Workshop was held in June 2011 at which several experts provided the project team with

input and advice about analysis methods and various data bases that might help advance

the project. (The Workshop summary is in Appendix A.)
1-6

c) The project team also examined several papers that describe different formalisms for

dealing with correlations or dependencies in SPRA, going back to the original SSMRP

reports and then forward to very recent work. (See Section 2.) Based on this review, a

white paper was written by M.K. Ravindra entitled “Selected Models to Treat Seismic

Dependency.” (This white paper is reproduced here as Appendix C.) This has proven to

be a useful focus for the team’s thinking on the issue of which formalism(s) to recommend.

1.7.3 Results of the Workshop in June 2011 

As mentioned, a project Workshop was held in June 2011 at which a few invited experts were 

asked to provide review and feedback on the project’s progress up to that time. (The Workshop 

summary is in Appendix A.) The main emphasis was on identifying possible data bases that 

might help the project team on the correlation issue. Among the Workshop’s conclusions, as 

documented in the Workshop Summary, are the following, shown in italics here. This is an 

excerpt only: 

o Based on the work so far by D. Moore and R. Budnitz, it was agreed that for some reactors,

as reflected in their Seismic PRAs, the SPRA analysis results can be quite sensitive to the

way the analyst treats correlations among the failures. For many PRAs, the baseline coredamage frequency (CDF) numbers are not very sensitive to the correlation issue, because

the CDF is dominated by a “seismic singleton,” i.e., a single failure beyond seismic-induced

loss of offsite power. However, this is not universally true, and in any event many more

insights are available from the SPRAs beyond the CDF results, and many of these insights

are sensitive to the correlation assumptions in the analysis.

o General agreement emerged that the part of the SPRA analysis where the sensitivity to the

correlation assumptions is greatest is in the region of the seismic fragility curve between

about 5% and about 25% or 35% probability of failure. In this low end of the fragility curve,

whether 2 or more failures are correlated can make an important difference, whereas at

both the very low end and the higher region of the fragility curve, there is usually less

sensitivity to the correlation assumption.

o Seismic experience data: Based in part on a presentation by G. Hardy, a broad consensus

emerged that these data are not particularly useful for this project’s purposes except in a

few targeted areas. This is because the experience data do not include many data (either

failures or successes) at the higher earthquake levels that are of most interest in the

SPRAs. Another reason is that the few data that are available are typically very difficult to

interpret. Examples of this were discussed at the Workshop and this led to the general

consensus as above.

o Seismic qualification tests: There is an extensive data base of qualification tests, and the

discussion examined the usefulness of this category of data. The broad consensus was

that there is rather little in the way of data about correlations among failures in this

literature, because of the way these tests were conducted and documented, including the

fact that much of the testing did not test an item up to shaking levels leading to failure, and

that often only a single item was tested. Hence, except for some very narrowly focused

test runs on a few subcomponents, there is little to be gained from examining this data set

in depth.
1-7

o The Workshop discussed the mathematical formalism used to analyze and quantify

correlations among failures, and agreed – in part, based on the presentation led by R.

Sewell – that the formalism is adequate and useful. The issue is not the formalism but the

data available to support it.

o There was a broad consensus that one of the major targets of this work should be the issue

of correlated seismic-induced failures of the diesel-generators. (Actually, the failures are

usually not of the generators themselves but of supporting apparatus necessary for the

diesel generators to provide their function.) This consensus would have been true even

before the recent nuclear accident at Fukushima, but in light of that accident this consensus

has been reinforced.

END OF EXCERPT QUOTED FROM THE JUNE 2011 WORKSHOP REPORT.

1.7.4 Pessimism about Major Reliance on the Existing Test or Experience Data Base 

One major conclusion from the project, which was reinforced by the Workshop in June 2011, is 

the project team’s conclusion that there is not enough useful information in any of the existing 

test data bases or earthquake-experience data bases to support by itself a different approach to 

analyzing correlation or dependency for use in SPRA. (See Section 3.)

1.7.5 The Second Workshop in November 2012

As mentioned, a second project Workshop was held in November 2012 at which six invited 

experts were asked to provide their expert judgments about the best way to analyze correlations 

or dependencies for SPRA. (The Workshop Summary is in Appendix B.)

At the second Workshop, some specific questions were posed to the 6 invited experts, which 

questions then resulted in a discussion of each followed by an attempt to ask each expert for his 

judgment or interpretation of the evidence. As discussed below, the experts were asked for 

their individual and then their collective judgments or interpretations about what they believed to 

be the dominant issues affecting the correlation or dependency between two SSCs or among 

more than two SSCs. The idea at this Workshop was to assure that, for each “problem,” the 

experts had enough time for discussion together that they could agree on the available and 

relevant evidence. Each was then asked for his own recommended approach, and this was 

followed by group discussion, leading to individual judgments that the other experts might or 

might not agree with. The approach used for each SSC category was to discuss the “split 

fraction”, a number between 0 and 1 that is discussed in more detail below in Section 8. As it 

turned out, there was broad agreement that the “split fraction” approach was not necessarily the 

best way to express the experts’ judgments about the correlations among SSCs in any given 

SSC category. Instead, the group settled on what it considered a better approach, the so-called 

“separation of independent and common variables” method that is described below (Section 8.)

A major part of the Workshop discussions themselves concentrated on the seven classes of 

SSCs that had been identified earlier. The summary of that discussion, class by class, is found 

below in Section 5.
1-8

1.8 Importance of Seismic Dependency

As stated in Section 1.4, seismic dependency can classically be defined in terms of the joint 

probability of two or more seismic caused failures, conditional on the occurrence of an 

earthquake. If there is no dependency, then the probability of the failure of two (or more) 

components is simply the product of the individual probabilities of failure. Seismic dependency 

is a function of two primary attributes, similarity in seismic capacity and similarity in seismic 

demand. Similarity in seismic capacity is a function of the dynamic characteristics (frequencies 

and mode shapes) of the component as well as the governing seismic failure modes. Similarity 

in the seismic demand is a function of the dynamic response (acceleration, velocity or 

displacement depending on the governing failure mode) at the anchor points of the components. 

With these basic tenets in mind, there are four types of situations requiring the PRA analyst to 

ponder over the potential seismic dependencies between component failures:

1. Dissimilar Components at Different Locations: The seismic responses at the mounting (or

floor) of these components may be somewhat correlated because of a single input

earthquake ground motion; or the components may be located in a single building or in

different buildings with a common foundation system. Because the components are

dissimilar, they will respond differently to the input floor motion and their failure modes will

also be different. To the extent that these facts dominate the situation, current

quantification methods treating these components as fully independent are thereby judged

to be generally appropriate.

2. Dissimilar Components in Close Proximity: The seismic responses at the mounting (or

floor) of these components are expected to be correlated because of a single earthquake

ground motion input to the building housing these components. Because the components

are dissimilar, they will respond differently to the input floor motion and their failure modes

will also be different. Even though the locations are closer than in the first case, to the

extent that the above facts dominate the situation, current quantification methods treating

these components as fully independent are thereby judged to be generally appropriate.

However, as noted above, if the components have approximately the same fundamental

frequencies and similar types of failure modes then a case might be made that partial

dependency exists.

3. Identical Components at Different Locations: The seismic responses at the mounting (or

floor) of these components may be partially correlated because of a single input earthquake

ground motion; or the components may be located in a single building or in different

buildings with a common foundation system. However, the magnitude of these (floor) input

motions could be different depending on where the different components are mounted on a

given floor in the structure. Modern finite element analyses typically show different seismic

responses for components mounted on a floor near a wall vs. components mounted in the

center of a floor slab. Because the components are identical, they will respond similarly to

the input floor motion and their failure modes could be similar. The variation in responses

can be large enough to minimize the impact of dependencies, but this will vary considerably

from case to case. Therefore, current quantification methods treating these components as

fully independent may or may not be appropriate. The analyst will need to apply judgment

to ascertain whether using the proposed new method is necessary.

4. Identical (Redundant) Components in Close Proximity: This is a common situation

requiring careful consideration of dependencies. It is typical for NPPs to have identical
1-9

electrical or mechanical equipment of different redundant safety trains mounted near each 

other; the anchorage of these equipment items is also generally similar (e.g., welding to 

embedments or use of expansion anchors to a concrete floor). Similarly, it is quite common 

for plants to have identical diesel generators (of different safety trains) and their auxiliary 

systems located in adjacent rooms of a building. In these situations, the seismic responses 

of these redundant components are expected to be highly dependent. At first glance, the 

capacities of these components could also be treated as highly dependent. The standard 

SPRA practice of treating these components as fully dependent (i.e., “one fails, all fail”) 

appears to be reasonable (and generally conservative) but may have a large impact on the 

accident sequence frequencies and on the insights of a seismic PRA. Therefore, one 

primary focus of this report is to examine ways to more realistically quantify the 

dependencies between such identical redundant and co-located components, so that more 

refined risk estimates can be obtained. A parallel and complementary focus is to identify 

places in the seismic PRA where zero dependency is now assumed but a more refined 

analysis would use partial dependency numbers where appropriate, such as for dissimilar 

components located near each other.

1.9 Expectations on the Impact of Results Arising from Using the Proposed 

 Method

Using an advanced new method will as a general matter provide the SPRA analyst with a more 

realistic estimate of the dependencies than using the current widely-used “thumb rule” for 

dependencies discussed earlier. (See Section 1.5.) However, the impact on the SPRA’s results 

and insights will clearly be more important for some situations than for others. (Another way of 

saying this last thought is that for some situations, the difference will be slight and not worth the 

effort.) 

Below, three “cases” will be differentiated to describe why there are differences in the likely 

impact of the use of the new methodology. Our three cases are: 

Case A --- apparently very highly dependent SSCs

Case B --- apparently independent SSCs 

Case C (a subset of Cases A or B) --- 3 or more SSCs 

1.9.1 Case A – Apparently Very Highly Dependent SSCs 

There are some situations for which the dependency is seemingly very high. The most obvious 

of these is when two identical SSCs (identical in every way!) are co-located within very close 

range, say within a few meters. For a situation like this, the project team’s intuition is that using 

the new analysis method described herein will not make much difference either to the SPRA’s 

bottom-line results or to the insights derived. That is, the thumb rule’s approach of assigning 

100% dependency is likely to be very close to whatever a more refined estimate might be. 

Hence, if our intuition is correct, current methods that treat these situations as fully dependent 

would be generally appropriate. However, it is important to perform several trial analyses using 

the new method to determine under which circumstances an important difference may arise, 

and why. Until then, it is best to withhold judgment. 
1-10

For situations with 3 or more identical co-located SSCs, however, the thumb rule’s approach is 

likely not to be as close to the more refined estimate from the new analysis method, as 

demonstrated in the example analyses in Section 8.3.

Of course, there is a “difference” between 100% dependency and, say, 90% dependency, which 

propagates to modest differences in an SPRA’s results and insights. However, it is the 

considered judgment of the project team that the advanced analysis method described herein is 

not able to discriminate well between these two cases (100% vs. 90%), and an analyst who 

“believes” the results at this fine a level is probably giving more credence to the precision of the 

numerical calculation than is supported by the underlying understanding. Again, only several 

trial analyses will help to determine under which circumstances an important difference may 

arise, and why.

Therefore, the following caveat is offered: Small differences of the type mentioned above may 

be genuine, but the method probably won’t be accurate enough to discriminate.

In any event, there is the more general point that differences in the numerical results of an 

SPRA should essentially never be the basis for a safety decision at the 10% or 20% level, and 

especially not when the difference at this level has arisen because of different approaches to 

our understanding of the dependencies.

1.9.2 Case B – Apparently Independent SSCs 

This case is on its face the opposite of Case A. Specifically, there are some situations for which 

the dependency is seemingly very low. The most obvious of these would be two very different 

SSCs, whether or not co-located, such as a shear wall and an electrical cabinet. The current 

thumb-rule approach assigns zero dependency to these situations, and for many of them, 

perhaps most of them, this is clearly appropriate. Hence, current quantification methods 

treating these components as fully independent are judged to be generally appropriate.

However, there are some situations for which the use of the new improved analysis method 

could make an important difference by quantifying a partial dependency. An example would be 

similar (but not identical) SSCs, for which the failure modes are also similar. (Another example 

would be two large outside water tanks with different dimensions but subject to the same 

earthquake input. One more example would be identical components located in very different 

locations, such as in different buildings on the site.) It is the considered judgment of the project 

team that in these situations, using the improved method to explore a partial dependency could 

be very much worthwhile -- that is, could provide a more reliable dependency estimate that 

could “make a difference” to the SPRA’s results and insights.

It will also clearly be necessary to build up some experience, by performing a wide variety of 

different case studies of situations like this, before the community of SPRA analysts will develop 

insights and intuition as to which circumstances (or SSC types) lead to robust partialdependency results and which ones don’t. This seems to be one of the most fruitful areas 

where the new improved method could make a difference.
1-11

1.9.3 Case C – 3 or More SSCs

In principle, the new improved method proposed herein enables the development of partial 

dependency numbers for 3 or more co-located SSCs, and also enables working out the values if 

the “success criterion” is, say, one out of 3, meaning that if only one of the 3 co-located SSCs 

were to survive the earthquake, the safety function would be performed. 

Whether the analysis of these types of situations “makes a difference” very much depends on 

the specific analysis problem. 

A specific example for which it could make a huge difference is as follows: Suppose that after a 

major earthquake, a nuclear power plant has lost offsite electric power for an extended period, 

and the station’s safety depends on successful onsite diesel-generator power. Suppose that the 

diesels cannot run without service water to cool the bearings. Suppose there are 4 identical 

service-water pumps, located side-by-side within a few meters in the same pump house, each a 

long-shaft pump (a few meters long) with the pump housing at the top and with the shaft 

extending down into a water bay well below the surface.

Suppose that the seismic capacity of the service-water pump is evaluated to be sufficiently 

weak that it is one of the two or three largest contributors to the seismic risk profile. However, 

suppose that the “success criterion” is that only one service water pump must run – that is, after 

the earthquake occurs and the plant shuts down its chain reaction successfully, and after most 

other service-water loads are shed, the survival of one pump is sufficient to assure plant safety.

Further, suppose that the plant’s seismic risk profile is dominated by the pump failure at seismic 

excitations corresponding to the 5% to 25% range on the fragility curve. (Note that this finding 

about the dominance of a specific contributor, or of the importance of a certain range on the 

fragility curve, might not be known until the analysis has reached almost its end-point, which if 

so would require an iteration in the analysis.)

Today’s thumb-rule approach assigns full (100%) dependency to the failure of all 4 service 

water pumps, meaning that a single fragility curve governs the failure in the SPRA analysis. 

The failure mode is not only assumed to be identical for all 4 pumps, but the failure is assumed 

to occur at the same point on the fragility curve for each one.

For a situation like this, it is the considered judgment of the project team that the assumption of 

full dependency everywhere on the fragility curve, for all 4 pumps, is unlikely to be correct, and 

that using the new method to explore a partial dependency could be very much worthwhile, so 

as to provide more accurate SPRA results and more robust safety insights.

As a general matter, the difference in the numerical results of the SPRA, and hence in the 

safety insights, is likely to be most sensitive to the dependency assumption (or dependency 

analysis) for situations like the one outlined just above --- where the success criterion is 

something like “one-out-of-four” or “two-out-of-four” for seemingly identical SSCs. (This set of 

issues is discussed in more detail in Section 8.) Here, today’s analyst generally assigns 

dependencies using the thumb-rule, often knowing that it would make a major difference if 

another approach were available, but not having any other analysis technique to which to turn. 

The project team believes that these situations, which often arise in SPRA analysis, are the 

most likely to benefit from the new improved method set forth in this report.

2-1

2 LITERATURE REVIEW – TREATMENT OF CORRELATIONS AND 

DEPENDENCIES IN SEISMIC PRA

2.1 Summary of Literature Review

2.1.1 Background 

Large earthquakes are major common-cause events. They affect all the components and 

systems in a reactor unit and all the reactor units at a plant site. These are different but related 

issues. In the past, PRA analysts have focused mainly on the risk of accidents emanating from 

a single reactor unit. As more units are being added at a particular site, the question of station 

(or site) risk has been raised. The 2011 accident at the Fukushima Nuclear Power Plant in 

Japan has emphasized the need for evaluating station risk of multiple reactor units. This 

literature review therefore addresses both of these two important issues. 

2.1.2 Single Unit

Most experts are of the opinion that the question of dependency between component failures 

due to earthquakes within a reactor unit is not always satisfactorily treated in the current seismic 

PRAs. Japan Atomic Energy Research Institute has been seriously looking into this for some 

time (Oikawa et al. 1998; Watanabe et al. 2003). The major dependence arises from the 

earthquake itself since it subjects all the components in the plant to the effects of vibratory 

motion. In this case, the seismic PRA treats the common cause accurately by keeping the 

seismic hazard outside and integrating the conditional probability of accident sequences given 

the occurrence of the earthquake over all possible earthquake sizes (measured, for example, by 

peak ground acceleration).

Common cause failures induced by spatial systems interactions (e.g., a masonry wall 

separating the two redundant pumps could fail, fall on the one and sever the cables/piping from 

the other) are noted in the walk-down before the system is modeled in the PRA.

For a given earthquake, are the component failures somehow correlated or dependent and how 

can the analyst quantitatively account for that correlation or dependency? There are almost no 

empirical data on the performance of multiple components subjected to the same ground 

motion; for a research study for Toshiba on the topic some twenty years ago, one of the present 

authors (Ravindra and Johnson, 1991) searched through the Earthquake Experience Database 

without much success. As discussed in Section 3, not enough has changed since that time to 

modify this finding. Therefore, the analyst needs to rely on analytical models and judgment. In 

the landmark SSMRP study (Wells, et al. 1982), the correlation between seismic responses of 

components was calculated using simulation; but the correlation between component seismic 

capacities was assigned 0 or 1 (fully independent or fully dependent). The response 

computation was feasible (if difficult) but the risk calculation was impossible 30 years ago using 

anything other than an expensive Cray computer. At that time, the seismic PRAs sponsored by 

the nuclear plants themselves were making the assumption that identical components located 

on the same floor are fully correlated. The guidance in the PRA Procedures Guide (Hickman et 

al. 1983) was to conduct sensitivity studies using assumptions of full independence and full 

dependence. One such sensitivity study for EPRI (Ravindra et al., 1984a) showed that the 

seismic core damage frequency was not very sensitive to the correlation assumption because 
2-2

there were a few low capacity "singletons" in the plant, namely single SSCs whose failure would 

lead to core damage given the inevitable earthquake-caused loss of offsite power. It should be 

pointed out that the seismic PRAs used for this study were rather simplified and conservative 

compared to today’s SPRAs. In operating plants that have gone through many seismic 

evaluations over the last 30 years, and have been modified accordingly, we would not expect to

encounter low-seismic-capacity “singletons”; hence this conclusion about the sensitivity of CDF 

to the correlation assumption may not be valid at many plants today. Also, the seismic core 

damage frequency was in the acceptable range for the plants in the Eastern US (i.e., about 25% 

of the overall CDF, slightly less than the internal fire contribution to CDF). Using the SSMRP 

results, Michael Bohn at Sandia National Laboratories developed some thumb rules for 

assigning the response correlation so that the tedious response correlation task could be 

avoided (Bohn and Lambright, 1990). These thumb rules are reproduced here in Table 2-1. 

However, the seismic risk quantification using these thumb rules still needs fast computers and 

specialized software to do the multiple integration. 

Note that the Bohn thumb rules in Table 2-1 include some situations for which the 

recommended assignment is 0.5 or 0.75. However, the common practice ever since in SPRA 

has almost always been to assign 100% to the situation of similar SSCs exposed to the same 

earthquake load (typically, SSCs located near each other), and zero everywhere else.

In the Diablo Canyon Long Term Seismic Program (Kennedy et al. 1988), detailed studies on 

component seismic dependencies were done to arrive at the following conclusions:

 Except at high frequencies (greater than about 18 Hz), responses of identical components

with the same frequencies should be treated as totally dependent, even when mounted at

different elevations in different structures located at the site,

 Responses of components with different vibrational frequencies are essentially

uncorrelated even when mounted on the same floor,

 Fragilities of components with different vibrational frequencies and mounted adjacently

should be treated as independent,

 The piping fragility should be treated such that each segment between rigid supports or

equipment is considered to be independent of the other segments,

 The fragility of conduits and cable trays is considered to be that of all the conduits and

cable trays as a whole, largely because of the natural flexibility existing in cables; that is,

individual cable trays and conduits are not considered independently. By their very nature,

large physical movements do not mean cable failure,

 The fragility of HVAC ducts is considered to represent that of all the ductwork supporting a

single safety system.

It is to be noted that piping, cable trays and conduits, and HVAC ducts are generically 

seismically rugged and the benefits or penalties from ignoring correlation or dependency are not 

severe. Using the above guidelines, the Diablo Canyon seismic PRA assumed total 

dependence for identical equipment at the site (that is, if one fails, all of the same type fail).

Correlation or dependency becomes relatively more important if the plant is well designed and 

does not have seismically low capacity “singleton” cut sets. 
2-3

The practice in the US is that the analyst’s own judgment is used for assigning correlation or 

dependency in terms of randomness and uncertainty. Since redundant equipment items are 

generally identical and often located adjacent to each other, it is difficult to defend any 

assumption other than full dependency. If they are located on different floors and mounted 

differently, they could be treated as independent. If they are located on different floors, their 

fragilities (referenced to the ground motion) may be dependent but different. The component at 

the lower floor will generally experience a smaller seismic load and hence will have a smaller 

conditional probability of failure. In this case, one could model the redundant components (with 

different fragility parameters) separately but call them dependent in the quantification 

calculation. Note that either assumption (full independence or full dependence) is extreme. If 

the components are located far apart on the same floor, they could be considered as not fully 

dependent but the extent of dependency is difficult to calculate. Dependency between 

component failures occurs because the components respond similarly in an earthquake (i.e., if 

the response of component 1 is high, the response of component 2 is also high compared to the 

medians), or they have common materials and fabrication (e.g., anchor bolts), or their fragilities 

are calculated for the same failure modes and models. If more of these are true, the SPRA 

analyst has generally been reluctant to use any other approach than assuming full dependence 

in the absence of additional data and algorithms. This can be illustrated with two examples.

i) In the first example, consider two redundant pumps (same design, manufacturer, location

and anchorage.) Are they assumed dependent, i.e., if one fails the other one will fail as

well with probability = 1.0, or can some credit be given for the second pump’s failure being

independent?

ii) As a second example, consider two systems each with two pumps, one system with

electrical pumps and the other with diesel driven pumps. Would the pumps of the different

systems be considered independent? Would they still be considered independent if the

same failure mode (such as the same type of anchorage failure) characterized all of the

failures?

The answers to these questions according to today’s practice follow. In the first example, one 

would assign full dependence in both the randomness and the uncertainty sense for the two 

redundant pumps provided the failure mode is the same in both pumps (i.e., no systeminteraction effects). Therefore, no credit is given for the second pump. In the second example, 

one would judge that the electrical pumps and the diesel-driven pumps are independent 

because their failure modes would be different. Even if they have identical anchorage and 

anchorage failure is the dominant failure mode for each, their seismic fragilities would be 

different because of differences in size, configuration etc.

The significance of dependent responses of paired components in the same building has been 

studied by Oikawa et al. (1998). They studied an example RHR system consisting of two 

completely separated trains with some of the components such as the RHR pump A in train A 

and RHR pump B in train B installed on the same floor. They treated these components as 

“paired” components. The system level fragility calculated for the “independent” case and 

“correlated responses in the same building and pair component capacity” show significant 

increase in the system failure probability for the dependent case over the independent case for 

peak acceleration of 0.5 g or less. However, the importance of this finding in terms of the 

overall core damage frequency should be evaluated considering the site-specific seismic 

hazard. The effect of convolving the fragility with the seismic hazard may reduce the 

importance of the differences between the assumption of full dependence and full 
2-4

independence. Also, note that the comparison should be between the full-dependency 

assumption for paired components (this is what the judgment of the analyst would normally be) 

and partial dependency (if it can be evaluated and justified). However, more work is needed in 

this area before it would be justified to modify the thumb rules developed over the last 25 years 

of seismic PRA practice. The body of this report constitutes this “more work.”

2.1.3 Numerical Methods for Seismic Risk Quantification Accounting for Dependency

The numerical schemes for risk quantification fall into two broad, but by no means exclusive 

categories (Ravindra and Tong, 1989). The first group, utilizing simulation techniques such as 

Latin Hypercube Sampling (LHS) and Monte Carlo Simulation (MCS), involves random sampling 

from a continuous probability density function (PDF). The second category involves the 

discretization of analytical PDFs into discrete probability distributions (DPD) and is referred to as 

the DPD method. In a discretization scheme a continuous lognormal density function is 

approximated by a finite number of {<pi, xi>} doublets. These three methods (LHS, MCS, and 

DPD) are described in the following subsections. For completeness, the existence of a fourth 

method should be mentioned. This is the Multiple Integration Method which formed the core of 

the systems analysis phase in the Seismic Safety Margins Research Program (Wells, et al.

1981). This method does not strictly belong to either of the two categories defined earlier; it 

uses probabilities of cut sets that are represented by multi-normal integrals and evaluated 

numerically using Gaussian quadrature.

Following the discussion of these four classic methods, five other methods specifically 

addressing the correlation issue will be discussed.” 

2.1.3.1 Monte Carlo Simulation (MCS) method

The MCS method (Karimi, 1988) begins with selecting a random confidence level, i.e., Q in the 

following equation for fragility 





























β

Φβ+















′ Φ=

−

R

1

U

m

(Q) A

a In

f (2-1)

where Φ-1(.) is the inverse of the standard Gaussian cumulative distribution function and the 

confidence level is Q = P[f < f’| A]. Here the terms Am, βR, and β U are the commonly used 

parameters for the analysis of fragilities, as defined and described in Reed and Kennedy, 1994.

The probability of failure f’ is evaluated at a given acceleration level a. This is done at the same 

acceleration level for all seismic components appearing in an accident sequence. Non-seismic 

components are also sampled at random in the same manner from a specified distribution on 

failure rate. Next using the Boolean expression for the particular accident sequence, the plant 

level failure probability S(A) is computed. The trial is completed by selecting at random one of 

the seismic hazard curves and evaluating the integrand [ H’(A)*S(A)], where H’(A) is the first 

derivative of cumulative distribution of seismic hazard at acceleration A. By performing several 
2-5

such trials at the same acceleration level, a probability distribution on the integrand is obtained. 

The process is repeated by marching along the acceleration axis and storing selected 

percentiles of the distribution on the integrand. Finally, the probability distribution on the 

frequency of occurrence for the accident sequence is constructed by numerical integration of 

the stored percentiles.

In the above procedure, the plant-level fragility curves are not explicitly developed. An 

alternative is to terminate a trial after the calculation of the sequence probability S(A) conditional 

on the acceleration. Multiple trials at the same acceleration lead to a distribution on sequence 

probability that may then be condensed into a DPD. The plant level fragility is constructed by 

marching along the acceleration axis. Convolution with the seismic hazard is performed later at 

a second stage, in the spirit of the DPD method. 

Dependency in uncertainty can also be incorporated using MCS. For the case of full 

dependency in uncertainty, the randomly selected value for confidence level, Q is applied 

uniformly to all components during a trial. For partial dependency, the transformation described 

for the LHS method could be performed on the confidence Q, which is treated as a standard 

normal variate.

2.1.3.2 Latin Hypercube Sampling (LHS) method

The LHS method (Iman et al. 1980) differs from MCS in that a stratified sampling algorithm is 

used to span the probability space efficiently, thereby reducing the required number of trials. 

Stratified sampling of a lognormally distributed variable may be described in three steps:

Step 1, Draw stratified random uniform samples. The interval between 0 and 1 is discretized 

into N equal intervals where N is the number of simulations. A point is sampled at random 

within each interval. The N random uniform numbers are then permuted into random order to 

form a vector {Xi}, i = 1,N.

Step 2, Transform uniform samples to standard normal samples. The uniform random numbers 

are mapped onto a standard normal distribution by treating {Xi} as standard Gaussian 

cumulative distribution functions and computing Φ-1(Xi). This step yields a vector of random 

standard normal variates, {Yi}, i = 1,N.

Step 3, Transform standard normal samples to lognormal samples. For a lognormal distribution 

defined by parameters Am and βU, this step is accomplished by the transformation {Zi} = {Am exp 

(βU Yi)}.

At the end of Step 3, one could construct a family of N fragility curves through the observation 

points {Zi} using the randomness variability parameter βR. Each curve in the family would carry 

a subjective probability of 1/N. The above three steps are repeated for each of the M 

components appearing in a Boolean expression, resulting in vectors {Z1i}, {Z2i}, ... {ZMi}. The 

Latin Hypercube samples are then constructed by assembling the vectors into a matrix of size 

(N x M). Each element of the matrix defines a weighted fragility curve and each row of the 

matrix represents one trial in the Latin Hypercube experiment.

The LHS method can handle partial correlation in uncertainty between component fragilities as 

discussed below. Correlation between M variables may be expressed in the form of a square, 

symmetric matrix [R] of size (M x M) with unit diagonal elements. If [R] is specified with non-
2-6

normal samples, conversion to a correlation matrix [R0] between standard normal variables is 

required. Der Kiureghian and Liu (1986) describe procedures for accomplishing the conversion. 

[R0] is then decomposed into lower and upper triangular matrices via Cholesky’s transformation

[R0] = [L] [LT] (2-2)

The independent standard normal samples {Y1i}, {Y2i}, .... {YMi}, obtained in step 2 for the M 

variables, are assembled into a matrix [Y] of size N x M. Correlated standard normal samples 

are then obtained by the transformation 

[Y] = [L] [Y]T (2-3)

2.1.3.3 Discrete Probability Distribution (DPD) method 

The DPD method applied to the “double lognormal” format of the component fragilities results in 

a family of fragility curves Fi. The steps are as follows. First, the probability density function 

(PDF) on the median capacity defined by Am and βU is discretized into a finite number of strips 

and a curve is passed through the mass centroid of each strip to reflect the random variability βR

associated with the median estimate. Each of the curves is weighted e.g., the first curve would 

have a subjective probability given by the area under the PDF within the first interval, and so 

forth.

Consider a component with Am = 0.63g, βR = 0.39 and βU = 0.30. Let the uncertainty in median 

be represented by five curves with weights of 0.04, 0.26, 0.40, 0.26 and 0.04, which represent 

the areas of the five strips of the discretized lognormal distribution (Figure 2-1). The discretized 

median values will correspond to the mass centroid location for these strips. The results are 

shown in the plot of the component fragility curves (Figure 2-2) with confidence levels or 

cumulative subjective probabilities. One may think of the family of curves as a set of doublets 

{<pi, Fi>}, following the terminology of Kaplan (Kaplan and Lin, 1987). An operation involving 

two components is then reduced to an operation between two sets of doublets. For instance, an 

intersection operation between two independent sets, x = {<pi, Fi >} and y = {<qj, Gj >}, yields a 

new set of doublets z defined by z = {<piqj, FiGj >}. Rules of DPD arithmetic govern these 

Boolean combinations. At the end of one operation involving two independent components, the 

product of the number of doublets in x and y gives the number of doublets in z. To prevent 

exponential escalation in storage requirements, a condensation procedure such as the one 

proposed in Kaplan and Lin (1987) is performed after each operation.

The family of sequence level fragility curves is evaluated by combining the component fragility 

curves according to the Boolean expression for the accident sequence. Assuming that each 

component has “n” fragility curves with specified probabilities, the procedure consists of 

performing the required operation (union or intersection) on two components at a time, for each 

of the n fragility curves. When the uncertainties in the median fragilities of two components are 

independent, this results in n2 fragility curves, representing the fragility of the combined event, 

which are condensed back into n curves. If the median fragility uncertainties are perfectly 

dependent, only n fragility curves result. In either case, the final n fragility curves of the 

combined event are then combined with the n curves of another component. This process is 

continued until all the component fragilities have been combined as specified by the Boolean 

expression, finally resulting in n sequence-level fragility curves.
2-7

Consider two components A and B, each with n fragility curves and respective probabilities 

which we will call pi (i= 1, ...., n) and qj (j = 1, ...., n).

For the union C = A +B, the fragility FCij(a) is given by

FCij(a) = FAi(a) + FBj (a) – F (Ai(a) * Bj(a)) (2-4)

where the subscripts i and j indicate one of the n fragility curves for the components. The 

probability pij associated with the fragility curve FCij(a) is given by piqj if the median capacities of 

A and B are independent. For perfectly dependent median capacities of A and B, pij is 0 for i ≠ j 

and is max [pi, qj] for i = j. The result of the intersection term is FAi(a) * FBj(a) when the 

randomness in the two events is independent and min [FAi(a), FBj(a)] when it is perfectly 

dependent.

For the intersection, D = A*B, of two components A and B, the fragility FDij(a) is given by

FDij(a) = F (Ai(a) * Bj(a)) (2-5)

is evaluated as described earlier. The probability pij is given by piqj if the median capacities are 

independent and by min [pi,qj] if these are perfectly dependent for i = j and 0 otherwise.

For the independent case, the n2 curves are condensed to n curves by sorting the failure 

frequencies FCij(a), at each acceleration level considered, in ascending order (Kaplan and Lin, 

1987). Starting with the smallest FCij(a), it is multiplied by its associated probability, pij. This 

product is summed with the product of the probability of the next larger FCij(a) and its associated 

pij. This is continued until the summation of the pij’s is equal to the first probability level desired 

for the composite curve. The summation of the products divided by pi leads to the condensed 

frequency of failure with probability pi. In general, the summation of pij’s will not exactly equal 

pi,. In such cases, an interpolation is performed. The procedure is continued until all of the n 

failure frequencies with associated probabilities pi (i = 1,...., n) are computed. The entire 

procedure is applied to all acceleration levels considered, finally resulting in n fragility curves.

The DPD method can handle two extreme cases of dependence between component failures, 

i.e., either zero or full dependency in randomness and uncertainty.

In order to determine the core damage frequency resulting from earthquakes the plant level 

fragilities are convoluted with the seismic hazard curves to obtain a set of doublets for the plant 

damage state frequency,

{<pij, fij>} (2-6)

where fij is the seismically induced plant damage state frequency and pij is the discrete 

probability of this frequency.

pij = qi

pj (2-7)

 f ---- (2-8) ij fi (a)

dH j

da = da

°

∞

∫
2-8

Here, Hj represents the jth hazard curve, fi the ith plant damage fragility curve; qi is the

probability associated with the ith fragility curve and pj is the probability associated with the jth

hazard curve.

The above equations state that the convolution between the seismic hazard and plant level 

fragility is carried out by selecting hazard curve j and fragility curve i; the probability assigned to 

the plant damage frequency resulting from the convolution is the product of the probabilities pj

and qi assigned to these two curves. The convolution operation given by Equation 2-8 consists 

of multiplying the occurrence frequency of an earthquake peak ground acceleration between a 

and a + da (obtained as the derivative of Hj with respect to a) with the conditional probability of 

the plant damage state, and integrating such products over the entire range of peak ground 

accelerations 0 to ∞ . In this manner, a probability distribution on the frequency of a plant 

damage state can be obtained.

Each of the n plant level fragility curves for an accident sequence is convolved with each of the 

m seismic hazard curves for the site. The convolution is expressed by the relation shown in 

Equation 2-8. Let pi (i =1, ...,n) and hk (k = 1, ....., m) be the probabilities associated with n 

plant level fragility curves and m seismic hazard curves, respectively. Then, n*m convolutions 

are performed, resulting in n*m frequencies of failure, with associated probabilities pihk. This is 

based on a realistic assumption that the uncertainty in the seismic hazard is independent of 

uncertainty in the fragility. The frequencies of failure are sorted in ascending order, and by 

summing the probabilities associated with each frequency of failure, the probability distribution 

of system failure frequency is obtained.

2.1.3.4 Multiple integration method (SSMRP Method)

The research done at the Lawrence Livermore National Laboratory under the Seismic Safety 

Margins Research Program (Cummings et al. (1986); Wells, et al. (1981)) focused on 

dependent failures induced by seismic events. Dependence arises because the responses of 

components may be dependent for a given earthquake; similarly the capacities of components 

may also be dependent. In the SSMRP program, the local responses of different components 

located at different elevations in various buildings were represented by a joint lognormal 

distribution; similarly, the capacities of these components were also represented by a joint 

lognormal distribution. Let {X} = (X1, X2, ... Xn) and {Y} = (Y1, Y2, ... Yn) denote the logarithms of 

response and capacity vectors with means μx and μy; the covariance matrices for the logarithms 

of response and capacity are denoted Cov (Xi, Xj) and Cov (Yi, Yj). The joint distributions of 

response and capacity are completely specified by these mean vectors and covariance 

matrices. In the SSMRP the mean response vector and the covariance matrix were developed 

by simulating a number of earthquakes and calculating the local responses of components for 

these earthquakes. The median and logarithmic standard deviations of capacity (fragility) for 

each component were estimated; the dependency between the capacities of like components 

was taken to be zero. The quantification of accident sequences containing these component 

failures was accomplished using the SEISIM computer code (Wells, George and Cummings, 

1981). The procedure in SEISIM is as follows:

If a cut set contains more than one component, then cut set failure is defined as all responses 

exceeding their associated capacities. 
2-9

Let Z = X - Y. Then,

 P [Failure] = P [Z1 > 0, Z2 > 0, ...., Zn > 0] (2-9)

where fZ (z1,...,zn) is the joint probability density function of Z. If Z has a multinormal density, 

this integral is

 (2-10)

where μZ = μX - μY and C is the covariance matrix of Z. The covariance is defined as follows:

For random variables A and B, the covariance is the second moment about their respective 

means μA and μB and can be calculated as

 Cov (A,B) = E [(X - μA) (Y - μB)] (2-11)

The correlation coefficient ρAB is 

 ρAB = Cov (A,B) /(σA* σB) (2-12)

where σA and σB are the standard deviations.

The probabilities of system failures and accident sequences are represented as the union of cut 

sets. Since the cut sets are not independent (there may be common components between the 

cut sets), SEISIM calculates at different stages of its computations, the following three upper 

bounds for the probability of a union of cut sets (the j-th cut set being indicated by the symbol 

Cj).

 (2-13)

 (2-14)

1n1z dzn )z..., ,(z f dz ..., , ∫∫

∞

°

∞

°

= ...

P[Failure] = 1

(2ππ)nn/2|C|1/2 � ... � exp �− 1

2 �zz − μμzz �

′

C−1�zz − μμzz �� dzz1 ... dzznn

∞

zz

∞

zz

∏=

−

k

1j

(Cj))P(1 - 1 ,

∑=

k

1j

and P(Cj),
2-10

(2-15)

The first bound is the exact probability of a union of 

independent cut sets and is an upper bound on the 

probability of a union for associated cut sets of coherent systems (Barlow and Proschan, 1975). 

The second is an upper bound on the probability of a union. However, it does not account for 

intersections between cut sets and is therefore, not an accurate bound when cut set 

probabilities are high. The third (Hunter, 1976) is an improvement on the second because it is 

obtained by subtracting the probabilities of certain pairs of cut sets from the sum, thereby taking 

into account some interaction between the cut sets. The selection of pairs is done to achieve 

maximum reduction in the sum and still have an upper bound on the system failure probability.

The Hunter's bound is explained by the following example:

Assume Sequence = C1 + C2 + C3 + C4

Based on the results and insights obtained from SSMRP, a simplified seismic PRA methodology 

was developed and applied in the evaluation of NUREG-1150 plants (Bohn and Lambright, 

1990). Variability in response and their correlations were assigned based on the SSMRP 

results. The rules for assigning response correlation are shown in Table 2-1.†

 The fragility 

(capacity) correlation was taken to be zero between components. The correlation between any 

two component failures is computed from the following expression

(2-16)

†

 Note that although the thumb rules for response correlation that Bohn and Lambright derived (see Table 2-1) 

provide for assigning response correlations of 0.5 or 0.75 in some cases, the almost universal practice among 

seismic PRA practitioners has been to use only the values of 1.00 or zero (that is, only full or zero response 

correlation). 

∑ ∑ = = <

≤

4

1 j

4

2 j

 P (Ci Cj)

j i

 max P (Sequence) P (Cj) - 

 P (C C )}

- max {P (C C ), P (C C ),

4 1

4 3 4 2

j =1

P (Cj) - P (C C ) - max {P (C3 C2 ), P (C3 C1 )}

4

≤∑ 2 1

Cj) P(Ci 

j i

 max - P(Cj)

k

1 j

k

2, j

∑ ∑ = = <

21 2

2

2

2

2

1

2

1

21

21 2

2

2

2

2

1

2

1

 

 FF

FRFR

FF

RR

FRFR

ρ

ββββ

ββ

ρ

ββββ

ββ

ρ

+ +

+

+ + = R2R1

12

 
2-11

in which

ρ12 = correlation coefficient between the failures of components 1 and 2

βR1, βR2 = standard deviations of the logarithms of the responses of 

 components 1 and 2

βF1, βF2 = standard deviations of the logarithms of the fragilities (capacities) 

 of components 1 and 2

ρR1R2 = = correlation coefficient between the responses of components 1 

 and 2

ρF1F2 = correlation coefficient between the fragilities (capacities) of 

 components 1 and 2

It is to be noted that the correlation between component failures is a function of the logarithmic 

standard deviations of responses and fragilities (capacities).

When only two unlike basic events are correlated in a cut set, the joint probabilities may be 

computed directly by the use of tables and formulas compiled by the National Bureau of 

Standards (NBS, 1959).

In the Peach Bottom seismic PRA, it was found that the only significant dependency between 

different components was for the 4 kV busses and the 125 volt busses. A number of identical 

components in the same location, however, were dependent; these are 4 kV buses, 125 volt 

buses, diesel generators and ESW motor driven pumps.

The significance of dependency was studied through sensitivity studies (Ravindra et al. 1984a, 

1984b). The assumption of either perfect dependence or independence did not have a major 

impact on the core damage frequency estimates of a number of plants examined because it was 

found that the final Boolean equations for core damage almost always consisted of singleton cut 

sets and among these cut sets, there were only a few components which had much smaller 

capacities compared to other components. Also, the large uncertainty and the shallow slope of 

the seismic hazard curves dominated the uncertainty in the core damage frequency. As was 

mentioned above in Section 2.1.2, it should be pointed out that the seismic PRAs used for this 

study were rather simplified and conservative compared to today’s SPRAs. In operating plants 

that have gone through many seismic evaluations over the last 30 years, and have been 

modified accordingly, we would not expect to encounter low-seismic-capacity “singletons”; 

hence this conclusion about the sensitivity of CDF to the correlation assumption may not be 

valid at many plants today. The current research project addresses this issue. 

2.1.3.5 Mankamo model

When identical components are located on the same floor slab, the calculation of their 

correlated failure probability can be performed in simple fashion as indicated by Mankamo 

(1977). This allows consideration of up to four identical components having arbitrary failure 

correlation coefficients. The model is explained in the following:
2-12

The bounds on joint failure probability of two events A and B are given by

P[A]. P[B] < P[AB] < min {P[A], P[B]}

Since these bounds could be very large, the geometric mean of the bounds is frequently used 

as a reasonable approximation:

P[AB] = (P[A]. P[B]. min{P[A], P[B]})1/2

In the case of two identical items, P =P[A] =P[B], this reduces to 

P[AB] = P1.5

This approximation was used to estimate the seismic risk in the Reactor Safety Study (NRC, 

1975).

The power 1 would represent the case of totally correlated failures whereas the power 2 would 

represent the totally uncorrelated failures. Mankamo has derived an expression of probability of 

failure of multiple redundant components in terms of a single failure probability. Table 2-2 from 

the Mankamo paper shows the power nk as a function of P1 (i.e., probability of failure of 

Component 1) and loading roughness ρ (i.e., the ratio of coefficient of variation of load to that of 

resistance). For large values of ρ, nk approaches 1, which means that the failures are highly 

dependent. This is a reasonable result, as the large variation in the common load of redundant 

components, compared with the variation of structural resistance, will mean that the 

components tend to fail simultaneously. When ρ is near zero, i.e., the loading roughness is 

small, nk approaches K where K is the total number of components. This is also reasonable 

since for small variations in load variation compared with the variation in resistance, the parallel 

loaded components tend to fail quite independently of each other. The ordinate Figure 2-3 gives 

the exponent nk to which the failure probability of a single component P1 must be raised to 

obtain the correlated failure probability for joint failure of all components.

Using the Mankamo model, the sensitivity of the component failure frequency for different 

assumptions of the loading roughness factor is studied. (See Table 2-3 below.) The seismic 

fragility of an example component is expressed in terms of median ground acceleration capacity 

of 1.27g with the composite βc of 0.4; the HCLPF capacity is 0.5g. The cut sets considered are 

two components failing concurrently, three components failing concurrently and four 

components failing concurrently. A representative seismic hazard curve for Site 1 is used in the 

calculation of cut set failure frequency. Two seismic hazard curves representing two different 

sites denoted “hazard 1” and “hazard 2” are used in the calculation of cut set failure frequency. 

(See Figure 2-4.)

In Table 2-3, the cut set frequencies (per year) are shown for different assumptions: the 

components are fully correlated, fully uncorrelated and load roughness factors of 0.9 and 0.8. 

The cut set fragility is calculated for each of these assumptions and convolved with the seismic 

hazard curve for the site to obtain the cut set frequency per year. The ratio of the cut set 

frequency for a particular assumption of dependency to the cut set frequency when the 

components are assumed to be fully independent is also shown in this table. It is observed that 

the ratio of cut set frequency for the cases of fully dependent to fully independent failures could 

be as much as 8.84 for the cut set of size 4. This ratio would reduce to 4.66 for an assumed 
2-13

load roughness factor of 0.8. The obvious questions are: a) is this decrease in the cut set 

frequency (from the fully dependent case to partially dependent case) significant, and b) what is 

the proper assignment of the load roughness factor? Further, there will be many accident 

sequences containing numerous cut sets of different sizes; the ones of particular interest to the 

study form only a small subset. Therefore, the significance of assumption of dependency 

should be assessed in the overall seismic risk quantification context. 

2.1.3.6 Reed-McCann procedure 

Reed et al. (1985) describe a procedure to estimate dependency between component failures 

by searching for common sources of variability in the response and strength calculations. The 

dependency in the structural parameters can be quantified by examining the process in which 

the individual factors of safety in a fragility assessment are developed. For example, two 

components in a building are dependent on each other and on the building through the building 

response factors (i.e., SSI, spectral shape, frequency, damping and mode shape). Thus, the 

corresponding epistemic uncertainty and randomness β values for each of these factors will be 

the same for both components if they are perfectly dependent. One exception may be the β 

values for the building modeling factors (i.e., frequency, damping, and mode shape) which could 

be different if the components are located in different parts of the building where support motion 

comes from different dynamic building modes. The procedure for developing the system 

fragilities consists of two stages. In the first stage, the median capacities of all components in 

the systems are sampled using a Latin Hypercube sampling technique (Inman et al. 1980). The 

correlation between the median capacities is considered by performing the sampling in two 

steps. In the first step, the logarithmic standard deviation for uncertainty βU' is used in place of 

βU where βU' is obtained using the following expression: 

βU' = (βU 2

 -∑ βU*2)

1/2 (2-17)

In this equation, the βU* is a common logarithmic standard deviation which exists between the 

component under consideration and other components. Several βU* values are generally 

required to represent different groups of correlation. For example, if components 1, 2 and 3 

have a common building response βU* value (i.e., because they are in the same building) and 

components 1 and 4 have a common βU* value because of capacity (e.g., they both are the 

same type pumps); then, by using the above equation, the calculation of βU' for component 1 will 

require that two values of βU*2 be subtracted from βU2

. 

After the sets of median capacity values are obtained using the reduced βU' values for the 

various components, modifications are made in the second step to account for the effects of 

dependency. For each of the common βU* values, N correction factors are obtained using the 

Latin Hypercube Sampling procedure (i.e., equal probability slice and weighted random 

sampling within each slice) where the sampled distribution is lognormal with the median value of 

1.0 and logarithmic standard deviation of βU*. Then the components in each set which have the 

common dependency are scaled sequentially by the same corresponding correction factors. 

For example, if there are 10 sets and the components 1,2 and 3 have a common dependency, 

then the first correction factor scales the median values for components 1, 2, and 3 in Set 1, the

second factor scales the same component values in Set 2, etc.
2-14

This procedure is repeated for each of the common groups of dependencies. After the scaling 

operation is completed, the N sets of median values reflect the inherent dependencies which 

exist in the median values. 

In the second stage, for each set of correlated median capacity values, a single system fragility 

curve is calculated which reflects the dependency in the capacity values conditional on known 

correlated median values. The capacities of components could be dependent because they 

may have some common dependent parts. The fragility of a sequence is obtained by first 

calculating the fragility conditional on the given value of the common dependent variable and 

then integrating this fragility over the probability distribution of the common variable. Section 8 

gives further details and examples on the use of this procedure. 

2.1.3.7 Kaplan procedure 

Kaplan (1985) has also proposed a procedure for handling partial dependencies between 

component failures. The idea is to separate the common or root variables, perform the system 

fragility calculation conditional on these variables and integrate the result over the distributions 

of these variables. Since there are no illustrations of this approach that address practical 

situations, it is difficult to judge the feasibility of the procedure. 

2.1.3.8 Fleming and Mikschl Procedure 

Fleming and Mikschl (1999) proposed a conceptual approach of deriving two different fragility 

curves for components: one representing the parts of the fragility that are assessed as being 

primarily dependent which should include the seismic intensity variability and at least part of the 

amplification contribution, and one for the parts that are expected to be independent. These two 

fragility curves are denoted by the superscripts D and I, respectively. The following equation is 

used to compute the joint failure probability of both components: 

Fj{A * B}= Fj

D {A *B} +[l-FjD {A * B}]FjI {A} FjI {B} (2-18)

This thinking has led to the recent proposals to cast the seismic dependence problem in the 

format of “split fraction” as discussed below.

2.1.3.9 Pellissetti and Klapp model

Pellissetti and Klapp (2011) proposed an approach that uses the traditional Common Cause 

Failure (CCF) model for internal events employing beta factors. 

The simplest commonly used CCF model is the Beta-Factor model (Mosleh et al., 1988), in 

which the total probability of failure Q of an individual component is expressed as the sum of the 

probability of the single failure Qs and of the common cause failure Qcc , respectively defined as

Qs = (1 - β)Q (definition)

Qcc = βQ (definition)

These same equations can then be written differently as:
2-15

Q = Qs + Qcc

Q = Qs + βQ .

The beta factor is derived by equating the joint probability of failure of components in the cut set 

to the probability of cut set represented in the CCF model. It is pointed out by the authors that 

this calibrated value of “split fraction” is not equal to the correlation coefficient between the 

component failures as proposed by Klugel (2009). The thumb rules developed by M. Bohn are 

used to assign the correlation coefficients for responses of components and the capacity 

correlation of 0.9 is assumed. It is shown for cable trays and HVAC ducts in the European 

Power Reactor that the seismic CDF (i.e., simultaneous failure of cable trays in 4 out of 4 trains) 

is about 10 times less than if the cable trays were assumed to be fully correlated. The authors 

have not applied the procedure to identical components located next to each other (making the 

response correlation coefficient equal to 1).

2.1.4 The Issue of a Multi-Unit Site

If there are multiple units at a nuclear plant site, they would all be exposed to the same 

earthquake; one or more units could fail simultaneously depending on the seismic ground 

motion and its effects on the units at the site. In the Seabrook Probabilistic Safety Study (PLG 

1983), the analysts examined the station risk because two units were planned to be built at the 

site. They listed the key inter-unit factors (dependencies) that can potentially influence the 

development of an integrated risk statement:

1. The sharing of some systems and hardware between Unit 1 and Unit 2; the most important

examples are the offsite electric power system and the tunnels that supply service water

and circulating water to both units

2. The added redundancy of equipment and manpower at the station to support either unit in

the event that one unit develops a problem

3. The planned overlap of the initial stage of Unit 1 operation and the later stage of Unit 2

construction

4. The physical proximity of the two units, separated by some 500 feet, to certain external

hazards (e.g., earthquakes and external floods).

5. The potential for common cause failures of systems or components at both units due to

causes other than external hazards (e.g., design errors, maintenance errors repeated on

both units). This potential influences the likelihood of concurrent accidents on both units.

It was shown that the frequency of core damage to both units concurrently is 3.2 E-5 per stationyear whereas the CDF for one unit is 4 E-4 per station year. The ratio of these two CDF 

numbers is 0.08. But the consequence (economic, political and radiological) of two units 

suffering core damage simultaneously is definitely more serious than any one unit suffering core 

damage. Seismic events are shown to be dominant contributors to the station risk of dual units 

both suffering core damage. In a later paper, Fleming (2005) extended this analysis and posed 

important questions for PRA analysts on the subject of integrated risk assessment.
2-16

Hakata (2006) has further explored the impact of seismic events on multi-unit sites. He 

emphasizes the need for accident management tailored to seismic events. Most nuclear power 

plants have provisions for accident management. The typical accident management measures 

are Diverse Reactor Scram, Alternative Emergency Core Cooling Water Supply, 

Depressurization of Reactor Coolant System and Feed-and-Bleed, Alternative Containment 

Cooling, Containment Venting and Electrical Tie-lines between units, etc. These measures are 

usually designed for internal initiating events and utilize even non-safety non-seismicallyqualified systems or equipments in the unit, which may not function during or after large 

earthquakes. 

Accident management measures for seismic events should rely on ways that one unit can 

support another unit in carrying out vital safety functions by using seismically qualified 

equipment, such as: 

Electrical ties between units

Ties of emergency feed-water supply (i.e. CST) between units

Ties of refueling water (in RWST) between units

Ties of service water (or sea water) systems between units.

Muramatsu et al. (2007) have examined the effect of dependency of component failures on the 

likelihood of simultaneous multiple core damage at different units. They chose the twin unit 

example used by Watanabe et al. (2003); there are two 1100 MWe BWRs with Mark II

containment located at the site. The CDF of the two-unit site (defined as the frequency of core 

damage to either or both units) is calculated as 4.07 E-5 per year whereas the frequency of 

simultaneous core damage for both units is calculated as 5.51 E-6 per year with the assumption 

of no dependency between the units. When dependency between component responses is 

taken into account, the frequency of simultaneous core damage jumps by 2.3 times. This 

analysis demonstrates the benefit of reducing the probability of the simultaneous core damage 

to multi-units by cross connection of EDGs.

2.2 Differences Between Internal Events and Seismic Events

An important difference exists between a PRA for internal events and a comparable analysis for 

seismic events; if you add an identical redundant component, the internal event cut set 

probability goes down by the failure rate of the added component (if the components are fully 

independent). Hence there is much benefit in adding redundancies provided that they do not 

introduce common-cause issues. In the seismic PRA, if full dependency is assumed using the 

traditional thumb rule approach, this may not be the case – that is, the SPRA results after 

adding an additional redundant component may not be very different. 

As an example, consider two identical components with HCLPF capacity of 0.5g pga. Assume 

the composite logarithmic standard deviation of capacity (βc) is 0.4. Therefore, the median 

capacity is 1.27g pga. The seismic fragility curve is shown in Figure 2-5. If the seismic cut set 

is the joint failure of these two components, Figure 2-5 also shows the cut set fragility for the 

case of total independence between the failures. Convolution of this cut set fragility with an 

assumed hazard curve (Hazard 1 in Figure 2-4) gives the frequency of failure of this cut set as 

1.28 E-8 per year. (See Table 2-5.) Compare this value with the frequency of cut set when 

both components are totally dependent of 4.34 E-8 per year. For a second hazard curve 

(Figure 2-4), the two frequencies are 3.80 E-7 (total independence) and 7.98 E-7 (total 

dependence) per year. If there are three identical redundant components in the cut set, the cut 
2-17

set failure frequencies assuming total dependence is calculated as 7.13 E-9 and 2.51 E-7 per

year for Hazard Curves 1 and 2 respectively. Table 2-4 shows the fragilities of three cut sets

(single failure, two identical components failing simultaneously and three identical components

failing simultaneously); it can be seen that the effect of dependency has a diminishing

importance as the ground motion increases. One does not see a dramatic change (i.e., an

order of magnitude) in the cut set probability (fragility) in the seismic PRA by adding

redundancies. Of course, this conclusion should be confirmed using full-scale seismic PRAs. 

In fact, the guidance to perform sensitivity studies using zero dependency and full dependency

between component failures has been in existence since the publication of the PRA Procedures

Guide (Hickman et al., 1983). However, only a few seismic PRAs have reported the results of

such sensitivity studies.

The objective of this report is to identify the need and to recommend and explain procedures for

treating dependency between components in different accident sequences (diverse components

at different locations, and identical redundant components in close proximity). The former may

not be crucial since the fragilities of components are different; the latter may also not matter if

there are low capacity singletons; further, the impact of dependence is a function of the seismic

hazard. The procedures and any necessary quantification software should be tailored to these 

different situations. 

Table 2-1 Rules for Assigning Response Correlation ρR1R2

(from Bohn and Lambright, 1990) 

Rule # Text

1 Components on the same floor slab and sensitive to the same spectral frequency 

range (i.e., ZPA, 5-10 Hz. or 10-15 Hz) will be assigned response correlation = 1.0.

2 Components on the same floor slab sensitive to different ranges of spectral 

acceleration will be assigned response correlation = 0.5.

3 Components on different floor slabs (but in the same building) and sensitive to the 

same spectral frequency range (ZPA, 5-10 Hz or 10-15 Hz) will be assigned 

response correlation = 0.75.

4 Components on the ground surface (outside tanks, etc.) shall be treated as if they 

were on the grade floor of an adjacent building

5 "Ganged" valve configurations (either parallel or series) will have response 

correlation = 1.0.

6 All other configurations will have response correlation equal to zero.
2-18

Table 2-2 Power nK as a Function of P1 and ρRS [Pi is the Probability of Failure of 

 Component I]

ρRS P1 = 10-1 P1 = 10-3 P1 = 10-5

P2 0.1 1.88 1.85 1.84

0.2 1.78 1.73 1.71

0.5 1.49 1.42 1.40

0.8 1.25 1.19 1.18

0.9 1.16 1.12 1.10

P3 0.1 2.65 2.58 2.56

0.2 2.38 2.28 2.24

0.5 1.81 1.67 1.63

0.8 1.39 1.29 1.26

0.9 1.25 1.18 1.15

P4 0.1 3.35 3.23 3.19

0.2 2.89 2.77 2.66

0.5 2.04 1.85 1.79

0.8 1.48 1.35 1.32

0.9 1.30 1.22 1.18

Table 2-3 Sensitivity of Cut Set Frequency (per year) to Load Roughness Factor

Cut set size

Fully 

Correlated

Correlation 

Coefficient 0.9

Correlation 

Coefficient 0.8 Fully 

Uncorrelated

2 

ratio to fully 

uncorrelated 

case

4.34 E-8 

3.39

3.87 E-8 

3.02

2.97 E-8 

2.32

1.28 E-8 

1.00

3 

ratio to fully 

uncorrelated 

case

4.34 E-8 

6.09

2.42 E-8 

3.39

2.10 E-8 

2.95

7.13 E-9 

1.00

4 

ratio to fully 

uncorrelated 

case

4.34 E-8 

8.84

2.79 E-8 

6.68

2.29 E-8 

4.66

4.91 E-9 

1.00
2-19

Table 2-4 Fragilities of Cut Sets with Independent Failures

Peak Ground 

Acceleration, g

Fragility of Single 

Component

Fragility of Two 

Components 

failing 

simultaneously

Fragility of Three 

Components 

failing 

simultaneously

0.85 0.157 0.025 0.004

1.25 0.484 0.234 0.113

2.50 0.955 0.913 0.870

Table 2-5 Comparison of Failure Frequency of Two Independent Identical Components 

(Cut Set A*A) with Failure Frequency of a Single Component (A)

Hazard

Fragility

HCLPF (g)

Annual 

Frequency of 

Failure of A

Annual 

Frequency of 

Failure of A*A

Ratio of A*A 

to A

1 0.5 4.34 E-8 1.28 E-8 3.39

2 0.5 7.98 E-7 3.80 E-7 2.10

1 0.3 2.30 E-7 8.83 E-8 2.60

2 0.3 2.37 E-6 1.39 E-6 1.71

1 0.25 3.30 E-6 2.05 E-6 1.61
2-20

Figure 2-1 Discretization of Lognormal Distribution 

Figure 2-2 Uncertainty Discretization (The 5 Curves, Top to Bottom, Represent 

Confidence Levels Approximately 1.00, 0.96, 0.70, 0.30, and 0.04, 

Respectively.) 
2-21

Figure 2-3 Powers n2, n3 and n4 as a Function of the Correlation Coefficient and the 

Single Component Failure Probability P1 (from Mankamo, 1977) 

Figure 2-4 Example Hazard Curve for Two Sites 
2-22

Figure 2-5 Fragility Curves for Different Cut Sets 
3-1

3 TEST DATA BASE AND EARTHQUAKE EXPERIENCE 

 DATABASE – USEFULNESS 

3.1 Introduction and Summary

Part of the project’s scope has been to evaluate whether the existing earthquake-experience 

data base and the existing seismic shake-table test data base can be used to support a better 

approach to understanding and analyzing dependencies. 

Summary of the conclusions on this data-base topic: At the project’s outset, the project team 

believed that, for at least some important classes of SSCs, there existed enough test data and 

earthquake-experience data to provide adequate data-driven support for determining 

dependencies, if only these data were examined carefully. A review of these data and 

consultation with other experts whose familiarity with the data is extensive has led the team to 

conclude that the original belief is not correct. Rather, it has been concluded that the data are 

inadequate for the purposes of refining dependency factors for use in future SPRAs. This 

conclusion was reinforced when the project team discussed this issue with a group of outside 

experts during the first project workshop in June 2011; it was reinforced again during the 

second project Workshop in November 2012. The remainder of this Section will describe why 

this conclusion has been reached. 

3.2 Earthquake Experience Data

The nuclear industry has invested considerable resources in understanding how equipment and 

structures similar to those in nuclear power plants have fared in actual large earthquakes 

around the world. The Seismic Qualification Utility Group (SQUG, 2001) has been researching 

the effects of major earthquakes for the past 25 years. SQUG sends teams of experienced 

investigators to research the effects of strong ground motion earthquakes on equipment and 

systems important to nuclear power plants. The specific goals of these investigations include: 

• To identify damage and failures to the equipment and systems

• To conduct root cause assessments to identify the failure mode and cause of the failure

• To document failure modes that may affect the seismic experience-based methods

developed as part of the Unresolved Safety Issue A-46 program

• To document the ground motion from the earthquake at each site researched

• To document successes for equipment and systems.

As part of this correlation project, a review of the applicable earthquake experience data was 

conducted. An example of the experience data for vertical pumps is summarized in Figure 3-1 

below. The sample of data shows the successes/failures of vertical pumps as a function of the 

estimated free field peak ground acceleration. While all of these pumps are considered to be 

within the same equipment class and have similar configurations, similar operating 

mechanisms, and similar failure modes, the actual failure levels span from fairly low 

acceleration levels to much higher levels based on both differences in the seismic response at 

the pump and differences in the pump designs and failure modes. These differences make the 

use of the experience data for the purpose of analyzing dependencies challenging at best.
3-2

Figure 3-1 Vertical Pump Performance Summary from the SQUG Earthquake 

Experience Database (from EPRI, 1996) 

Most of the information is derived from earthquakes that have affected non-nuclear installations 

having mechanical and electrical equipment as well as distribution systems similar to safetyrelated components from nuclear power plants. Until very recently, there has been very little in 

the way of large-earthquake experience at nuclear power plants themselves. However, in the 

recent years, two large earthquakes in Japan have affected several nuclear power plants each. 

The plants were the Kashiwazaki-Kariwa plant with 7 units on Japan’s west coast (which 

experienced a large earthquake in 2007) and the Fukushima-Daiichi, the Fukushima-Daini and 

the Onagawa plants on Japan’s east coast with more than a dozen units among them (all of 

which experienced a large earthquake in 2011.) While these two Japanese earthquakes 

produced a very large set of “success” earthquake experience that EPRI is studying, only a very 

limited number of non-safety and no safety-related equipment items experienced seismiccaused damage. In addition, the tsunami damage at the two Fukushima nuclear plant sites 

significantly complicates investigations of seismic damage. 

Thus, most of what passes for relevant earthquake-experience information is derived from nonnuclear installations around the world that have been exposed to significant earthquake 

motions. 

Unfortunately, despite the major effort over the past few decades devoted to gathering and 

analyzing this type of information, the project team has concluded, after examining the relevant 
3-3

information, that it has only modest relevance to the problem here of understanding 

dependencies among failures. The factors that support this conclusion are the following:

o Even though teams of experts have spent lots of time in the field after major earthquakes to

gather the data and then spent significant additional time poring over the information, the

total number of failures of equipment that is similar to the classes of interest for NPPs is not

large. More to the point vis-à-vis dependencies, the number of failures of similar or

identical equipment that would have experienced the same input earthquake shaking is

smaller still.

o When multiple seismic-caused failures have occurred in similar equipment that is colocated, the equipment at issue is often not identical but merely similar, and often one or

another aspect of the configuration may be sufficiently problematic that comparisons are

difficult to support. For example, even if the items are identical, the anchorage and

supports might be quite different, or the vintages might be different for apparently similar

equipment. This limits the relevant data base further.

o As an example, suppose two identical and adjacent items of equipment have experienced

the same large earthquake. It is common that poor anchorage of one item can make it very

difficult to understand how it compares to a nearby item, even an identical item that has

adequate anchorage.

o Because responses to a large earthquake can differ considerably in different locations even

in the same building, it can be difficult to use information about identical items if they are

not located close by each other. For the purposes of understanding dependencies, this

limits the usefulness of some of the otherwise seemingly relevant experience data.

o All too often, a failure to function after a large earthquake is reported, but a detailed failure

analysis has not been reported. By the time the experts have an opportunity to evaluate

the actual situation, the original configuration has been disturbed (or replaced), making a

failure-mode comparison impossible.

o For the purposes of understanding dependency (or lack of it) among similar equipment

items, it is almost as important to record the “successes” (that is, the absence of failure to

function) as to record the failures. These successes are not always recorded, yet that is

often a key reason for the inability to understand the relevance of the experience data visà-vis dependencies.

o In non-nuclear installations (refineries, fossil-energy thermal-electric stations, factories,

smelters, etc.), there is commonly little in the way of documentation of the history of the

equipment that has experienced the strong shaking. Both the installation and operating

history and the quality-control history are relevant and only sometimes available.

o Crucially, even though these issues are problematic, important information has been

derived about the general ruggedness (or lack of it) of broad classes of equipment.

However, using the same data base to support an understanding of the dependencies

among failures of seemingly identical equipment is a far more difficult task.

Summary: Based on the above, it is concluded that the earthquake-experience seismic-failure 

data are inadequate for the purpose of understanding dependencies among failures. A short 
3-4

few-word explanation is that the data are too difficult to understand, fraught with too many kinds 

of interpretation uncertainties, and too sparse.

3.3 Seismic Test Data

The amount of testing performed over the years to understand whether various equipment items 

used in NPPs are adequately rugged under earthquake loads is enormous, and the resources 

spent to develop the information are enormous too. The reference here, of course, is to testing 

on shake-table facilities under controlled conditions. However, as will be described below, this 

information too (like the earthquake experience data) is inadequate for the purpose here. 

However, the reasons are different.

o One advantage of the test data base is that the conditions are entirely controlled: the

shaking environment is controlled and recorded, the rest of the environment (temperature,

humidity, etc.) is controlled, and the nature of the specimens, including their quality

pedigree, is well documented.

o Controlled conditions include that the response is understood and reproducible, and that

the supports (anchorage, etc.) are controlled. This allows one to focus on the seismic

capacity of the item(s) under study.

o Another advantage is that the items tested are typically exactly like those installed in the

actual nuclear plants that are the subject of the seismic PRA analysis. One usually needs

little if any in the way of extrapolation from the data-base test specimen(s) to the item(s) at

issue in the NPPs.

o These advantages are genuine, but they are counterbalanced by the considerable

disadvantages and difficulties with the test data base.

o The principal disadvantage of the test data base is that the vast majority of the tests were

qualification tests, in which an item is tested to demonstrate that it remains functional at (or

slightly above) the design input level. This is usually a long way from “damage,” which is a

good thing in terms of assuring that or plants have significant seismic margins above the

design. By contrast, very little of the data are from tests that take an item up to high

enough seismic excitations to cause failure.

o Another major limitation of the test data base is that, for those few tests-to-failure, usually

only a single item was tested, providing essentially no information about the dependency

issue.

o The ideal test protocol for the purposes of understanding dependencies would be a series

of tests of two (or more) identical items placed side-by-side on the table and shaken to

failure. (“Failure” means “failure to perform the item’s safety function,” which must be

defined carefully case-by-case.) The community of testing experts knows how to design a

series of such tests that, in principle, can provide strong support for understanding the

dependency issues at the heart of the study here. However, translating this understanding

“in principle” to a practical test program is complex, unless the test program is very

extensive (which would make it very costly.)
3-5

o Unfortunately, and this is the second major problem, no such extensive tests exist. Only a

very limited number of tests in the data base have studied two (or more) identical items

side-by-side on the same table and taken these items up to shaking levels that can cause

failure. For those few tests that do exist, the protocols are not useful enough to allow the

extraction of sufficient good-quality data for the purposes here.

o Another issue is that much of the test data base uses input spectral shapes that, while

adequate for the “qualification by test” needs of regulation, are different from those of a real

earthquake that might excite the same item in an actual plant. This can make damage

comparisons quite challenging. In some cases, even the failure modes being explored in

the qualification tests can be different from the actual failure modes that an item would

experience at the much higher damaging levels of a real earthquake.

o It is important to note that, even though these issues are problematic in terms of the

understanding of dependencies, very important information has been derived about the

ruggedness (or lack of it) of broad classes of equipment and of large numbers of specific

items, down to the model number. However, using the same data base to support an

understanding of the dependencies among failures of seemingly identical equipment is a

far more difficult task.

Summary: Based on the above, it is concluded that the shake-table test data base is largely 

inadequate for the purposes of understanding dependencies among failures. A short few-word 

explanation is that the test data are comprised mostly of qualification tests, and that for those 

few tests that take an item to failure the data are comprised mostly of testing of a single item. 

4-1

4 REVIEW OF SPRA LITERATURE CONCERNING THE IMPORTANCE 

OF DEPENDENCIES OR CORRELATIONS

4.1 Introduction

The project team performed a review of several existing seismic PRAs, selected from the team’s 

own experience and libraries. The purpose of the review was to confirm the judgment made at 

the beginning of the project that the approach to analyzing correlation or dependency can 

sometimes “make a difference” to the results and insights derived from the SPRA. All of the 

plants were LWRs. The SPRAs selected were judged to be “typical” of the practice, and 

encompass sites with low, medium, and high seismicity, as well as both older LWR designs and 

relatively newer designs.

The result of the review was not a surprise --- the earlier judgment was confirmed. Here, we will 

describe the review and the insights derived.

As noted earlier, in most modern SPRAs the default assumption for assigning correlations or 

dependencies has usually been to follow the well-known thumb rules discussed in Section 2.1 

and presented in Table 2-1. These rules are usually called the “Bohn thumb rules” as a tribute 

to the late M. Bohn, who proposed them, as discussed in Section 2.1.

As noted above, the Bohn thumb rules include some situations for which the recommended 

assignment is 0.5 or 0.75. However, the common practice ever since in SPRA has almost 

always been to assign 100% to the situation of similar SSCs exposed to the same earthquake 

load (typically, SSCs located near each other), and zero everywhere else.

Today, the methodology guidance for conducting a seismic PRA is in the ASME-ANS PRA 

Standard (ASME-ANS, 2008), the Addendum A version of which has been endorsed by the 

NRC in Regulatory Guide 1.200 (NRC, 2009.) However, the seismic PRAs reviewed here were 

completed prior to the publication of thee ASME-ANS standard. The treatment of dependencies 

and correlations in the Addendum A version is in supporting requirements SPR-B4, SPR-E4, 

and SPR E-6.

4.2 The Review

The review covered 10 SPRAs, half of which are relatively modern SPRAs done in the last 

decade or so, the others being older SPRA analyses performed 20 or more years ago. The 

baseline seismic CDF results for these PRAs varied from about 10-7/year to about 2 x 10-5/year, 

a wide range. The principal contributors to the seismic CDF also varied significantly from plant 

to plant, being highly plant-specific.

For analyzing dependencies, almost all of the SPRAs used the standard thumb rule 

assumptions. However, there was an occasional exception that was explained or justified by 

doing sensitivity studies and then arguing as to why the thumb-rule approach was not 

appropriate in the given situation.
4-2

Two of the SPRAs used a much more sophisticated approach derived from the SSMRP studies 

of the late 1970s. These were the SSMRP study’s own early SPRA for the Zion station 

(Cummings, 1986), and the Diablo Canyon SPRA (Pacific Gas and Electric, 1988). In both of 

these, a much more elaborate dependency analysis was done, and in fact the Bohn thumb rules 

were derived based on insights from the SSMRP analysis at Zion. The Diablo Canyon SPRA 

performed some very sophisticated dependency analysis based on SSMRP methods, but in the 

end did not use it, relying instead in the final quantification on the thumb rules, albeit with some 

very carefully explained exceptions. 

4.3 Insights from the Review

The most important generic insight is a confirmation that in some SPRAs the approach to 

assigning dependency/correlation “makes a difference” to the baseline seismic CDF and to the 

safety insights. The second most important insight is that a few categories of SSCs seem to 

appear over and over in the SPRAs reviewed as those for which the correlation approach 

“makes a difference.”

4.3.1 Major Systems Insights

A list of the major systems insights follows:

o For some SPRAs, the difference in seismic CDF based on how the dependency

assumption was made could be as much as slightly less than a factor of 2. More typical

was a difference of 30% to 60% in overall seismic CDF.

o For some key accident sequences, the difference could be larger, as much as factors of 2

to 4 in the frequency of that sequence.

o In some SPRAs, the dependent-failure issue is not as important because the overall

seismic CDF is dominated by an accident sequence that is itself dominated by a PRA

“singleton” (a single failure.) In these cases, how dependency/correlation is treated makes

little difference.

o For some important sequences, assuming partial rather than full dependency can reduce

CDF, although seldom by as much as a factor of 2.

o For some plants with highly redundant components having relatively lower seismic

capacities, partial dependencies can be significant in governing the “insights” as to which

SSCs are more important and why.

o In some SPRAs, the seismic failure of all cable trays (or perhaps all of one particular

model) is treated as one seismic failure, in which case a major difference in insights would

emerge if partial correlation were in fact the real situation.

o The same is true for motor control centers and also for service-water pumps and isolation

valves --- in some SPRAs, all of them (or perhaps all of them located near each other) are

treated as a single failure. If only partial dependency is true, this makes a major difference

in the PRA insights.
4-3

4.3.2 Insights Concerning SSC Types 

In the SPRAs that were reviewed, the importance of the correlation/dependency assumption for 

different types of SSCs varied significantly from one SPRA to the next. However, a few types of 

SSCs seem to appear over-and-over again among those for which the approach to analyzing 

dependency “makes more of a difference,” meaning in the project team’s view “makes a 

difference to baseline seismic CDF” or to the safety insights. The list of SSCs is below. Not all 

of those on the list below appear as “important” vis-à-vis correlation in every SPRA, but there is 

a common thread in the SPRAs, and these categories are the most common:

1. Masonry walls

2. Electrical: MCCs (motor control centers)

3. Large tanks: condensate storage tanks or other similar tanks

4. Small tanks: diesel generator fuel oil day tanks

5. Heat exchangers: such as component cooling water heat exchangers

6. Mechanical: long shafted service-water pumps, horizontal aux feedwater pumps (motor and

turbine driven correlation)

7. Batteries and racks.

This list was used during the project as the basis for specific discussions during our Workshop 

2. (See Section 5.2 and Appendix B.)

5-1

5 SPECIFIC CLASSES OF SSCS – ASSESSMENTS BY THE EXPERTS 

5.1 Background

The project team identified 7 classes of SSCs for which the approach to analyzing dependency 

can make an important difference to the results of a typical SPRA. The main objective of the 

second Workshop (see Appendix B for the Workshop summary) was a discussion during which 

the 6 invited experts were asked to provide their individual and collective assessments about 

how the proposed new analysis methodology might apply to each of the 7 classes of SSCs.

The seven classes of SSCs are:

1. Masonry walls

2. Electrical: motor control centers

3. Large tanks: condensate storage tanks or other similar tanks

4. Small tanks: diesel generator fuel oil day tanks

5. Heat exchangers, such as component cooling water heat exchangers

6. Mechanical: long shafted service-water pumps, horizontal aux feedwater pumps (motor

and turbine driven)

7. Batteries and racks

The emphasis in these Workshop discussions was on seismic capacity or fragility dependency, 

rather than on seismic response correlation, although some discussion of the latter occurred 

also.

For each of these 7 classes, the experts were asked to do the following:

1) to discuss any issues for that class of SSCs that would affect the seismic dependency

analysis methodology recommended herein;

2) to opine or provide perspectives on what the likely results would be for the dependency

analysis recommended herein, for that class of SSCs; and

3) to explore whether there was a broad consensus among the 6 experts on the above topics,

or whether any differences of view existed, and if so why; the insights gained would be

useful either way.

It turned out that the discussion of the 7 specific SSC classes has provided a strong basis for 

confidence that the new methodology for analyzing dependency shows promise of being useful. 

As is typical of such discussions, specific details and the views and experiences of the experts 

on those details helped to “flesh out” what would otherwise have been more abstract 

methodological discussions. 

The notes below are an attempt to capture the thrust of these discussions at the Workshop. 

The notes are not complete, nor could they be, but the project team believes that they should 

provide useful information and some important perspectives on the broad problem of working 

out seismic dependencies for use in SPRA. 
5-2

5.2 Workshop Observations for Various Classes of SSCs

5.2.1 Large Tanks: Condensate Storage Tanks or Other Similar Tanks

The case discussed was for two identical large tanks, adjacent to each other or nearly so. 

Typically, these tanks are located outdoors, so-called “yard tanks.”

The observations made during the discussion were as follows:

o The failure mode is the inability of the tank to retain its contents (water).

o These tanks are usually fabricated in the field. Field fabrication leads to differences in

detail for seemingly identical tanks. Among these differences are small but important

differences in out-of-roundness, which differences can have an important effect on the

seismic fragility.

o The fragility of these tanks is usually developed by analysis, supported by test and

earthquake-experience data for the failures of the anchorages.

o One usually assumes that a broken support bolt leads to failure, although this is almost

always conservative.

o One also usually assumes that important buckling, such as elephant-foot buckling, leads to

failure.

o There are typically differences (variations) in how the bolts are embedded, especially below

the grout pad, that can affect the seismic capacity.

o The tanks are most sensitive in the range 5 to 8 Hz, in which region there is not much

ground motion incoherency.

o The forces leading to failure are typically impulsive horizontal forces.

o Because of the differences from tank to tank due to field fabrication, there is not likely to be

large dependency in the seismic capacities of the seemingly similar tanks under

consideration.

o The experts opined that the “split fraction” is likely to be 0.1 to 0.3 at the lower end of the

fragility curve (say, from the HCLPF point to the median point.) [One expert disagreed,

thinking that the split fraction might be as high as 0.5 to 0.7 at the lower end.] Near the

median point, the split fraction is likely to be around 0.5. At the high end of the fragility

curve, more dependency could be expected but it doesn’t matter much to the SPRA results.

(The discussion used the term “split fraction,” but the parameter being discussed, for two

identical co-located large tanks, was actually the conditional probability of the second SSC

failing given that the first one has failed.)
5-3

5.2.2 Electrical Motor Control Centers

The case discussed was for two supposedly identical MCCs, adjacent to each other or nearly 

so. Typically, these MCCs are located in the turbine building, the auxiliary building, or another 

building that houses equipment. It was observed that in a typical SPRA analysis, there would 

be a large number of MCCs (5 or 10 might be typical), often in pairs controlling two identical 

trains of equipment. The discussion here centered on the issue of two MCCs.

The observations made during the discussion were as follows:

o The failure mode is a functional failure, often due to the failure of auxiliary contacts. Rattle

is a typical effect of the earthquake motion.

o The seismic fragility of these MCCs is usually developed based on the test data base, but

with analysis of the anchorages as a major component of the analysis. The anchorage

failures themselves rely to a major degree on data developed in special tests directed

specifically at this issue. If multiple identical or seemingly similar MCCs are being

analyzed, the SPRA fragility analyst must examine the anchorages to assure that they are

correctly installed, but also to observe whether (or not) they are identical. If they are

identical, then the dependency issue is important, while if not, the dependency is much

reduced.

o The experts opined that the failure modes of identical co-located MCCs are likely to be

highly dependent, and hence the fragilities will be also.

o For MCCs not closely co-located, it was observed that the demands will be different, and

the experts noted that this would reduce the overall dependency a good deal.

o One expert opined that the split fraction near the HCLPF point is likely to be high, around

0.7 or so, and above that higher still, namely around 0.9 near and above the median. The

other experts agreed. (As noted above in Section 5.2.1, the discussion used the term “split

fraction,” but the parameter being discussed, for two identical co-located MCCs, was

actually the conditional probability of the second SSC failing given that the first one has

failed.)

o It was observed that there is an opportunity to improve the fragility calculation itself by

digging into the data base to reduce βu by taking advantage of lower βu values for a specific

sample of similar MCCs (such as MCCs from the same manufacturer and vintage, which is

likely the case at the existing NPP plants for identical co-located MCCs.) However, this

data base has not yet been studied. Such a study could help to support a more accurate

calculation of the seismic dependencies in MCC capacity.

5.2.3 Mechanical: Long Shafted Service-Water Pumps, Horizontal Aux Feedwater 

Pumps (Motor and Turbine Driven) 

The case discussed in detail was for two long-vertical-shaft service water pumps, adjacent to 

each other or nearly so. Typically, these pumps are located in their own small building, but are 

sometimes in another building co-located with other equipment. Also, the typical configuration 

is to have 4 or even 6 such pumps adjacent to each other. It was observed that in a typical 
5-4

SPRA analysis, there would be a large number of these often in pairs servicing identical trains 

of equipment. The discussion here centered on the issue of two such pumps.

The observations made during the discussion were as follows:

o The failure mode is typically that the earthquake causes the bearings to get out of line.

This causes a functional failure. A very small amount of misalignment is typically called

“failure,” which could be conservative, but analysts cannot usually defend any other

approach.

o The opinion of the experts was that the dependency in fragility is likely to be very high for

this case, even at the low end of the fragility curve. This is due to a generally high

dependency in the failure mode. These pumps are a manufactured item with quite good

tolerances, and the word ”identical” is likely to be more applicable in these cases than in

some other categories of SSCs.

o For similar pumps not co-located, the opinion of the experts was that dependency would be

substantially reduced.

o There was no detailed discussion about horizontal-shaft pumps such as auxiliary feedwater

pumps. However, it was noted that the general considerations noted for vertical-shaft

service water pumps are likely to apply, although the former pumps are typically larger.

5.2.4 Batteries and Racks

The case discussed was for the large station battery installations, typically meaning a “battery 

rack” comprised of dozens of individual batteries ganged together electrically in series, in a 

room that contains no other equipment. The seismic failure is usually analyzed as an all-ornothing failure of the entire “rack”, not the failure of an individual battery in the rack. The issue 

of dependency under discussion was the failure of two “identical” battery racks, in nearby 

rooms. 

The observations made during the discussion were as follows:

o The failure mode is usually a structural failure of the frame holding the batteries in place,

which causes enough displacement of individual batteries that the electrical (ganged)

connection is lost.

o These batteries are of course factory-fabricated, but the installation into a ganged “rack” is

always done in the field. The experts observed that field fabrication can lead to important

differences in detail for seemingly identical installations.

o The Workshop experts observed that the extent of dependency in the failure depends on

the type of installation. For the structural failure of the frame, a very high dependency is

expected. For anchorage, high dependency is expected for cast-in-place anchorage and

for welded-to-embedment anchorage, but for expansion anchorage the dependency would

be somewhat less.

o The batteries themselves can often be quite rugged. There was a difference of view about

the extent of dependency: some of the experts opined that the dependency in the failures
5-5

of the batteries themselves should be very high, while others opined otherwise. Discussion 

did not resolve this difference of view.

o It was observed that sometimes seemingly identical battery rooms can be located a great

distance part, at opposite sides of the nuclear plant, sometimes more than 100 meters

apart where the seismic demand could be different.

o Diesel-generator batteries: The experts also briefly discussed a quite different “battery”

issue, namely the seismic ruggedness of the batteries used to start the diesel generators.

The failure mode is usually the inadequate restraint of some of these batteries. Where this

is the case, the experts noted that there is likely to be very weak if any dependency in the

failures of similar diesel-generator batteries in adjacent bays or buildings.

5.2.5 Masonry Walls

The case discussed was for two identical masonry walls located near each other. Typically, the 

walls at issue are interior walls within a larger building, used to separate areas from each other 

or used to provide support to equipment or distribution systems such as piping and cabling.

The observations made during the discussion were as follows:

o These walls are invariably constructed in the field. Field construction leads to differences in

detail among what ought otherwise to be “identical” walls. This is due to differences in the

placement of the reinforcing bar, the strength or the detailed installation of the mortar, and

the differences in support of the wall, either base support or support at the top or part-way

up.

o There are two different failure modes at issue. First is the masonry wall’s failing to carry

the load of something mounted on the wall or supported by it. The second is the failure of

the masonry wall itself, so that the wall falls on an item of equipment or the wall causes

structural damage to another structural element. It was observed by the experts that this

latter failure of the wall itself is usually modeled as a failure at about half height, with the

upper half losing its integrity and failing or falling.

o The experts opined that for identical items mounted on identical co-located masonry walls,

the failure due to loss of mounting capability is likely to be very highly dependent, even at

the low end of the fragility curve.

o However, when the failure mode is damage to an item of equipment because the masonry

wall falls on it, the experts opined that there is likely to be rather little in the way of

dependency among such failures.

5.2.6 Small Tanks: Diesel-Generator Fuel-Oil Day Tanks

The case discussed was for two identical diesel-generator fuel-oil day tanks in nearby bays, 

each supporting a different diesel generator. 

The observations made during the discussion were as follows:

o These are typically tanks manufactured in a factory and then mounted in the field.
5-6

o The experts noted that the failure mode is structural, and is well understood.

o The experts opined that the seismic fragilities of similar tanks located near each other are

likely to be very highly dependent.

o Fuel line failure: A common failure mode identified in SPRAs is the failure of the fuel line

that runs from the tank to the diesel-generator engine, due to motion of the tank. This

failure mode is likely to be only weakly dependent for two diesel generators even if colocated nearby.

5.2.7 Heat Exchangers, Such as Component Cooling Water Heat Exchangers

The case discussed was for two component cooling water heat exchangers located close to 

each other, each supporting a different train.

The observations made during the discussion were as follows:

o These are typically large horizontal tanks manufactured in a factory and then mounted in

the field, with heat-exchanger apparatus (tubes, supports, etc.) mounted inside the tanks.

o The experts noted that the failure mode is usually anchorage rather than a structural failure

of the tank. If this is the governing failure mode, and if the installation details are similar,

the dependency is likely to be very high for adjacent heat exchangers.

o The experts opined that different seismic capacities can arise from different installation

configurations, which would lead to different demands and therefore to rather small

dependency in the seismic capacity.

o This latter observation led the experts to note that if the installation details are sufficiently

different, it behooves the analyst to analyze the heat exchangers separately, because the

configurations can lead to different capacities and almost surely in that case to very low

dependency.

o The experts opined that if installation details are similar and the failure mode is the outer

tank’s structure itself, the seismic fragilities of similar heat exchangers located near each

other are likely to be very highly dependent.
6-1

6 RESPONSE CORRELATION

6.1 Introduction

The concept of correlation between component failures in seismic PRA was first introduced in 

the SSMRP program (see Section 2.1.3.4). The responses and capacities of components were 

modeled by jointly distributed lognormal probability density functions. In this model the 

correlation coefficient is a parameter that represents the degree of linear dependence between 

the component responses (or between the component capacities). The correlation coefficient 

varies between -1 and +1. The value of +1 implies the following: if the response of component A 

is high (low), the response of component B will also be high (low). The value of -1 implies that 

the high responses of component A will be associated with low responses of component B. The 

correlation coefficient of zero implies that there is no linear relationship between the responses 

of components A and B, i.e., whatever is the response of component A, that has no influence at 

all on the response of component B. Because of its origin in the SSMRP, the term “correlation” 

is popularly used in the seismic PRA literature to represent the probabilistic dependence 

between component failures.

Methodology exists for calculating the response correlation between components (i.e., 

structures, equipment and distribution systems) located on different floors and different buildings 

in the NPP. In recent years, the probabilistic seismic response analyses have been done for 

NPP structures using the Latin Hypercube Sampling procedure to develop median and 

logarithmic standard deviation of responses at different floors. The present authors are not 

aware of any examples where the correlation coefficients between responses at different floors 

have been calculated. However, the analytical method and software exist for calculating the 

response correlation. (See Section 7 below.)

Capacity correlation or dependency is different. In the literature, there are no procedures to 

calculate the dependency or correlation between capacities of two components. Also, there are 

no data to assign the partial correlation between the capacities of components. The SSMRP 

project (Wells et al. 1981) assumed the capacities as fully independent whereas JAERI 

(Watanabe et al. 2003) assumed full correlation between capacities of components in the same 

generic category.

Even if the response correlation is calculated and full correlation between like component 

capacities is assumed, there are no software programs available for quantification of the cut 

sets using the formulation of the joint probability density function (Eq. 2-7). Further, for colocated “like components”, the procedure sets the response correlation as 1.0. This negates the 

benefit of redundancy so valued in the nuclear design practice.

Response correlation between components arises because of the following:

o A single earthquake ground motion input is exciting all the buildings in the nuclear power

plant.

o The foundation medium, whether rock or soil, may be common to all the buildings.

o The layout and design of different buildings may be similar (e.g., reinforced concrete shear

walls and slabs).
6-2

Therefore, the floor responses (which provide input to the components mounted on these floors) 

at different floors and in different buildings are likely to be correlated. 

6.2 Probabilistic Seismic Response Analysis

Probabilistic seismic response analysis (Johnson et al. 1981) is used to calculate the median 

and logarithmic standard deviation of responses at different floor levels in the nuclear plant 

buildings. There may be equipment of interest to seismic PRA mounted on these floors. The 

steps in this analysis are:

Start by selecting a number (typically 30) of earthquake time histories that match the median 

and 84 percentile ground motion spectra; it could be the Ground Motion Response Spectrum 

(GMRS) as defined in NRC’s Regulatory Guide 1.208 (US NRC, 2007).

Step 1: Develop the best estimate soil-structure interaction (SSI) model

Step 2: The uncertainties in the SSI model are characterized by the logarithmic standard 

deviations of soil shear modulus, soil damping, structural damping and structural frequency. 

Using the Latin Hypercube sampling procedure, 30 values of each of these variables are 

sampled from the lognormal distributions with unit median and logarithmic standard deviation.

Step 3: These 30 values of the four variables (soil shear modulus, soil damping, structural 

damping and structural frequency) are used randomly in the calculation to obtain 30 sets of 

realizations of the SSI model that account for both variabilities and uncertainties.

Step 4: The seismic response analysis is performed using an earthquake time history and one 

realization of the SSI model to obtain the floor response spectra at different levels in the 

building(s). The analysis is repeated 30 times, each time with a different earthquake time history 

and a different realization of the SSI model.

Step 5: With the 30 floor spectra values at each level, the median and the logarithmic standard 

deviation of the response are calculated.

In the probabilistic seismic response analyses performed for nuclear power plant PRAs since 

the SSMRP, the analysts have typically terminated the analysis after obtaining the median and 

logarithmic standard deviation of responses. The SSMRP had concluded that the probabilistic 

seismic response analysis to derive the parameters of the joint probability density function of 

responses was too tenuous (because of the computer hardware limitations at that time) which 

led to the thumb rules devised by Bohn (1984). However, the computer memory and speed are 

no longer the constraints. Probabilistic seismic response analysis as described in Steps 1 

through 6 could now be efficiently performed. Further, the correlation between seismic 

responses can be calculated using Equations 2-11 and 2-12. It does however require a close 

interaction between the systems analyst and the fragility analyst. The components that are 

modeled in the seismic PRA and their floor locations should be made known to the fragility 

analyst so that he/she can develop the floor responses accordingly. Knowing the dynamic 

frequency of the components, the analyst can calculate the covariance between the component 

responses and hence the response correlations. 
7-1

7 METHODOLOGIES FOR CALCULATING THE FRAGILITY OF JOINT 

FAILURES

In this Section, the four candidate methods for deriving the dependency between component 

fragilities are described and the proposed method is selected. It is envisioned that the 

quantification of the seismic PRA is done in two phases:

Phase I: Quantification of the SPRA is done using the traditional thumb rule approach to identify 

dominant cut sets and sequences. The standard thumb-rule assumptions are used: for 

redundant and identical co-located components the assumption is “one fails, all fail” whereas for 

all other components the assumption of zero dependency is used. If use of these assumptions 

distorts the importance of certain components, then the analyst may refine the quantification in 

Phase II. 

Phase II: For those components for which a refinement is desired, the analyst will assess the 

partial dependency (conditional probability of failure) using one of the following candidate 

methods and redo the quantification of the SPRA accident sequences of interest. 

The four candidate methods are discussed next in the following 4 subsections.

7.1 Correlation Coefficient Method

The methodology for quantification follows the SSMRP method (Section 2.1.3.4). It requires the 

calculation of medians, logarithmic standard deviations and correlation coefficients for 

component responses and capacities. 

The calculation of response statistics (medians, logarithmic standard deviations and correlation 

coefficients) for components could be done using probabilistic seismic response analysis 

(Section 6).

As stated in Section 3, there are no empirical data that can be relied on to assign correlation 

coefficients for component capacities. Therefore, the fragility analyst must use judgment in that 

assignment based on certain common characteristics among the components. These could be:

o Failure Mode (functional and anchorage): One could expect that two components failing in

the same functional mode (e.g., electrical trip) could be highly dependent because these

components are fabricated to stringent factory specifications. If the anchorage is the

controlling failure mode, one could expect some variation in the capacity due to installation

practices. Again, differences could be present depending on whether the cabinets are

welded to the steel embeds or anchored to the concrete floor using expansion anchors.

o Common approaches: Dependency could also arise since the same or common

procedures or empirical equations are used to estimate capacity.

o Common material and fabrication practices could induce some dependency between

component capacities.

o How built: The extent of dependency would depend on if the components are factory built

or field constructed.
7-2

The assignment of dependency between component capacities would become crucial for 

identical redundant components that are co-located. In this case, the response correlation 

could be taken as 1.0. The analyst should identify any differences between nominally identical 

components and use judgment to assign the response correlation coefficient less than 1.0. 

The quantification of the accident sequences is done using Equations 2-10, 2-13, 2-14 and 2-

15. This procedure has not been applied in any seismic PRAs conducted since the SSMRP trial

applications on Zion and La Salle nuclear power plants, but the procedure remains valid.

Not all seismic PRAs that will be conducted in response to NTTF Recommendation 2.1 may 

perform probabilistic seismic response analysis; some of these new SPRAs may use scaling of 

existing seismic responses to the site’s new ground motion response spectrum (GMRS) (EPRI, 

2012). Therefore, this procedure of using the correlation coefficient may not be utilized for 

some existing plants.

7.2 Conditional Probability of Failure Method

In the traditional fragility analysis, the analyst identifies the critical failure mode and estimates 

the medians and betas for different components following the EPRI guidance (Reed and 

Kennedy, 1994). In the proposed approach, one is also asking the analyst to assign a 

conditional probability of component B failing given failure of A. This is a function of the seismic 

load (such as peak ground acceleration) as explained below. 

At low seismic loads, the failure of A may have been due to some flaw in the material or in 

installation; the same may not be present in B. Therefore, the analyst would assign a low 

conditional probability of failure B|A. At very high seismic loads, the load will be high enough to 

fail both A and B, calling for a high conditional probability. Therefore the conditional probability 

also follows roughly the S shape of a typical fragility curve. 

Next consider the example of a component A with median capacity of 0.7g pga and βc of 0.36; 

component B is nominally identical and has the same failure mode with the same median and 

βc. Following the above logic, the analyst assigns the conditional probability as a function of the 

ratio of pga/HCLPF. For values of this ratio less than 1.0, the conditional probability is less than 

40 percent. At a ratio of about 3.00, this conditional probability reaches 90 percent (Figure 7-1). 

. With this assigned conditional probability, the annual frequency of A and B failing 

simultaneously is calculated using the seismic hazard curve 1 as shown in Table 7-1.

7.3 Split Fraction Method

The concept of “split fraction” is one of the backbones of internal-events PRA. To explain it, 

when two components A and B fail, the likelihood that the failure of A is dependent on B’s failure 

can be expressed by a “Split Fraction,” SF such that SF is the likelihood (or probability) that the 

two failures are dependent, and (1 – SF) is the likelihood that they are independent.

We define the following quantities:

A-IND = Independent Failure Probability of A

B-IND = Independent Failure Probability of B
7-3

AB-DEP = Dependent Failure Probability of A and B

AB-FAIL = Joint probability of failure of A and B, that is, the probability that they 

 both fail. Then:

AB-FAIL = A-IND * B-IND * (1 - SF) + AB-DEP * SF

SF = Split Fraction.

As an example, suppose that the likelihood that A fails is 0.3, and the likelihood that B fails is 

also 0.3. Suppose that the split fraction SF is either 0, 0.75, or 1.0. Then:

SF = 0 AB-FAIL = 0.3 * 0.3 = 0.09

SF = 0,75 AB-FAIL = 0.3 * 0.3 * (1 - 0.75) + 0.3 * 0.75 = 0.2475.

SF = 1 AB-FAIL = 0.3 

As this reveals, if SF is zero (no dependency), AB-FAIL is 0.09, whereas if SF is unity (full 

dependency), AB-FAIL is simply 0.3.

For the case of seismic-induced failures of components or structures, the same formulation 

applies, except that each of the failures would need to be conditioned on the occurrence of an 

earthquake of a given “size.” Also, note that this formulation is quite general and does not 

depend on the two failure probabilities A-IND and B-IND being identical.

Using the fragility and hazard from Section 7.2, Table 7-2 shows the variation of cutset (A*B) 

frequency for different values of split fraction. As noted, the value of split fraction of zero means 

zero dependency whereas split fraction of 1.0 means that the components are fully dependent. 

Figure 7-2 shows the variation of conditional probability of failure as a function of peak ground 

acceleration for different split fractions. By examining this figure, the analyst should select the 

split fraction that reflects his/her judgment on the dependency, or more explicitly on the 

conditional probability of B given A.

7.4 Separation of independent and Common Variables Approach

Reed et al. (1985) describe a procedure to estimate dependency between component failures 

by searching for common sources of variability in the response and strength calculations. Here 

this approach will sometimes be called the “Reed-McCann” method after its two principal 

developers. The dependency in the structural parameters can be quantified by examining the 

process in which the individual factors of safety in a fragility assessment are developed. For 

example, the behavior in earthquakes of two components in a building are dependent on each 

other and on the building through the building response factors (i.e., SSI, spectral shape, 

frequency, damping and mode shape). Thus, the corresponding epistemic uncertainty and 

randomness β values for each of these factors will be the same for both components if they are 

perfectly dependent. One exception may be the β values for the building modeling factors (i.e., 

frequency, damping, and mode shape) which could be different if the components are located in 

different parts of the building where support motion comes from different dynamic building 

modes. 
7-4

The Reed-McCann procedure for developing the system fragilities consists of two stages. In the 

first stage, the median capacities of all components in the systems are sampled using a Latin 

Hypercube sampling technique (Inman et al. 1980). The correlation between the median 

capacities is considered by performing the sampling in two steps. In the first step, the 

logarithmic standard deviation for epistemic uncertainty βU' is used in place of βU where βU' is 

obtained using the following expression:

βU' = (βU 2

 -∑ βU*2)

1/2 (7-1)

In this equation, the βU* is a common logarithmic standard deviation which exists between the 

component under consideration and other components. Several βU* values are generally 

required to represent different groups of correlation. For example, if components 1, 2 and 3 

have a common building response βU* value (i.e., because they are in the same building) and 

components 1 and 4 have a common βU* value because of capacity (e.g., they both are the 

same type pumps); then, by using the above equation, the calculation of βU' for component 1 will 

require that two values of βU*2 be subtracted from βU2

. 

For each component the median capacity is independently sampled using the βU' value; this 

median capacity is modified by multiplying by correction factors which are also sampled from 

probability distributions with unit median and βU*.

This procedure aims at the treatment of partial dependency between component fragilities. The 

analyst should look for similarities and differences between the components that will result in 

partial dependence. Findings from the review of component design and qualification documents 

and plant walkdowns will be useful for this purpose. The analyst should carefully examine if the 

installation of components is indeed identical. Even if the components are nominally identical, 

there will be inherent variation due to fabrication, material properties, etc. Judgment is needed 

to identify which variables are common to the group of components and which are independent. 

It is expected that the term ∑βU*2 is less than βU2

. If the analyst judges that the components in 

the group are identical, assigning the ∑βU*2 as equal to βU2 may be appropriate. In this case, 

the median capacity of each component is modified by multiplying by the correction factors 

which are sampled from probability distributions with unit median and βU*. In this extreme case, 

the full dependency between the components in the uncertainty sense is assumed.

In the second stage, for each set of dependent median capacity values, a single system fragility 

curve is calculated which reflects the dependency in the capacity values conditional on known 

dependent median values. The capacities of components could be dependent because they 

may have some common variables. The fragility of a sequence is obtained by first calculating 

the fragility conditional on the given value of the common dependent variable and then 

integrating this fragility over the probability distribution of the common variable. In the following 

an example of the use of this procedure is given:

Consider the probability of failure for components 1 and 2. 

Pf1 = P (c1 < ag) (7-2)

Pf2 = P (c2 < ag) (7-3)

where ci are the component capacities and ag is the peak ground acceleration due to an 

earthquake. However, c1 and c2 can be expressed as c1x and c2x where c1 and c2 are the 
7-5

independent parts of capacity and x is the common dependent part. Now the failure 

probabilities can be expressed as follows:

Pf1 = P (c1

’ < ag/x) (7-4)

Pf2 = P (c2

’ < ag/x) (7-5)

The failure of both components, Pf (1 ∩ 2), is given by the following equation:

Pf (1 ∩ 2) = ∫ P (c1

’ < ag/x) P (c2’ < ag/x) p(x) dx (7-6)

In terms of the lognormal model for capacity, the parameters for components 1 and 2 are 

LN(Am1/x, βR1’

) and LN(Am2/x, βR2’), respectively. The distribution for x is LN(1, βR*). The values 

of Am1 and Am2 are the median capacities from the ith set of median values selected in Stage 1) 

and βR* is the portion of the randomness logarithmic standard deviation common to both 

components. βR1’ and βR2’ are obtained from the following equation:

βRi’ = (βRi2

 - ∑ βR*2)

1/2 (7-7)

It is expected that the term ∑βR*2 is less than βRi2

. As stated in the discussion of βU, the analyst 

should look for similarities and differences between the components in terms of their 

randomness. The components may be nominally identical, but slight variations in the mounting 

may lead to differences in their dynamic responses. Further, the components in the group may 

experience different input motions due to the stochastic nature of earthquake time histories. If 

the analyst concludes that the components are totally identical and respond identically to the 

seismic input, βR1’ should be treated as equal to zero. When both βR1’ and βU’ are equal to zero, 

the extreme case of full dependence between components in the group (in the randomness and 

epistemic uncertainty sense) will result.

Extrapolation to the general case of multiple dependencies is straightforward from this two 

component case. For each group of dependencies there is one level of integration. The 

reduced logarithmic standard deviation for each component is obtained by removing the 

common group β*

s using the above Equation (7-7). The corresponding median values are just 

the component median values divided by the product of the dummy variables x1, x2, ...., xN

which represent the common dependencies. Only the terms xi corresponding to the groups for 

which a component has dependencies are included in the expression for that component.

The above method will be illustrated using the following example.

Assume that there are two yard tanks (A and B) which are identical and redundant. The system 

is such that it will fail only if both of these tanks fail in the earthquake.

Let the median ground acceleration capacity of the two tanks be 0.7g with the logarithmic 

standard deviations of βR = 0.20 and βU = 0.30. Components A and B have response 

dependencies since they are both ground mounted and near each other. They also have high 

capacity dependence since they are identical and designed and installed in the same fashion. 

The common portion of the uncertainty comes from the common material, same failure mode 

and capacity calculation procedures. Assume that this βU* = 0.15. Therefore, the independent 

portion of the epistemic uncertainty is βU' = 0.26 from Equation 7-1 which is that 

βU' = (βU 2

 -∑ βU*2)

1/2 . 
7-6

Using the Latin Hypercube Sampling procedure, ten samples are obtained for A and B 

respectively from LN (0.7g, 0.26). These are randomly ordered to get pairs of median values of 

A and B. Using the dependent portion LN (1.0, 0.15), another 10 samples are generated and 

randomly ordered. The combined (correlated) median values of A and B are obtained by 

multiplying the independent and dependent samples respectively. 

Table 7-3 Shows the 10 Sets of Median Values Developed Using This Procedure.

In stage 2, one calculates the fragility curves; for each set of dependent median capacity values, 

a single system fragility curve is calculated which reflects the dependency in the capacity values 

conditional on known dependent median values. The reduced randomness logarithmic 

standard deviation is obtained using βR* = 0.15 as follows:

βRi’ = (βRi2

 - ∑ βR*2)

1/2 = (0.202

 – 0.152)

1/2 = 0.13

For sample set 1, the median values of A and B are cA’ = 1.08g and cB’ = 0.83g. 

Pf (A ∩ B) = ∫ P (cA

’ < ag/x) P (cB’ < ag/x) p(x) dx (7-8)

where P (cA

’ < ag/x) = Φ [ (ln (1.08/(ag/x))/0.13] 

P (cB ’ < ag/x) = Φ [ (ln (0.83/(ag/x))/0.13] and

X is LN(1.0, 0.15)

With these as input, the integral is calculated for a specific ag value. By varying the ag value, a 

fragility curve for the system is obtained. The process is repeated for other sample sets of 

median values in Table 7-3 to obtain the family of fragility curves (Figure 7-3). These fragility 

curves are convolved over the seismic hazard curves (used in earlier examples) to obtain the 

mean annual frequency of system (cut set) failure as 1.90 E-6.

Table 7-4 shows the comparison of results obtained using the different methods discussed here.

In the Reed and McCann procedure, the analyst must identify the common variables and their 

epistemic uncertainty and aleatory variability. In the above example of two identical tanks, the 

values of βR* = 0.15 and βU* =0.15 were used. In order to assess the sensitivity of these 

assumptions, two studies were done and the mean frequency of A and B failing jointly were 

calculated:

Sensitivity study 1: 

βR* = 0.15 and 

βU* = 0.25 Mean frequency = 2.88 E-6 /yr

Sensitivity study 2: 

βR* = 0.18 and 

βU* = 0.25 Mean frequency = 2.36 E-6/yr
7-7

7.5 Selection of Preferred Procedure

The procedure “Separation of Independent and Common Variables Approach” (Section 7.4) has 

been selected as the preferred one for the following reasons:

o The first method (Section 7.1) requires the analyst to assign the correlation coefficients for

component capacities; there are no empirical earthquake experience data or fragility test

data to guide the analyst in this assignment. Further there are no quantification software

programs that do the multiple integration of the multi-lognormal joint probability density

functions required in this method. The PRA systems analyst is typically not familiar with

this method.

o The second method (Section 7.2) requires the analyst to assign the conditional probability

of component B failing given the failure of component A. Again, there are no empirical

earthquake experience data or fragility test data to guide the analyst in this assignment.

However, the use of the conditional probability in quantification of seismic PRA is

straightforward.

o The third method (Section 7.3) requires the fragility analyst to derive the split fraction (SF).

The PRA systems analysts are very familiar with the use of SF in the quantification of

seismic PRA. As in methods 1 and 2, the fragility analyst does not have either empirical

earthquake experience data or fragility test data to use as a basis to guide in the selection

of SF. At the second workshop (November 2012), the outside experts were reluctant to

assign the SFs for the various categories of components that were discussed. (See

Section 5.)

o The project team finds the fourth method (Section 7.4) to be the most promising. It requires

the fragility analyst to develop the fragility curves for the joint failure of components (cut

sets) based on what are seen to be common variabilities and independent variabilities

among these components. The fragility analyst is well equipped to make this judgment

since he/she has an intimate knowledge (acquired through review of design documents and

plant walkdown) of how the components are designed, qualified and installed. Using this

method (Section 7.4), the joint failure fragility of the cut set is derived. In the format of

seismic PRA, this joint failure fragility is presented in terms of a family of fragility curves

with associated subjective probabilities. The mean fragility curve can be convolved with the

mean seismic hazard curve to obtain a point estimate of sequence frequency. The

probability distribution reflecting the uncertainty in this frequency can be obtained by

convolving the family of fragility curves with the family of seismic hazard curves. The PRA

analyst can use the fragilities of cut sets directly in the quantification of accident

sequences.
7-8

Figure 7-1 Conditional Probability of Failure vs. PGA/HCLPF 

Figure 7-2 Conditional Probability for Different Split Fractions 
7-9

Figure 7-3 Conditional Probability of Two Components Failing Using Separation 

 of Independent and Common Variables 

Figure 7-4 Conditional Probability of Component B Failing given Failure of A using 

Different Methods 
7-10

Table 7-1 Annual Frequency of Joint Failure of A and B

Zero Dependency 100% dependency

Assigned Conditional 

Probability B|A 

3.77 E-6 1.61 E-6 2.71 E-6 

Table 7-2 Cut Set (A*B) Frequency vs. Split Fraction

Split 

Fraction

Cut Set 

Frequency

Ratio of Cutset 

Frequency to the 

Frequency if 

SF = 1 

0.0 1.61 E-6 0.43

0.1 1.83 E-6 0.49

0.2 2.04 E-6 0.54

0.5 2.69 E-6 0.71

0.7 3.12 E-6 0.83

0.8 3.34 E-6 0.89

1.0 3.77 E-6 1.00
7-11

Table 7-3 Sample of Median Capacity Values

Sample 

Independent 

Step A

Independent 

Step B

Dependent 

Step

Combined 

Median A (g) 

Combined 

Median B (g)

1 0.83 0.64 1.30 1.08 0.83

2 0.79 0.58 0.91 0.72 0.53

3 0.66 0.30 0.99 0.65 0.30

4 0.52 0.71 1.12 0.58 0.80

5 0.73 0.93 0.94 0.69 0.87

6 0.95 0.85 1.03 0.98 0.88

7 0.59 0.56 1.18 0.70 0.66

8 1.05 1.17 0.80 0.84 0.94

9 0.35 0.69 0.82 0.29 0.57

10 0.64 0.78 1.07 0.68 0.83

Table 7-4 Mean Annual Frequency of Joint Failure of Two Identical Components A and 

B using Different Models 

Model Mean Frequency per year

Fully Independent 1.61 E-6

Fully Dependent 3.77 E-6

Mankamo Model 3.16 E-6

Assigned Conditional Probability 2.71 E-6

Reed-McCann Procedure 1.90 E-6

Split Fraction Method (SF = 0.8) 3.34 E-6

Split Fraction Method (SF = 0.5) 2.69 E-6

Split Fraction Method (SF = 0.2) 2.04 E-6

8-1

8 ILLUSTRATIVE DESCRIPTION OF THE PROPOSED METHODOLOGY

FOR CALCULATING THE FRAGILITY OF JOINT FAILURES

8.1 Introduction

The methodology described in this section is the one proposed here for use as the “improved 

methodology” for analyzing dependency. This methodology has been introduced in Section 7.4. 

Here, it is described further using various cases of an illustrative example. The methodology, 

which will sometimes be called the “Reed-McCann” method here after its two main developers, 

will be described using the three components example. The methodology is to first identify the 

independent and common variables that describe the epistemic uncertainty and randomness in 

the capacities of components. Reed et al. (1985) define these as “Group Dependencies.” In 

Stage 1, the median capacities of components are sampled to reflect the uncertainty and to 

account for the dependency between component capacities. In Stage 2, the independent 

portion of randomness variability of each component capacity is calculated by appropriately 

separating the independent portion from the common portion and removing the common portion 

of the randomness. The three components are designated as A, B, and C. For each set j of 

dependent median capacity values (Am, Bm and Cm), the frequency of joint failure of three 

components is calculated as a triple integral:

Pf (a, j) = ∫ ∫ ∫ Φ [a, x1, x2, x3, j] φ [x1, x2, x3] [1/x1 x2 x3] dx1 dx2 dx3 (8-1)

where 

Φ [a, x1, x2, x3, j] = Φ [ Z12 (a, x1, x2, j)] Φ [ Z13 (a, x1, x3, j)] Φ [ Z23 (a, x2, x3, j)]

Z12 (a, x1, x2, j) = ln [ (a/Am,j) x1 x2 ]/βRA’ 

Z12 (a, x1, x3, j) = ln [ (a/Bm,j) x1 x3 ]/βRB’ 

Z12 (a, x2, x3, j) = ln [ (a/Cm,j) x1 x2 ]/βRC’ 

z1 (x1) = ln(x1)/ βRA* 

z2 (x2) = ln(x2)/ βRB* 

z3 (x3) = ln(x3)/ βRC* 

φ [x1, x2, x3] = φ [z1 (x1) ] φ [z2 (x2) ] φ [z3 (x3) ]

By performing this integration for different values of acceleration “a”, one obtains the fragility 

curve for the system (of three component cut set) as a function of “a”. By repeating this 

procedure for different samples of median capacities, one obtains the family of fragility curves; 

the weighted arithmetic average of these curves gives the mean fragility curve. The weighting is 

1/n where n is the number of samples of median capacity.
8-2

8.2 Examples

8.2.1 Case 1: Identical Components Located Next to Each Other

This case (the base case) follows the focus of the research project and postulates a cut set of 

three nominally identical components located next to each other. The objective is to derive the 

fragility curves for this cut set as functions of peak ground acceleration. The analyst judges that 

there are common variables in the determination of seismic responses of these components 

and in the failure modes and capacities as discussed in Section 8.

Component Properties

Component Median Capacity βR βU

A 0.7g 0.25 0.30

B 0.7g 0.25 0.30

C 0.7g 0.25 0.30

Group Dependencies

Common Variability

Group Components βR* βU* 

1 A, B 0.15 0.15

2 A, C 0.15 0.15

3 B, C 0.15 0.15

In Stage 1, the median capacities of A, B and C are sampled accounting for the common 

epistemic uncertainties βU*. For each sample set, a fragility curve is derived by integrating 

according to Equation 8-1. Figure 8-1 shows these fragility curves. The mean curve is 

convolved over the mean seismic hazard to obtain the mean frequency of system failure. Table 

8-1 shows this frequency along with the bounds assuming total independence and total

dependency. Figure 8-1 shows that one of the ten samples is clearly an ”outlier” compared to

the other 9. The outlier is in fact a valid sample, but this outlier significantly affects the mean.

This is only an example to illustrate the method. However, this demonstrates that in an actual

analysis the choice of only ten samples is insufficient to produce a stable mean result.

Figure 8-2 shows the fragility curve (mean) for joint failure of these three components calculated 

for three models: zero dependency, 100 % dependency and Reed-McCann method. It can be 

seen that the assumption of 100% dependency could be conservative at lower peak ground 

accelerations; the system failure frequency is therefore impacted by the seismic hazard curve 

shape and the location of the component capacity relative to the hazard curve. Although the 

assumption of 100 % dependency (“one fails, all fail”) does not change the system failure 

frequency by orders of magnitude, it does have some impact on the system failure frequency as 

inferred from Figure 8-2. 

As a sensitivity study, the value of βU* is changed to 0.20 to reflect the thinking that there are 

more things in common between the two components in terms of uncertainty in fragility. The 

resulting mean cut set frequency is 1.96 E-6 per yr compared to the 1.15 E-6/yr for Case 1.
8-3

8.2.2 Case 2: Identical Components on Different Floors

In this case, it is assumed that A and B are on the same floor and located next to each other; 

Component C, which is otherwise identical, is located at a different floor with a lower building 

amplification, hence a higher median capacity. 

Component Properties

Component Median Capacity βR βU

A 0.7g 0.25 0.30

B 0.7g 0.25 0.30

C 1.0g 0.30 0.40

Group Dependencies

Common Variability

Group Components βR* βU* 

1 A, B 0.15 0.15

2 A, C 0.10 0.12

3 B, C 0.10 0.12

8.2.3 Case 3: Different Components Located Side-by-Side

In this example, the failure modes and the capacities of all 3 of the components are different (for 

example, the 3 different failure modes could be anchor bolt failure, weld anchorage failure, and 

functional failure of electrical equipment).

Component Properties

Component Median Capacity βR βU

A 0.8g 0.30 0.40

B 0.6g 0.25 0.35

C 1.2g 0.25 0.30

Group Dependencies

Common Variability

Group Components βR* βU* 

1 A, B 0.15 0.10

2 A, C 0.15 0.20

3 B, C 0.15 0.15

8.2.4 Case 4: Different Components on Different Floors

Component Properties

Component Median Capacity βR βU

A 0.7g 0.20 0.35

B 1.3g 0.25 0.30

C 0.9g 0.20 0.40
8-4

Group Dependencies

Common Variability

Group Components βR* βU* 

1 A, B 0.10 0.10

2 A, C 0.05 0.15

3 B, C 0.10 0.20

8.2.5 Case 5: Union of Components

The objective of this example is to assess the impact of dependency when the components are 

in a Boolean OR configuration in the system model (‘union”). This means that the overall cut set 

failure will occur if any one of the constituent components has failed. It is traditional to assume 

that the components in such a combination are perfectly independent which is conservative. If 

the components have different capacities or fragilities, typically the lowest capacity component 

controls. 

Component Properties

Component Median Capacity βR βU

A 0.7g 0.20 0.35

B 1.3g 0.25 0.30

C 0.9g 0.20 0.40

Group Dependencies

Common Variability

Group Components βR* βU* 

1 A, B 0.10 0.10

2 A, C 0.05 0.15

3 B, C 0.10 0.20

Figure 8-3 shows the mean fragility curves for different cases. Each of these curves is 

convolved with the mean seismic hazard curve to obtain the mean annual frequency of system 

failure. Table 8-1 shows the result; also shown are the values for zero dependency and 100% 

dependency. It can be seen that this method provides a more refined and insightful estimate 

compared to the assumption of “one fails, all fail” for redundant adjacent components in a cut 

set; it also shows that the traditional assumption of zero dependency used when the 

components are in series (Boolean OR) is not overly conservative.

When the components are different and are located on different floors (Case 4), the impact of 

dependency is minimal. The separation of variables approach gives a mean annual frequency 

value very close to that obtained assuming the components are fully independent. There is a 

minor difference that is attributed to the numerical integration procedure used. For the union of 

components (Case 5), the theoretical upper bound on the frequency is obtained when the 

components are fully independent. The assumption of full dependency provides the lower 

bound on the frequency. The separation of variables approach provides the frequency value in 

between these bounds. 
8-5

The examples described above show the typical situations where the PRA analyst is required to 

consider and quantitatively account for seismic correlation between component failures. The 

methodology for treating such correlation searches for the common variables that give rise to 

correlation and performs the quantification of the cut set consisting of the independent portion 

integrated over the range of dependent variables. This is generally a multiple integration. This 

integration over the common variables shown in Equation 8-1 may become highly intractable 

when higher order cut sets are to be evaluated as described in the following example.

8.3 Example of 2 Out of 4 Success Criteria 

In many PRA applications, we encounter situations that the system would succeed if any 2 out 

of 4 redundant components (A,B,C, and D) succeed. Therefore, the system failure can be

expressed as 

System fails = (A,B,C,D all fail) 

OR (A succeeds, B,C,D all fail) 

OR (B succeeds, A,C,D all fail) 

OR (C succeeds, A,B,D all fail) 

OR (D succeeds, A,B,C all fail).

We will first describe the calculation of the fragility of ABCD (i.e., the joint failure probability of all 

the four components.)

Component Properties

Component Median Capacity βR βU

A 0.7g 0.25 0.30

B 0.7g 0.25 0.30

C 0.7g 0.25 0.30

D 0.7g 0.25 0.30

Group Dependencies

Common Variability

Group Components βR* βU* 

1 A, B 0.10 0.15

2 A, C 0.10 0.15

3 A, D 0.10 0.15

4 B, C 0.10 0.15

5 B, D 0.10 0.15

6 C, D 0.10 0.15

In Stage 1, the median capacities of components are sampled to reflect the uncertainty and to 

account for the correlation between component capacities using the procedure described 

earlier. For example, 

βUA' = (βU 2

 -∑ βU*2)

1/2 = [0.302

 – (0.152 + 0.152 +0.152)]1/2 = 0.15

Similarly, βUB', βUC ' and βUD' are calculated. 
8-6

Using median capacity (0.7g) and βUA', βUB', βUC ' and βUD', ten Latin Hypercube samples are 

obtained. To each of these values, the correction factors are applied which are sampled from 

the lognormal distribution with median = 1.0 and βU*. 

βRA' = (βR 2

 -∑ βR*2)

1/2 = [0.252

 – (0.102 + 0.102 +0.102)]1/2 = 0.18

Similarly, βRB', βRC ' and βRD' are calculated.

In Stage 2, the integral will be six-fold to account for 6 group dependencies. It is not practical to 

perform this integration; hence we need an alternative approach. It is seen that each integration

is over the probability density function of dependent variable defined as lognormal with median 

of 1.0 and βRAB*, etc. For a set of values of dependent variables, the integrand is calculated. 

Therefore, we propose that Latin Hypercube sampling be done to select the sample sets of 

dependent variable values. Using each of these samples, the integrand is calculated and 

summed. Table 8-2 shows the mean annual frequency of system failure (2 out of 4) using this 

procedure compared with the assumption of zero dependency and 100% dependency. The 

calculated frequency of 2 out of 4 system failure is lower than the value obtained for zero 

dependency since the system failure Boolean equation is a combination of failures and 

successes in “AND” and “OR” gates. For details, see Appendix D.

It is noted that the mean annual frequency calculated for Case 4 in Table 8-1 and also for the 

case “2 out of 4 system failure” in Table 8-2 fall slightly outside the two “bounding” cases. This 

could be improved by selecting more samples of median capacity and increasing the Latin 

Hypercube samples.

8.4 Assessment of Common Variables

The proposed methodology requires that the analyst identify and assess the common variables 

between the fragilities of two or more components under review. The dependency between 

component fragilities can be quantified by examining the process in which the individual factors 

of safety in a fragility assessment are developed. For example, the behaviors in earthquakes of 

two components in a building are dependent on each other and on the building through the 

building response factors (i.e., SSI, spectral shape, frequency, damping and mode shape). 

Thus, the corresponding epistemic uncertainty and randomness β values for each of these 

factors will be the same for both components if they are perfectly dependent. One exception 

may be the β values for the building modeling factors (i.e., frequency, damping, and mode 

shape) which could be different if the components are located in different parts of the building 

where support motion comes from different dynamic building modes. If two components have 

identical failure modes, they could be considered highly dependent; however, the material (e.g., 

concrete, steel, anchor bolt and weld) may have some random variation even among nominally 

identical designs. The responses between the two components could be considered to be 

highly correlated although there may be some randomness introduced through variations in 

fabrication and installation. Therefore, the fragility analyst is urged to look for similarities and 

differences between the components in assessing the variabilities (as expressed in the β*

values). After a few applications of the methodology in full-scale seismic PRAs, the procedure 

for identification and assessment of common variables could be standardized and specific 

guidance could be developed.
8-7

8.5 Generalization of Reed and McCann Procedure for Multi-Component 

 Correlation 

The procedure described in Section 7.4 has mainly focused on pair-wise dependencies 

between groups of components (e.g., AB, AC and BC when there are three components A, B 

and C under study). However, it is recognized that all three components (A, B and C) are 

mutually dependent on each other. Dr. Mohamed Talaat of Simpson Gumpertz & Heger has 

proposed a generalization of the Reed and McCann procedure to treat multi-component 

correlation. 

A straightforward extension of the logical process above to correlations among multiple 

components is to do the following:

a. begin by identifying the components that share common β* values;

b. start with the Tier 1 β*

U value(s) that connects the largest number of components,

generate a LHS set(s) of dependent scale factors from a lognormal distribution(s)

with a unit median(s) and each Tier 1 β*(1)U (typically, there will be only one Tier 1

β*

U);

c. calculate the Tier 1 reduced β’

U for each component, per Equation 2.17

d. if there are common dependencies still, then create another LHS tier of

dependent scale factors, Tier 2, for each set of still-correlated components.

These scale factors will have unit medians and common β*(2)U values reduced

according to Equation 2.17 from the original common β*

U values by the amount

accounted for in Tier 1;

e. keep “peeling away” tiers of dependencies until there is only the portion β’

U for

each component which is not shared with any other component; then generate

the “independent step” LHS realizations using the median capacity and β’

U for

each component;

f. similar to the procedure in Section 7.4, randomly order the rows of the resulting

matrix with replacement;

g. similar to Section 7.4, multiply for each component the realization and scale

factors for any correlated group to which this component belongs;

h. perform the integration of the transformed variables over the entire range of the

dummy variables such that there is one dummy variable for each “dependent”

scale factor developed in the different tiers;, the dummy variables are lognormal

with unit median and β*(i)R. The lognormal standard deviations β’(j)R of the

transformed variables are calculated by removing all tiers of β*(i)R from β(j)R.

The application of this generalized approach requires the fragility analyst to identify and 

quantify the variables that are common to different groups of components. Currently, there 

are no defined procedures or empirical data to use to perform this identification and 

quantification of common variables. 

As discussed in Sections 9.3 and 10.4, the methodology of separating the common 

variables is evolving and needs to be vetted with real applications during the next phase of 

this research. 
8-8

Figure 8-1 Fragility Curves for Joint Failure of A, B and C, Case 1 

Figure 8-2 Fragility for Joint Failure of Three Components (Case 1) for 

 Three Models: Zero Dependency, 100% Dependency, and ReedMcCann Method 
8-9

Figure 8-3 Fragility of Joint Failure of Three Components in Different Configurations 
8-10

Table 8-1 Mean Annual Frequency for Three Component Failures for 

Different Configurations 

Case Description

Zero 

Dependency

Separation of 

Independent and 

Common 

Variables Method

100% 

Dependency

Case 1

Identical 

Components 

located side by 

side 1.02 E-6 1.15 E-6 4.16 E-6

Case 2

Identical 

Components on 

Different Floors 6.14 E-7 6.65 E-7 2.12 E-6

Case 3

Different 

Components 

located side-by

side 3.56 E-7 5.32 E-7 7.22 E-7

Case 4

Different 

components on 

different floors 2.42 E-7 2.27 E-7 5.41 E-7

Case 5

Union of 

Components 7.79 E-6 6.49 E-6 4.34 E-6

Table 8-2 Mean Annual Frequency of 2 out 4 System Failure

Zero Dependency

Separation of 

Independent and 

Common Variables 

Method 100% Dependency

1.84 E-6 1.21 E-6 3.77 E-6 
9-1

9 CONSIDERATIONS ON USING THE NEW METHODOLOGY IN 

SEISMIC PRA

9.1 Introduction

The outcome (the “result”) of using the recommended more refined and insightful new 

methodology for dependencies is a seismic fragility curve, examples of which can be found in 

Figures 8-1, 8-2, and 8-3. However, the “failure” that the fragility curve from the new 

methodology represents is not the failure of a single item, as in a typical fragility curve, but the 

outcome defined by the dependency problem being addressed. For a two-item system, for 

example, this outcome could be three different fragility curves representing 0 out of 2, 1 out of 2, 

and 2 out of 2 failures occurring. These fragility curves will embed all of the information about 

dependencies that is encompassed by the new methodology. 

Notice that the outcome “0 out of 2” means that “neither item fails,” which is a distinct end state. 

For the usual one-item fragility curve, the end state called “success” is simply the inverse of the 

“failure” end state – that is, either the single item “fails” or it “does not fail” when subjected to the 

seismic load. When two items are evaluated using the new dependency analysis, it is 

necessary to work out the “0 out of 2” end state explicitly, because it may be needed as part of 

the rest of the PRA systems analysis.

Although the proposed new methodology is technically sound and rigorous, in execution the 

fragility analyst may need further guidance. This Section is intended to provide a modicum of 

introduction and explanation, along with some advice and some necessary warnings.

9.2 How the analysis will likely proceed

The authors of this report expect that, in a typical NPP seismic PRA, the more refined and 

insightful correlation methodology will only be brought into play for a very few situations. It will 

likely not be used to address a large number of correlation/dependency problems. In part, this 

is because in a typical SPRA only a few such situations will likely exist, but detailed application 

could be time-consuming and hence costly. Until enough experience is gained, the community 

of seismic-PRA analysts will not know whether or not this is so.

We envision several “steps” in the process, as follows:

Step 1: Performance of a seismic PRA using standard methods

o The SPRA needs to include sufficient sensitivity studies to explore where the standard

thumb-rule assumptions on dependency “make a difference” compared to a more realistic

analysis. The sensitivity studies will presumably be done at the cut set or the accidentsequence level.

o The sensitivity studies need to include studying the entire cut set or accident sequence in

which the failures being addressed are included. This is because it is the effect on the

overall cut set or sequence quantification that is at issue.

Step 2: Identification of those (presumably few) cut sets or accident sequences where the 

correlation analysis “makes a difference.”
9-2

o The cut set or accident sequence identification will presumably be based in a major way on

the insights from the sensitivity studies.

o The words “presumably few” are used because, in the authors’ experience, a typical SPRA

might only have a very few (one or two, seldom as many as four or five) cut sets or

accident sequences for which the choice of correlation/dependency analysis would “make a

difference.”

o Only the SPRA analyst team will know what the phrase “makes a difference” means – the

difference could be numerical (in the quantification), it could be in terms of importance, or it

could be in terms of a difference in the safety insights.

Step 3: Use of the new methodology to study the identified cut sets or accident sequences, 

one by one. 

o The more refined and insightful new methodology is to be applied, of course, to only one

“correlation/dependency problem” at a time.

o For each problem, the methodology develops a fragility curve, or more than one, as

indicated above, representing, say, 0 out of 2, or 1 out of 2, or 2 out of 2 failures.

Step 4: Use of the new fragility curve(s) in the seismic PRA in the usual way.

o A principal benefit of the new methodology, in terms of using the results in an SPRA, is that

its output is the same type of fragility curve that is already in routine use in seismic PRA --

that is, a fragility curve that plots the probability of “failure” on the ordinate against the size

of the seismic “load” on the abscissa.

o The quantification aspect of the seismic PRA can therefore proceed as usual.

o Note that an iterative approach may be appropriate. Specifically, after the quantification

occurs in Step 4, the analysis team may decide to go back to Step 3 or even to Step 2 to

perform another round of analysis, perhaps in more detail or by selecting a different set of

SSCs to study using the new dependency methodology.

9.3 Caveats When Using the New Methodology

There are several caveats that the analysis team should be made aware of.

Difficulty in use: First, there is the possibility that the more refined and insightful methodology 

will prove to be too difficult to use except in the hands of the most experienced seismic-PRA 

fragility analysts. There is no way to know now whether this will turn out to be true, nor any way 

to alleviate it if it proves true, until the methodology has been applied several times by different 

analysts.

Variability among analysts: Second, there is the concern that even in the hands of experienced 

analysts, the methodology is fraught with the possibility of considerable variability from analyst 

to analyst. This is because expert judgment will inevitably be needed to assign the various β

values, specifically in the partitioning between the “independent” and the “dependent” parts, 
9-3

which introduces new areas of “model uncertainty”. Indeed, each individual analyst is urged to 

try to identify how much uncertainty is to be associated with that analyst’s β-partitioning 

assignments, and to do sensitivity studies on their effect. This is because that uncertainty is by 

its nature pure epistemic uncertainty, and as such needs to be incorporated into the overall 

analysis.

Conservative vs. non-conservative bias in selecting the “problems” to analyze: There is a 

danger of bias, conscious or unconscious, in terms of which “problems” are selected for analysis 

using the more realistic new methodology. An analyst might select only those where the likely 

outcome of the new methodology would reduce the overall sequence or cut set frequency, while 

ignoring those for which the likely outcome would go the other way.

The fact is that, taken as a whole, there is no way to know for a given SPRA whether those few 

sequences or cut sets where the correlation/dependency approach “matters” would mostly be 

those for which a more realistic analysis will produce a larger or a smaller result. Either 

outcome could be the case. The methodology is agnostic --- but the analyst(s) might not be, 

even if unconsciously.

This leads us to make an additional admonition. The admonition is that thinking about the new 

methodology in terms of whether it will provide for a “more conservative” or a “less conservative” 

analysis is simply the wrong way to think about things. The correct way to think about this 

aspect of SPRA is that the new methodology will produce a more refined and insightful SPRA 

analysis, when compared to the standard SPRA approach of using the thumb rules in Table 2.1. 

This is true even though the new methodology requires a certain amount of judgment on the 

part of the SPRA analyst, and therefore cannot be as “fully realistic” as would be an approach 

fully supported by a plethora of test data -- data that are simply not available now.. 

Acceptability of the current SPRA approach: The current SPRA approach to this type of 

analysis, using the thumb rules (Table 2.1) to assign full or zero dependency, can be fully 

adequate in many analysis situations, if not most of them. The word “adequate” here should be 

understood in the context of the use of an SPRA to support various safety decisions. One 

should not take away an implication that SPRAs are generally either conservative or nonconservative because of how they treat dependencies in general – it will depend on the 

individual configuration. This is especially true when taking account of the uncertainties, which 

may or may not affect how robust the technical support is for any specific decision.

Need for peer review, formal or informal: Whether the application of the proposed methodology 

requires a “formal” peer review must be left to the analysis team and its sponsors. However, at 

least until the methodology becomes established and accepted, the authors of this report wish 

to express the hope that peer review in the nature of consultation with colleagues, if not more, 

will be a part of the first few initial applications of the methodology. The authors also believe 

that, because significant judgment on the part of the analysts will be required whenever this 

methodology is used, a peer review by outside experts (formal or informal) should always be 

performed to enhance the confidence in the results. 

10-1

10 SUMMARY 

10.1 Introduction 

What motivated this project, as stated in the opening section of this report, is the observation 

that in every seismic PRA for a nuclear power plant, it is necessary for the analyst to deal with 

the fact that the seismic responses and fragilities of various SSCs in the plant can be 

dependent, and in some cases highly dependent. However, the methodology in common use 

by SPRA analysts for dealing with this issue is not as refined and insightful as it needs to be. 

The project team proposed to undertake this work because of the conviction that a directed 

effort to deal with this issue held out the promise of a possible important advance in the 

methodology available to SPRA analysts.

At the start of the project, the project team had a few initial ideas and pre-conceptions as to how 

the project should proceed, what would be learned, what barriers would be difficult to overcome, 

and what the ultimate project “results” might be. As it has turned out, some of these early ideas 

have borne fruit, while others turned out not to be correct, and still others turned out not to be as 

beneficial as had been thought.

Here the major initial ideas that motivated the project team will be described, and for each what 

was learned will be discussed.

A. Importance of the issue: At the outset, the project team believed that how dependency is

dealt with in SPRAs is important; that is, the approach used can make an important difference to

the results and insights from a typical SPRA at an NPP. This was confirmed by the review of

several existing SPRAs. (See Section 4.)

B. The mathematical formalism: At the outset, the project team’s experience had led it to

believe that the mathematical formalism used for analyzing seismic dependencies had been

developed in several different (but equivalent) forms, and that the formalism was adequate in

principle. A review of the literature has confirmed this initial confidence. (See Section 2.)

C. Usefulness of the existing data base: At the outset, the project team believed that, for at

least some important classes of SSCs, there existed enough test data and earthquakeexperience data to provide adequate data-driven support for determining dependencies, if only

these data were examined carefully. A review of these data and consultation with other experts

whose familiarity with the data is extensive has led to the conclusion that the original belief is

not correct. That is, the data are inadequate for the intended purposes here. (See Section 3.)

D. Feasibility of developing a more useful data base: At the outset, the project team believed

that if additional test data were felt to be needed to support an improved ability to analyze

dependencies, the development of these additional data is feasible. The work during this

project has confirmed this belief, it also seems clear that the testing necessary to develop the

needed data would likely be very costly and probably not justified. (See Section 3.) More

important, it also seems clear that the proposed new methodology makes feasible an important

advance in SPRA in this area without the need for a huge and costly new test program.

E. A methodology for analyzing dependencies for use by SPRA experts: At the outset, it was

believed that the “result” of this project would be a recommendation for a methodology or an
10-2

approach that could be used by experts in the field. It is believed that this has been confirmed 

by the work described in this report. (See Section 8.)

F. A methodology for analyzing dependencies for routine use by the SPRA community: At the

outset, although there was optimism that an improved methodology could be used routinely by

SPRA practitioners, there was not as much optimism in this regard as there was about the

potential usefulness of an advanced approach in the hands of experts. Now that this project

has been completed, it is believed that the methodology can be used by ordinary skilled SPRA

practitioners.

10.2 How the Results of This Research Project can be Used in Future Seismic 

 PRAs

The project team believes that the methodology described herein will ultimately become part of 

the analysis “tool kit” used by every SPRA analyst. This will not occur immediately, however, 

because the SPRA community will need to await one or more “trial applications” of the 

methodology before confidence will emerge that the methodology can be routinely used without 

major pitfalls. 

All of that is still in the future, of course. 

Applications: The first application of the results of the methodology will be to understand better 

which accident sequences of importance in SPRA (if any) have contributions dominated by the 

dependencies among SSCs, or perhaps not. This understanding may lead to an effort to reduce 

the importance of those accident sequences, which might mean specific design or operational 

changes to reduce the extent of dependency. Several approaches to achieve such a reduction 

are available, but each case will be different – this will inevitably be an analysis and then a 

safety decision taken on a case-by-case basis. 

Whether the initial application(s) of this new methodology will be mostly for new designs or 

mostly for study of reactors that are already operating is unknown, of course, but it is easy to 

note that changes are usually simpler, less disruptive, and less costly before a plant has been 

built. 

10.3 How an Application of the Methodology Will Likely Proceed

As noted earlier (see Section 9.2), it is envisioned that the methodology will be used in a seismic 

PRA mostly in an iterative sense, as follows: 

First, the analysts would develop a normal SPRA study that identifies the significant accident 

sequences and cut sets, using an analysis that includes today’s usual assumptions on 

dependency based on the well-known thumb rules. (See Table 2-1.) This would be followed by 

a determination of which (if any) of the accident sequences would be different, and by how 

much, depending on the sensitivity of the results to the dependency assumption. (The analyst 

should normally treat the identical redundant components located next to each other as totally 

independent for this sensitivity study). These would be communicated to the fragility analysis 

team. 
10-3

The next part of the analysis would be undertaken by the fragility analysts, working with the 

failure modes of interest and the success criteria at issue (e.g., 1 out of 2, 1 out of 4, 2 out of 3, 

2 out of 4 etc.), and using the methodology herein to do a “better job” on those few SSC 

dependencies where it “matters.”

This would lead to an iteration in which the SPRA systems analyst team re-quantifies the 

analysis, and then determines anew which accident sequences and cut sets are important (and 

why.) Whether this leads to still another iteration by the fragility analysis team will depend on 

the results and/or on the application of those results.

10.4 Recommendations for Future Work

The purpose of this study has been to assess whether an improved methodology for 

incorporation of correlation/dependency could be recommended for future SPRA applications. 

A new and more refined and insightful approach to incorporate correlation/dependency has 

indeed been recommended as a result of this study. To implement this new approach requires 

the participation of both the SPRA fragility analysts and the SPRA plant logic 

model/quantification analysts. 

Some simple scenarios have been examined as a part of this study. However, to understand 

the actual challenges with the implementation on a full SPRA as well as to ascertain the 

cost/benefit of the new approach, follow-on studies are warranted. The most important followon work is that a few trial applications be undertaken of the new methodology described in this 

report. Specifically, it is necessary that the method be used in a few real ongoing seismic PRA 

studies. 

The U.S. nuclear industry is currently developing new SPRAs in response to the NRC’s postFukushima Near Term Task Force 2.1 seismic recommendation. As such, state-of-the-art 

SPRAs are being developed for a number of U.S. NPPs that could serve as potential sensitivity 

studies for the proposed new approach. The objectives of these trial applications would be:

• First, to determine how readily the methodology can be understood and adopted by the

most experienced SPRA practitioners;

• Second, to identify whether there is a need for further methodology guidance both for the

most experienced practitioners and also to assist those who would be new to these

methods, and

• Third, to identify the cost/benefit inherent in this new approach so as to guide the industry

and the NRC on the benefits of incorporation of this new method.

In addition to these trial applications, we recommend that consideration be given to forming a 

peer review panel representing both the NRC and the utility industry to provide comments and 

suggestions on this approach; to provide recommendations for new research that could assist in 

refining specific aspects of how correlation/dependency is analyzed (e.g., increased use of 

testing and experience data in the applications); and to provide peer review for the pilot 

applications.

11-1

11 REFERENCES

ASME-ANS (2009), American Society of Mechanical Engineers (ASME) and American Nuclear 

Society (ANS), “ASME-ANS RA-Sa-2009, Addendum a to RA-S-2008, “Standard for Level 1-

Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant 

Applications,” American Society of Mechanical Engineers, New York NY (2013)

Barlow, R.E., and F. Proschan (1975), Statistical Theory of Reliability and Life Testing – 

Probability Models, Holt, Rinehart, and Winston, New York, NY 

Bohn, M.P., (1984), "Recommended Procedures for the Simplified Seismic Risk Analyses in 

TAP A-45", prepared for USNRC by Sandia National Laboratories, Albuquerque, NM

Bohn, M.P., and J.A. Lambright (1990), "Procedures for the External Event Core Damage 

Frequency Analyses for NUREG-1150," NUREG/CR-4840, SAND88-3102, Sandia National 

Laboratories, Albuquerque, NM

Cummings, G.E. (1986), "Summary Report on the Seismic Safety Margins Research Program", 

NUREG/CR-4431, Lawrence Livermore National Laboratory, Livermore, CA

Der Kiureghian, A.D., and P.L. Liu, (1986) “Structural Reliability under Incomplete Probability 

Information,” Journal of Engineering Mechanics, ASCE, Vol. 112, No. 1, January 1986, pp 85-

104

Electric Power Research Institute (1996), “Summary of the Seismic Adequacy of Twenty 

Classes of Equipment Required for the Safe Shutdown of Nuclear Plants,” EPRI Report NP7149-D Supplement 1

Electric Power Research Institute (2012), “Seismic Evaluation Guidance: Screening, 

Prioritization and Implementation Details (SPID) for the Resolution of Fukushima Near-Term 

Task Force Recommendation 2.1: Seismic,” EPRI Report 1025287

Fleming, K.N., (2005), “On the Issue of Integrated Risk – A PRA Practitioner’s Perspective”, 

Proceedings of PSA-05, American Nuclear Society, San Francisco

Fleming, K. and T.J. Mikschl (1999), “Technical Issues in the Treatment of Dependence in 

Seismic Risk Analysis”, Proceedings of OECD/NEA Workshop on Seismic Risk, 

NEA/CSNI/R(99)28, February 2001

George, L.L., S.B. Guarro, P.G. Prassinos and J.E. Wells, (1985), "SEISIM - Systematic 

Evaluation of Important Safety Improvement Measures User Manual", UCID-20496, Lawrence 

Livermore National Laboratory, Livermore, CA

Genz, A.C. and A.A. Malik (1980), "Remarks on Algorithm 006, An Adaptive Algorithm for 

Numerical Integration Over an N-Dimensional Rectangular Region", Journal of Computational 

and Applied Mathematics, Volume 6(4), 1980.
11-2

Gupta, S.S. (1983), “The Multivariate Normal Distribution with Equal Correlations," in Statistical 

Tables for Multivariate Analysis: A Handbook with References to Applications, Edited by Heinz 

Kres, Springer Verlag, New York

Hakata, T. (2006), “Seismic PSA Methodology for Multi-Unit Sites,” Specialists Meeting on the 

Seismic PSA of Nuclear Facilities, OECD Nuclear Energy Agency, Jeju Island, Korea, 

November 6-8, 2006

Hickman, J., et al. (1983) “PRA Procedures Guide: A Guide to the Performance of Probabilistic 

Risk Assessments for Nuclear Power Plants,” Report NUREG/CR-2300, American Nuclear 

Society, Institute of Electric and Electronic Engineers, and U.S. Nuclear Regulatory Commission

Hunter, D. (1976), "An Upper Bound on the Probability of a Union," Journal of Applied 

Probability, Volume 13, 1976

Iman, R.L., W.J. Conover, and J.E. Campbell (1980), "Risk Methodology for Geological Disposal 

of Radioactive Waste: Small-Sample Sensitivity Analysis Techniques for Computer Models, with 

an Application to Risk Assessment", Report NUREG/CR-1397, Sandia National Laboratories, 

Albuquerque, NM

Johnson, J.J., G.L. Goudreau, S.E. Bumpus, and O.R. Maslenikov (1981), “Seismic Safety 

Margins Research Program – Phase I Final Report, Seismic Methodology Chain with Statistics 

(Project VIII),” Report NUREG/CR-2015, Vol. 9, U.S. Nuclear Regulatory Commission/Lawrence 

Livermore National Laboratory, Livermore CA

Kaplan, S. (1985), "A Method for Handling Dependencies and Partial Dependencies of Fragility 

Curves in Seismic Risk Analysis”, Transactions of Eighth SMiRT Conference, Brussels, 

Belgium, Paper M2M1 1/5

Kaplan, S. and J.C. Lin, (1987), “An Improved Condensation Procedure in Discrete Probability 

Distribution Calculations,” Risk Analysis, Vol, 7, No. 1, 1987

Karimi, R (1988) “ SEISMIC – A Computer Program for Seismic Risk Evaluation,” Report NUS4064, NUS Corporation, Gaithersburg, MD, 1983

Kennedy, R.P., et al. (1988) “Seismic Fragilities of Structures and Components at the Diablo 

Canyon Power Plant,” prepared for Pacific Gas and Electric Company

Klugel, J-U (2009), “On the Treatment of Dependency of Seismically Induced Component 

Failures in Seismic PRA”, Transactions of Twentieth SMiRT Conference, Espoo, Finland, 

August 9-14, 2009, Division VII, Paper 1581

Mankamo, T. (1977), "Common Load Model: A Tool for Common Cause Failure Analysis", UDK 

519.283:62-19, Electrical Engineering Laboratory Report 31, Technical Research Center of 

Finland, Espoo, Finland

Muramatsu, K., Q. Liu, and T. Uchiyama, (2007) “Effect of Correlations of Component Failures 

Cross-Connections of EDGs on seismically Induced Core Damage of a Multi-Unit Site”, Japan 

Atomic Energy Agency Presentation, November 14, 2007 (private communication)
11-3

Mosleh, A., et al. (1988), "Procedures for Treating Common Cause Failures in Safety and 

Reliability Studies - Procedural Framework and Examples", NUREG/CR-4780, EPRI NP-5613, 

Prepared for U.S. Nuclear Regulatory Commission and Electric Power Research Institute

National Bureau of Standards (1959), Tables of the Bivariate Normal Distribution Function and 

Related Functions, NBS Applied Mathematics Series 50, U.S. Government Printing Office

Ogura, K., M. Fukuda, M. Sakagami, and K. Ebisawa, (2006), “Accident Sequence Study for 

Seismic Event at the Multi-unit Site”, Specialists Meeting on the Seismic PSA of Nuclear 

Facilities, OECD Nuclear Energy Agency, Jeju Island, Korea, November 6-8, 2006

Oikawa T., M. Kondo, Y. Mizuno, Y. Watanabe, H. Fukuoka and K. Muramatsu (1998) 

“Development of System Reliability Analysis Code SECOM-2 for Seismic PSA,” Journal of 

Reliability Engineering and System Safety, 1998: 62:251-71

Pacific Gas and Electric Company (1988) “Final Report of the Diablo Canyon Long Term 

Seismic Program,” available from the U.S. Nuclear Regulatory Commission, Dockets 50-275 

and 50-323

Pellissetti, M.F., and U. Klapp, (2011), “Integration of Correlation Models for Seismic Failures 

into Fault Tree Based Seismic PSA”, Transactions of Twenty-First SMiRT Conference, 6-11 

November, 2011, New Delhi, India Div-Vii: Paper ID# 604

Pickard, Lowe and Garrick, Inc. (1983), “Seabrook Station Probabilistic Safety Assessment – 

Section 13.3 Risk of Two Unit Station,” PLG-0300

Ravindra, M.K. and J.J. Johnson (1991), “Seismically Induced Common Cause Failures in PSA 

of Nuclear Power Plants”, Transactions of the Eleventh SMiRT Conference, Tokyo, Japan, 

August 1991 Paper M04/1

Ravindra, M.K. and L.W. Tiong (1989), "Comparison of Methods for Seismic Risk 

Quantification", Transactions of the Tenth SMiRT Conference, Anaheim, California

Ravindra, M.K., et al. (1984a), "Sensitivity of Seismic Risk Models", Report EPRI NP-3562, 

Electric Power Research Institute, Palo Alto, CA

Ravindra, M.K., et al. (1984b), "A Program to Determine the Capability of the Millstone 3 

Nuclear Power Plant to Withstand Seismic Excitation Above the Design SSE", Report prepared 

for Northeast Utilities, Berlin, CT

Ravindra, M.K., R.P. Kennedy, and R.H. Sues (1985), "Dominant Contributors to Seismic Risk: 

An Appraisal", EPRI NP- 4168, Electric Power Research Institute, Palo Alto, CA

Reed J.W., and R.P. Kennedy (1994), “Methodology for Developing Seismic Fragilities,” Report 

TR-103959, Electric Power Research Institute, Palo Alto, CA

Reed, J.W., M.W. McCann, J. Iihara, and H. Hadidi-Tamjed, (1985), "Analytical Techniques for 

Performing Probabilistic Seismic Risk Assessment of Nuclear Power Plants", ICOSSAR '85, 4th 

International Conference on Structural Safety and Reliability, Kobe, Japan, May 1985, Volume 

III, pp 253-261
11-4

SQUG (2001), Generic Implementation Procedure (GIP) for Seismic Verification of Nuclear 

Plant Equipment, Revision 3A, December 2001, Seismic Qualification Utility Group (SQUG)

Thoft-Christensen, P., and M.J. Baker, (1982), Structural Reliability Theory and Its Applications, 

Springer-Verlag, New York

US NRC (1975), “An Assessment of Accidental Risks in U.S. Commercial Nuclear Power 

Plants,” Report WASH 1400

US NRC (2007), Regulatory Guide 1.208, “A Performance-Based Approach to Define the SiteSpecific Earthquake Ground Motion”

US NRC (2009), Regulatory Guide 1.200, “An Approach for Determining the Technical 

Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,” Revision 2

Watanabe, Y., T. Oikawa, and K. Muramatsu (2003), “Development of the DQFM Method to 

Consider the Effect of Correlation of Component Failures in Seismic PSA of Nuclear Power 

Plant,” Journal of Reliability Engineering and System Safety, 79(2003)265-279

Wells, J.E., L.L. George, and G.E. Cummings (1981), "Seismic Safety Margins Research 

Program; Systems Analysis (Project VII)", NUREG/CR-2015, Vol.8, Lawrence Livermore 

National Laboratory, Livermore, CA
A-1

APPENDIX A

REPORT ON THE LBNL SEISMIC CORRELATIONS WORKSHOP

16 – 17 JUNE 2011, NEWPORT BEACH CA

A.1 Venue, Organizer, Attendees and Agenda

WORKSHOP VENUE:

Simpson, Gumpertz & Heger

Attn: Gregory S. Hardy

4000 MacArthur Blvd., West Tower (K2), Suite 710

Newport Beach, CA 92660 

Telephone (213) 271-2000

Email: gshardy@sgh.com

WORKSHOP ORGANIZER: 

Robert J. Budnitz 

Lawrence Berkeley National Laboratory

University of California

Earth Sciences Division, Mail Stop 74R-0120

Berkeley CA 94720

Telephone (510) 486-7829

(Email: <RJBudnitz@lbl.gov> 

WORKSHOP ATTENDEES:

Robert J. Budnitz, LBNL (Berkeley CA)

Annie Kammerer, US NRC (Rockville MD)

Nilesh Chokshi, US NRC (Rockville MD)

Rosemary Hogan, US NRC (Rockville MD)

Gregory S. Hardy, SGH, (Newport Beach CA)

Mayasandra K. Ravindra, consultant (Irvine CA)

David L. Moore, consultant (Mercer Island WA)

Robert P. Kennedy, RPK Structural Mechanics Consulting (Escondido CA)

Robert T. Sewell, consultant (Louisville CO)

Larry Lee, Erin Engineering (Walnut Creek CA)

Peter Zinniker, ENSI, Swiss Federal Nuclear Safety Inspectorate (Brugg, Switzerland)

Katsumi Ebisawa, Japan Nuclear Energy Safety Organization-JNES (Japan)

Shinjiro Hidaka, JNES (Japan)

Manabu Yoshinaga, JNES (interpreter) (Japan)

WORKSHOP AGENDA

(Approximate – there was a lot of discussion of various topics outside of the specific agenda 

item under which they nominally fell.)

Thursday 16 June 2011

START TIME: 8:30am
A-2

Opening Remarks

A. Kammerer

Introduction to NRC Research Project: Scope, Schedule and Deliverables 

R.J. Budnitz 

Survey of Seismic PRAs to Assess Significance of Correlation 

R.J. Budnitz & D.L. Moore 

Review of Literature on Treatment of Correlated Seismic Failures 

M.K. Ravindra

Insights from Seismic Qualification Tests 

All 

Invited Discussion on Japanese Activities (4 presentations):

1. Method for Estimating Correlation of Hazard and SSCs and Application

i. Results (K. Ebisawa)

2. Role of Seismic PSA on Relationship Between Defense in Depth and

3. Safety/Performance Goals (K. Ebisawa)

4. Seismic Capacity Test of NPP Components and Equipment (K. Ebisawa)

5. Improvement of seismic capacity testing results of SSCs (S. Hidaka)

Invited Discussion, Swiss PRAs, examination of correlation issues

R.T. Sewell 

END TIME 5:45pm

Friday 17 June 2011

START TIME: 8:30am

Review of Earthquake Database for Correlated Failures (focusing on recent quakes: Chile, 

Turkey, Taiwan, Northridge, Kobe, Kashiwazaki, Fukushima etc.) 

G.S. Hardy 

Report on Accident at Fukushima and its Impact (3 separate presentations)

K. Ebisawa

Summary of First Day, Insights 

R. J. Budnitz

Action Items Discussion

R.J. Budnitz

Future Research Activities

R.J. Budnitz

END TIME 3:00pm
A-3

A.2 Workshop summary

A.2.1 Background About the Project

The project that sponsored this Workshop is entitled “Correlation of Seismic Performance in 

Similar Structures, Systems, and Components.” It is supported by the US Nuclear Regulatory 

Commission’s Office of Nuclear Regulatory Research, and is being carried out at the University 

of California’s Lawrence Berkeley National Laboratory. The Principal Investigator for the project 

is R. J. Budnitz (LBNL). The other main collaborators are D. L. Moore and M.K. Ravindra, 

assisted by G.S. Hardy. The NRC project manager is A. Kammerer.

Technical background: When an earthquake occurs near a nuclear power plant site, it subjects 

all of the structures, systems and components (SSCs) within the plant to ground motion. 

Depending on the level of this ground motion, one or more failures of SSCs could occur. 

Seismic Probabilistic Risk Assessment (SPRA) requires an estimation of the possible 

correlations among seismic failures of similar components at different stages of the analysis. 

This correlation is a large area of uncertainty and the very simple (but clearly incorrect) 

assumption is usually made that component failures are either fully coupled or completely 

uncoupled, depending on the relative location of the SSC in the plant and on the type of SSC. 

In reality, the correlation depends on the location of the equipment (within and between 

buildings), the dynamic characteristics of the equipment, and several other factors. Moreover, 

the failure mechanisms of various components could be quite different (e.g., saddle failure of a 

heat exchanger, shear failure of a shear wall of a building, anchorage failure of an electrical 

cabinet, deflection of a pump impeller etc.). Therefore, failures of different components can only 

be partially correlated at most. The impact of the simplifying assumptions currently made when 

performing SPRA to determine ultimate risk numbers is not currently known.

A.2.2 Objectives of the Project

The first objective of the proposed research project is to assess the impact that the correlation 

assumptions found in typical modern seismic PRAs have on the ultimate risk estimates 

calculated; and specifically to determine if they could lead to seriously incorrect insights. A 

second objective is to identify the data sources and analysis methods that could be developed 

to provide better correlation estimates. Finally, a third objective is to recommend how those 

data and methods can be developed, so that improved correlation analysis will become a 

standard part of seismic PRAs.

A.2.3 Objectives of the Workshop

The main objective of the Workshop was to advance the “second objective” above. Specifically, 

the Workshop was sponsored “to identify the data sources and analysis methods that could be 

developed to provide better correlation estimates.” In preparation for the Workshop, the project 

team studied both the existing seismic capacity (fragility) data bases and a group of typical 

seismic PRAs, in order to provide background information for the Workshop and to advance the 

overall project.

Attendance at the Workshop was by invitation only, and was limited to a small group of experts 

who were already familiar with the technical subject matter.
A-4

A.2.4 Summary of the Workshop Findings and Recommendations

The principal points raised during the Workshop are summarized as follows:

o There is a distinction between correlation and dependency. This was explored at length,

and the distinction made clear. This project’s scope and hence the Workshop’s scope

covers correlations but not dependency issues. [This did not mean that the discussion

didn’t wander over to issues of dependency of failures after an earthquake – it did, and

some of that discussion was useful. This was especially the case for the issue of the

failure of a structure that could affect the secondary failure of a piece of equipment

inside or dependent on that structure.]

o There was extensive discussion of the possible correlation of seismic-induced failures of

SSCs at multiple nuclear reactors co-located on a single site. It was agreed that in

principle this topic is covered by the scope, but in practice most of the attention will be

given to correlations among failures at a single reactor. However, many of the insights

to be gained will be applicable to the larger problem of correlations among co-located

reactors.

o Based on a presentation by M.K. Ravindra, and on some modest background provided

by R. Budnitz, the Workshop spent considerable time discussing how the current SPRAs

deal with correlation -- usually using the well-known rules-of-thumb that were first written

down by M. Bohn in the early 1980s based on NRC-sponsored research work under the

influential and extensive SSMRP (Seismic Safety Margins Research Program.) In most

SPRAs even today, analysts do not go beyond using those thumb rules.

o The discussion highlighted the observation that much of the concern about correlated

failures at nuclear plants involves distribution systems (electricity, piping, air, water,

cable trays, etc.) and more generally the support systems that support the front-line

safety systems and components. If there is some benefit to be gained from this project,

the consensus was that it is likely to be concentrated on correlations among these types

of failures – not exclusively, but likely to be concentrated.

o There was a broad consensus that one of the major targets of this work should be the

issue of correlated seismic-induced failures of the diesel-generators. (Actually, the

failures are usually not of the generators themselves but of supporting apparatus

necessary for the DGs to provide their function.) This consensus would have been true

even before the recent nuclear accident at Fukushima, but in light of that accident this

consensus has been reinforced.

o There was extensive discussion about the potential benefit of some targeted shake-table

tests, to overcome the need for using generic fragilities, and to help bolster our

understanding of where correlated failures are a potential problem. It was agreed that

one target for the work during the remainder of this project should be thinking about what

types of tests might be useful, and how. Providing a sound basis for any

recommendations for new tests could be an important outcome of this project.

o Based on the work so far by Dave Moore and Bob Budnitz, it was agreed that for some

reactors, as reflected in their Seismic PRAs, the SPRA analysis results can be quite

sensitive to the way the analyst treats correlations among the failures. For many PRAs,

the bottom-line core-damage frequency (CDF) numbers are not very sensitive to the
A-5

correlation issue, because the CDF is dominated by a “seismic singleton”, a single 

failure beyond seismic-induced loss of offsite power (LOSP). However, this is not 

universally true, and in any event many more insights are available from the SPRAs 

beyond the CDF results, and many of these insights are sensitive to the correlation 

assumptions in the analysis.

o General agreement emerged that the part of the SPRA analysis where the sensitivity to

the correlation assumptions is greatest is in the region of the seismic fragility curve

between about 5% and about 25% or 35% probability of failure. In this low end of the

fragility curve, whether 2 or more failures are correlated can make an important

difference, whereas at both the very low end and the higher region of the fragility curve,

there is usually less sensitivity to the correlation assumption.

o Seismic experience data: Based in part on a presentation by Greg Hardy, a broad

consensus emerged that these data are not particularly useful for this project’s purposes

except in a few targeted areas. This is because the experience data do not include

many data (either failures or successes) at the higher earthquake levels that are of most

interest in the SPRAs. Another reason is that the few data that are available are

typically very difficult to interpret. Examples of this were discussed at the Workshop and

this led to the general consensus as above.

o Seismic qualification tests: There is an extensive data base of qualification tests, and

the discussion examined the usefulness of this category of data. The broad consensus

was that there is rather little in the way of data about correlations among failures in this

literature, because of the way these tests were conducted and documented, including

the fact that much of the testing did not test an item up to shaking levels leading to

failure, and that often only a single item was tested. Hence, except for some very

narrowly focused test runs on a few subcomponents, there is little to be gained from

examining this data set in depth.

o The Workshop discussed the mathematical formalism used to analyze and quantify

correlations among failures, and agreed – in part, based on the presentation led by Rob

Sewell – that the formalism is adequate and useful. The issue is not the formalism but

the data available to support it.

o The Workshop discussed the observation that most of the computer codes in use today

for SPRA analysis and quantification are not as amenable to quantifying correlation

aspects of the seismic PRA as they could be. A research project to develop this tool and

to make it user-friendly might be helpful.

o There was a discussion of how SPRA treats the initiating event after the earthquake

(sometimes LOSP, or sometimes another failure), and whether this treatment accounts

appropriately for the correlation issue. It was agreed that it could be beneficial for this

project to examine this issue to determine whether any benefits could ensue from better

treatment of correlations among these types of failures.

o A very useful set of presentations by our Japanese colleagues (K. Ebisawa and S.

Hidaka) provided the starting point for a broad discussion of how seismic test data are

used, and for thinking about how more extensive testing could advance our

understanding of correlations among failures. The consensus was that the Japanese

test data base is by far the most useful in the world. It was agreed that whatever ideas
A-6

for new research will emerge from this project will be shared with our Japanese 

colleagues to help advance both Japanese and U.S. understanding, and to support 

further testing (if appropriate) either in Japan or in the U.S.

o Toward the end of the Workshop, K. Ebisawa gave a very informative presentation about

lessons-learned so far from the Fukushima nuclear reactor accident. An extensive set of

insights is being compiled both by the Japanese and by others, including a major review

under the IAEA that has just begun. The US NRC’s own review and lessons-earned

evaluations are in process now.
B-1

APPENDIX B

REPORT ON THE LBNL SEISMIC CORRELATIONS WORKSHOP

1 – 2 NOVEMBER 2012, NEWPORT BEACH, CA

B.1 Venue, Organizer, Attendees and Agenda

WORKSHOP VENUE:

Simpson, Gumpertz & Heger (SGH)

Attn: Gregory S. Hardy

4000 MacArthur Blvd., West Tower (K2), Suite 710

Newport Beach, CA 92660 

Telephone (213) 271-2000

Email: <gshardy@sgh.com

WORKSHOP ORGANIZER:

Robert J. Budnitz 

Lawrence Berkeley National Laboratory

University of California

Earth Sciences Division, Mail Stop 74R-0120

Berkeley CA 94720

Telephone (510) 486-7829

Email: <RJBudnitz@lbl.gov

WORKSHOP ATTENDEES: 

Project team

Robert J. Budnitz, LBNL (Berkeley CA)

Gregory S. Hardy, SGH (Newport Beach CA)

David L. Moore, consultant (Mercer Island WA)

Mayasandra K. Ravindra, consultant (Irvine CA)

NRC Staff

Annie Kammerer, US NRC (Rockville MD)

Nilesh Chokshi, US NRC (Rockville MD)

Robert Roche-Rivera, US NRC (Rockville MD)

Invited Experts

Robert P. Kennedy, RPK Structural Mechanics Consulting (Escondido CA)

Robert P. Campbell, consultant (Huntington Beach CA)

Kelvin Merz, SGH (Newport Beach CA)

Martin McCann, Jack Benjamin & Associates (Menlo Park CA)

Walter Djordjevic, Stevenson & Associates (Woburn MA)

James Johnson, J. J. Johnson & Associates (Alamo CA)
B-2

WORKSHOP AGENDA

(Approximate – there was a lot of discussion of various topics outside of the specific

agenda item under which they nominally fell.)

Thursday 1 November

1. Brief Introductions

for NRC – Annie Kammerer

for LBNL – Bob Budnitz 

logistics etc. – Greg Hardy

2. Project scope, purpose, background (Bob Budnitz)

Motivation for the project

Accomplishments so far

Insights from the June 2011 Workshop

How this Workshop will proceed

What we’re asking for

What we expect as an “outcome”

Process for gaining input from the Invited Experts

3. Review of the seismic PRA literature (Dave Moore)

Insights from the systems-analysis side

4. Treatment of seismic correlations in the literature (Ravi Ravindra)

Current industry seismic PRA practice

Available procedures and models

Introduction to the “split fraction” idea

5. The data base and why we believe it isn’t useful enough (Greg Hardy)

6. The “split fraction” approach (Bob Budnitz)

Why we selected it --- pros and cons

Definitions of “split fraction”, “contingent probability of failure”, “correlation”

7. Issue of variations in the “split fraction” vs. seismic load (PGA) and variations as a function of

other variables (Bob Budnitz)

What is at stake (Dave Moore)

Why there might be such variations (Ravi Ravindra, Greg Hardy)

8. How the input from the experts will be gathered and used (Bob Budnitz)

We will use a “SSHAC-like” approach

Friday 2 November

9. Substantive discussion and input from the experts – one SSC type at a time (Budnitz)

10. Return to major issues not yet discussed (Budnitz)

Correlation in response

Split fractions for 3 or 4 SSCs
B-3

B.2 Workshop Summary

B.2.1 Background About the Project

The project that sponsored this Workshop is entitled “Correlation of Seismic Performance in 

Similar Structures, Systems, and Components.” It is supported by the US Nuclear Regulatory 

Commission’s Office of Nuclear Regulatory Research, and is being carried out at the University 

of California’s Lawrence Berkeley National Laboratory. The Principal Investigator for the project 

is R. J. Budnitz (LBNL). The other main collaborators are D. L. Moore and M.K. Ravindra, 

assisted by G.S. Hardy. The NRC project manager is A. Kammerer.

Technical background and problem statement: When an earthquake occurs near a nuclear 

power plant site, it subjects all of the structures, systems and components (SSCs) within the 

plant to ground motion. Depending on the level of this ground motion, one or more failures of 

SSCs could occur. Seismic Probabilistic Risk Assessment (SPRA) requires an estimation of the 

possible correlations among seismic failures of similar components at different stages of the 

analysis. This correlation is a large area of uncertainty and the very simple (but clearly 

incorrect) assumption is usually made that component failures are either fully coupled or 

completely uncoupled, depending on the relative location of the SSC in the plant and on the 

type of SSC. In reality, the correlation depends on the location of the SSC (within and between 

buildings), the dynamic characteristics of the SSC, and several other factors. Moreover, the 

failure mechanisms of various SSCs could be quite different (e.g., saddle failure of a heat 

exchanger, shear failure of a shear wall of a building, anchorage failure of an electrical cabinet, 

deflection of a pump impeller etc.). Therefore, failures of different components can only be 

partially correlated at most. The impact of the simplifying assumptions currently made when 

performing SPRA to determine ultimate risk numbers is not currently known.

B.2.2 Objectives of the Project

The first objective of the proposed research project is to assess the impact that the correlation 

assumptions found in typical modern seismic PRAs have on the ultimate risk estimates 

calculated; and specifically to determine if they could lead to seriously incorrect insights. A 

second objective is to identify the data sources and analysis methods that could be developed 

to provide better correlation estimates. Finally, a third objective is to recommend how those 

data and methods can be developed, so that improved correlation analysis will become a 

standard part of seismic PRAs.

B.2.3 Objective of the Workshop

The main objective of the Workshop was to advance the “third objective” above. Specifically, 

the Workshop was sponsored to obtain the input, review, and advice of the several experts on a 

proposed new methodology for analyzing seismic correlations, and to benefit from their specific 

individual experience. 

Attendance at the Workshop was by invitation only, and was limited to a small group of experts 

who were already familiar with the technical subject matter.

B.2.4 Summary of the Workshop’s Discussions, Findings and Recommendations

The principal topics covered during the Workshop are summarized as follows:
B-4

o There was general agreement among the attendees that the project’s progress to date

comprises a strong basis for the development of an improved methodology for analyzing

correlation in seismic PRA.

o The discussion of the insights from the first Workshop (in June 2011) revealed that the

attendees continue to endorse the principal findings and recommendations from that

Workshop, as reported by the project team and as captured in the written Summary of

that Workshop.

o Dave Moore provided a summary of the project team’s review of the SPRA literature.

His review discussed the conclusion that 7 classes of SSCs comprise the principal

classes for which the SPRA “correlation assumption” made using M. Bohn’s standard

thumb-rules could “make a difference” if a different methodology were used. Here the

words “make a difference” is taken to mean “make a difference to the SPRA’s bottomline results or the safety insights derived from the analysis.”

o Ravi Ravindra reviewed the technical literature on correlation, which includes the

important early work in the NRC-sponsored SSMRP program, M. Bohn’s development of

the “thumb rules,” several journal papers, and various reports by experts. There was

broad agreement that the mathematical formalism for dealing with correlations in SPRA

exists, is well developed (in several different but equivalent formalisms), and can be

relied upon. There was also a general consensus that the mathematical formalisms now

in the literature are generally clumsy and difficult to use.

o Greg Hardy made a presentation covering why the existing shake-table test data base

and earthquake-experience data base cannot by themselves be used as the basis for

determining correlation numbers. The attendees all agreed with this conclusion, which

had also been a principal finding of the first Workshop a year earlier.

o Bob Budnitz discussed a proposed approach called the “split faction” approach, and its

pros and cons. There was a lot of discussion about how confusing this approach might

be when an analyst is faced with developing a split fraction that varies across the fragility

curve as a function of the seismic load. Because what we are after is fundamentally a

“conditional probability of failure” of an SSC given the seismic-caused failure of another

one, the consensus emerged that one ought to try to deal with that concept directly ----

and therefore we ought to work with how fragilities are developed using the standard

method(s).

o Dave Moore led a discussion in which he pointed out that the way SPRA systems

analysts quantify a seismic PRA can readily accept a “split fraction” and use it in the

analysis without a problem. A systems analyst can also readily accept and use a

“fragility curve” that embeds correlation within it – for example, a fragility curve in which

the ordinate (probability of “failure”) represents the undesired conditional failure of, say,

both SSCs under consideration, vs. a different fragility curve representing, say, the

failure of only one out of two.

o This led to was extensive discussion of a correlation method first proposed by M.

McCann and J. Reed, that uses the traditional “separation of variables” method for

analyzing the fragility of an SSC, and that assigns correlation numbers to constituent

aspects of the various “variables” in the fragility analysis. A consensus emerged that
B-5

this approach could be an excellent basis for deriving correlation numbers that could 

vary across the fragility curve as a function of seismic load, which was something that 

the experts (and the project team) believed was necessary.

o A major part of the workshop discussions on the afternoon of the first day covered the

above topic. There was a struggle among the attendees (including both the project team

and the invited experts) to gain a common understanding, in part because of the need

for a precise definition of each of the various terms and words used. This discussion

was extremely important and useful, because it revealed how much difference exists in

the way ordinary working engineers might interpret the words used to explain the

approach being recommended. It led everyone to agree about the need for a carefully

crafted explanation.

o In the end, the attendees tentatively settled on recommending an approach for

correlation analysis that is a variant of that proposed earlier by McCann and Reed.

Specifically (but briefly here), the approach would begin with the traditional “separation

of variables” method for developing a fragility. Let us consider developing the joint

fragility for the failure of two identical SSCs, and also the fragility for, say, the failure of

one out of two. The approach begins by noting that for each of the various “variables”,

the analyst must determine a median value and beta-c (better, both beta-r and beta-u).

For each of these variables, there is a technical basis for assigning either full correlation

or zero correlation. It is these assignments that provide the fundamental underpinning of

the new methodology. The various assignments can then be combined arithmetically to

produce a composite correlation for the overall problem. The attendees debated the

efficacy of this approach, and broadly agreed that it seems likely both to be correct and

to be useful in the hands of an SPRA analyst.

o The project team was then left with the challenge of writing down this approach in a way

that analysts could understand and use.

o The Workshop’s first day ended with a broad endorsement of the above.

o Finally, it was agreed that the major challenge facing the project team in the coming

period is to develop a report that explains all of the above well.

B.2.5 The Workshop Discussions on the Second Day About Seven Casses of SSCs

The second day (actually, only a half day) was entirely devoted to an extended discussion of 

correlation for the 7 most important classes of SSCs. The extensive notes below capture this 

discussion.

Background: The project team had identified 7 classes of SSCs for which the approach to 

analyzing correlation can make an important difference to the results of a typical SPRA. The 

agenda for the Workshop’s second day consisted of a discussion during which the 6 invited 

experts were asked to provide their individual and collective assessments about how the 

proposed new analysis methodology might apply to each of the 7 classes of SSCs.

The seven classes of SSCs are:

A. Large tanks: condensate storage tanks or other similar tanks

B. Electrical: motor control centers
B-6

C. Mechanical: long shafted service-water pumps, horizontal aux feedwater pumps (motor

and turbine driven)

D. Batteries and racks

E. Masonry walls

F. Small tanks: diesel generator fuel oil day tanks

G. Heat exchangers, such as component cooling water heat exchangers

The emphasis in these Workshop discussions was on seismic capacity or fragility correlation, 

rather than on seismic response correlation, although some discussion of the latter occurred 

also.

For each of these seven classes, the experts were asked to do the following:

• to discuss any issues for that class of SSCs that would affect the seismic correlation

analysis methodology recommended herein;

• to opine or provide perspectives on what the likely results would be for the correlation

analysis recommended herein, for that class of SSCs; and

• to explore whether there was a broad consensus among the 6 experts on the above

topics, or whether any differences of view existed, and if so why; the insights gained

would be useful either way.

It turned out that the discussion of the 7 specific SSC classes provided a strong basis for 

confidence that the new correlation methodology shows promise of being useful. As is typical of 

such discussions, specific details and the views and experiences of the experts on those details 

helped to “flesh out” what would otherwise have been more abstract methodological 

discussions. 

The notes below are an attempt to capture the thrust of these discussions at the Workshop. 

The notes are not complete, nor could they be, but the project team believes that they should 

provide useful information and some important perspectives on the broad problem of working 

out seismic correlations for use in SPRA.

B.2.6 Notes on the Workshop Discussions for the Seven Classes of SSCs

B.2.6.1 Large tanks: condensate storage tanks or other similar tanks

The case discussed was for two identical large tanks, adjacent to each other or nearly so. 

Typically, these tanks are located outdoors, so-called “yard tanks.”

The observations made during the discussion were as follows:

o The failure mode is the inability of the tank to retain its contents (water.)

o These tanks are usually fabricated in the field. Field fabrication leads to differences in

detail for seemingly identical tanks. Among these differences are small but important

differences in out-of-roundness, which differences can have an important effect on the

seismic fragility.
B-7

o The fragility of these tanks is usually developed by analysis, supported by test and

earthquake-experience data for the failures of the anchorages.

o We usually assume that a broken support bolt leads to failure, although this is almost

always conservative.

o We also usually assume that important buckling, such as elephant-foot buckling, leads to

failure.

o There are typically differences (variations) in how the bolts are emplaced, especially

below the grout pad, that can affect the seismic capacity.

o The tanks are most sensitive in the range 5 to 8 hertz, in which region there is not much

ground motion incoherency.

o The forces leading to failure are typically impulsive horizontal forces.

o Because of the differences from tank to tank due to field fabrication, there is not likely to

be large correlation in the seismic capacities of the seemingly similar tanks under

consideration.

o The experts opined that the “split fraction” is likely to be 0.1 to 0.3 at the lower end of the

fragility curve (say, from the HCLPF point to the median point.) [One expert disagreed,

thinking that the split fraction might be as high as 0.5 to 0.7 at the lower end.] Near the

median point, the split fraction is likely to be around 0.5. At the high end of the fragility

curve, more correlation could be expected but it doesn’t matter much to the SPRA

results. NOTE: The discussion used the term “split fraction,” but the parameter being

discussed, for two identical co-located large tanks, was actually the conditional

probability of the second SSC failing given that the first one has failed.

o One expert opined that it is easier to develop a βc using the “separation of variables”

method, but developing the separate βr and βu values would be more difficult. None of

the other experts contradicted this view. This point is not directly relevant to the

correlation issue per se, but is relevant to the use of the “separation of variables”

method.

B.2.6.2 Electric motor control centers

The case discussed was for two supposedly identical MCCs, adjacent to each other or nearly 

so. Typically, these MCCs are located in the turbine building, the auxiliary building, or another 

building that houses equipment. It was observed that in a typical SPRA analysis, there would 

be a large number of MCCs (5 or 10 might be typical), often in pairs controlling two identical 

trains of equipment. The discussion here centered on the issue of two MCCs.

The observations made during the discussion were as follows:

o The failure mode is a functional failure, often due to the failure of auxiliary contacts.

Rattle is a typical effect of the earthquake motion.
B-8

o The seismic fragility of these MCCs is usually developed based on the test data base,

but with analysis of the anchorages as a major component of the analysis. The

anchorage failures themselves rely to a major degree on test data.

o The experts opined that the failure modes of identical co-located MCCs are likely to be

highly correlated, and hence the fragilities will be also.

o For MCCs not closely co-located, it was observed that the demands will be different, and

the experts noted that this would reduce the overall correlation a good deal.

o It was noted that the βu value for MCCs is typically quite high, because the information

used by the analysts to develop the fragilities using separation of variables relies on an

older data base that includes a very diverse group of MCCs. More modern MCCs might

not fit exactly into this data base, which would increase the βu even more.

o One expert opined that the split fraction near the HCLPF point is likely to be high, around

0.7 or so, and above that higher still, namely around 0.9 near and above the median.

The other experts agreed. NOTE: As noted above under “Tanks”, the discussion used

the term “split fraction,” but the parameter being discussed, for two identical co-located

MCCs, was actually the conditional probability of the second SSC failing given that the

first one has failed.

o It was observed that there is an opportunity to improve the fragility calculation itself by

digging into the data base to reduce βu by taking advantage of lower βu values for a

specific sample of similar MCCs (such as MCCs from the same manufacturer and

vintage, which is likely the case at our existing NPP plants for identical co-located

MCCs.) However, this data base has not yet been studied. Such a study could help to

support a more accurate calculation of the seismic correlations in MCC capacity.

B.2.6.3 Mechanical: long shafted service-water pumps, horizontal auxilary feedwater pumps

(motor and turbine driven)

The case discussed in detail was for two long-vertical-shaft service water pumps, adjacent to 

each other or nearly so. Typically, these pumps are located in their own small building, but are 

sometimes in another building co-located with other equipment. Also, the typical configuration 

is to have 4 or even 6 such pumps adjacent to each other. It was observed that in a typical 

SPRA analysis, there would be a large number of these often in pairs servicing identical trains 

of equipment. The discussion here centered on the issue of two such pumps.

The observations made during the discussion were as follows:

o The failure mode is typically that the earthquake causes the bearings to get out of line.

This causes a functional failure. A very small amount of misalignment is typically called

“failure,” which could be conservative, but analysts cannot usually defend any other

approach.

o The opinion of the experts was that the correlation in fragility is likely to be very high for

this case, even at the low end of the fragility curve. This is due to a generally high

correlation in the failure mode. These pumps are a manufactured item with quite good

tolerances, and the word ”identical” is likely to be more applicable in these cases than in

some other categories of SSCs.
B-9

o For similar pumps not co-located, the opinion of the experts was that correlation would

be substantially reduced.

o There was no detailed discussion about horizontal-shaft pumps such as auxiliary

feedwater pumps. However, it was noted that the general considerations noted for

vertical-shaft service water pumps are likely to apply, although the former pumps are

typically larger.

B.2.6.4 Batteries and racks

The case discussed was for the large station battery installations, typically meaning a “battery 

rack” comprised of dozens of individual batteries ganged together electrically in series, in a 

room that contains no other equipment. The seismic failure is usually analyzed as an all-ornothing failure of the entire “rack”, not the failure of an individual battery in the rack. The issue 

of correlation under discussion was the failure of two “identical” battery racks, in nearby rooms. 

The observations made during the discussion were as follows:

o The failure mode is usually a structural failure of the frame holding the batteries in place,

which causes enough displacement of individual batteries that the electrical (ganged)

connection is lost.

o These batteries are of course factory-fabricated, but the installation into a ganged “rack”

is always done in the field. The experts observed that field fabrication can lead to

important differences in detail for seemingly identical installations.

o The Workshop experts observed that the extent of correlation in the failure depends on

the type of installation. For the structural failure of the frame, a very high correlation is

expected. For anchorage, high correlation is expected for cast-in-place anchorage and

for welded-to-embedment anchorage, but for expansion anchorage the correlation would

be somewhat less, perhaps considerably less.

o The batteries themselves can often be quite rugged. There was a difference of view

about the extent of correlation: some of the experts opined that the correlation in the

failures of the batteries themselves should be very high, while others opined otherwise.

Discussion did not resolve this difference of view.

o It was observed that sometimes seemingly identical battery rooms can be located a

great distance part, at opposite sides of the nuclear plant, sometimes more than 100

meters apart where the seismic demand could be different.

o Diesel-generator batteries: The experts also briefly discussed a quite different “battery”

issue, namely the seismic ruggedness of the batteries used to start the diesel

generators. The failure mode is usually the inadequate restraint of some of these

batteries. Where this is the case, the experts noted that there is likely to be very weak if

any correlation in the failures of similar diesel-generator batteries in adjacent bays or

buildings.
B-10

B.2.6.5 Masonry walls

The case discussed was for two identical masonry walls located near each other. Typically, the 

walls at issue are interior walls within a larger building, used to separate areas from each other 

or used to provide support to equipment or distribution systems such as piping and cabling.

The observations made during the discussion were as follows:

o These walls are invariably fabricated in the field. Field fabrication leads to differences in

detail among what ought otherwise to be “identical” walls. This is due to differences in

the placement of the reinforcing bar, the strength or the detailed installation of the

mortar, and the differences in support of the wall, either base support or support at the

top or part-way up.

o There are two different failure modes at issue. First is the masonry wall’s failing to carry

the load of something mounted on the wall or supported by it. The second is the failure

of the masonry wall itself, so that the wall falls on an item of equipment or the wall

causes structural damage to another structural element. It was observed by the experts

that this latter failure of the wall itself is usually modeled as a failure at about half height,

with the upper half losing its integrity and failing or falling.

o The experts opined that for identical items mounted on identical co-located masonry

walls, the failure due to loss of mounting capability is likely to be very highly correlated,

even at the low end of the fragility curve.

o However, when the failure mode is damage to an item of equipment because the

masonry wall falls on it, the experts opined that there is likely to be rather little in the way

of correlation among such failures.

B.2.6.6 Small tanks: diesel-generator fuel-oil day tanks

The case discussed was for two identical diesel-generator fuel-oil day tanks in nearby bays, 

each supporting a different diesel generator. 

The observations made during the discussion were as follows:

o These are typically tanks manufactured in a factory and then mounted in the field.

o The experts noted that the failure mode is structural, and is well understood.

o The experts opined that the seismic fragilities of similar tanks located near each other

are likely to be very highly correlated.

o Fuel line failure: A common failure mode identified in SPRAs is the failure of the fuel line

that runs from the tank to the diesel-generator engine, due to motion of the tank. This

failure mode is likely to be poorly correlated for two diesel generators even if co-located

nearby.
B-11

B.2.6.7 Heat exchangers, such as component cooling water heat exchangers

The case discussed was for two component cooling water heat exchangers located close to 

each other, each supporting a different train.

The observations made during the discussion were as follows:

o These are typically large horizontal tanks manufactured in a factory and then mounted in

the field, with heat-exchanger apparatus (tubes, supports, etc.) mounted inside the

tanks.

o The experts noted that the failure mode is usually anchorage rather than a structural

failure of the tank. If this is the governing failure mode, and if the installation details are

similar, the correlation is likely to be very high for adjacent heat exchangers.

o The experts opined that different seismic capacities can arise from different installation

configurations, which would lead to different demands and therefore to rather small

correlation in the seismic capacity.

o This latter observation led the experts to note that if the installation details are sufficiently

different, it behooves the analyst to analyze the heat exchangers separately, because

the configurations can lead to different capacities and almost surely in that case to very

low correlation.

o The experts opined that if installation details are similar and the failure mode is the outer

tank’s structure itself, the seismic fragilities of similar heat exchangers located near each

other are likely to be very highly correlated.

C-1

APPENDIX C

SELECTED MODELS TO TREAT SEISMIC CORRELATION

BY M. K. RAVINDRA (20 OCTOBER 2012)

C.1 Introduction

Based on the discussion at several of the project meetings, we have narrowed down the 

correlation or dependency problem as mainly between redundant identical components located 

close to each other. For this situation, the model first developed in SSMRP and later simplified 

by M. Bohn and the JAERI researchers does not provide any solution. The industry practice of 

“one fails-all fail” appears to be easily defended provided the seismic risk is not significantly 

impacted by these correlated failures. For a more realistic estimation of the joint failure 

probability of two or more correlated components, two models are proposed. Model A is based 

on the paper by T. Mankamo, “Common Load Model: A Tool for Common Cause Failure 

Analysis”. Model B is based on the concept that the seismic response of the equipment is 

random for a given floor motion and the seismic capacity is also random; therefore, the seismic 

failures of identical and redundant components located close to each other are not fully 

dependent.

C.2 The Various Models

C.2.1 Model A (Mankano)

The bounds on joint failure probability of two events A and B are given by

P[A]. P[B] < P[AB] < min {P[A], P[B]}

Since these bounds could be very large, the logarithmic median of the bounds is frequently 

used as a reasonable approximation:

P[AB] = (P[A]. P[B]. min{P[A], P[B]})1/2

In the case of two identical items, P =P[A] =P[B], this reduces to 

P[AB] = P1.5

This approximation was used to estimate the seismic risk in the Reactor Safety Study (WASH 

1400).

The power 1 would represent the case of totally dependent failures whereas the power 2 would 

represent the totally independent failures. Mankamo has derived an expression of probability of 

failure of multiple redundant components in terms of a single failure probability. Table C.1 from 

his paper shows the power nk as a function of P1 and loading roughness ρ (i.e., the ratio of 

coefficient of variation of load to that of resistance). For large values of ρ, nk approaches 1, 

which means that the failures are highly dependent. This is a reasonable result, as the large 

variation in the common load of redundant components, compared with the variation of 

structural resistance, will mean that the components tend to fail simultaneously. When ρ is near 

zero, i.e., the loading roughness is small, nk approaches K. This is also reasonable because for 

small variations in load variation compared with the variation in resistance, the parallel loaded 

components tend to fail quite independently of each other.
C-2

Using the Mankano model, the sensitivity of the component failure frequency for different

assumptions of the loading roughness factor is studied. The seismic fragility of the component

is expressed in terms of median ground acceleration capacity of 1.27g with the composite βc of

0.4; the HCLPF capacity is 0.5. The cutsets considered are two components failing

concurrently, three components failing concurrently and four components failing concurrently. A

representative seismic hazard curve for Site 1 is used in the calculation of cutset failure 

frequency.

In Table C.2, the cutset frequencies (per year) are shown for different assumptions: the 

components are fully correlated, fully uncorrelated and load roughness factors of 0.9 and 0.8.

Table C- 1 Power nK as a Function of P1 and ρRS or the Loading Roughness δS/δR

ρRS δS/δR P1 = 10-1 P1 = 10-3 P1 = 10-5

P2 0.1 1 / 3 1.88 1.85 1.84

0.2 1 / 2 1.78 1.73 1.71

0.5 1 1.49 1.42 1.40

0.8 2 1.25 1.19 1.18

0.9 3 1.16 1.12 1.10

P3 0.1 1 / 3 2.65 2.58 2.56

0.2 1 / 2 2.38 2.28 2.24

0.5 1 1.81 1.67 1.63

0.8 2 1.39 1.29 1.26

0.9 3 1.25 1.18 1.15

P4 0.1 1 / 3 3.35 3.23 3.19

0.2 1 / 2 2.89 2.77 2.66

0.5 1 2.04 1.85 1.79

0.8 2 1.48 1.35 1.32

0.9 3 1.30 1.22 1.18
C-3

Table C- 2 Sensitivity of Cutset Frequency (per year) to Load Roughness Factor 

 (ratio = Ratio to Fully Dependent case)

Cutset 

size

Fully 

Dependent

Load Roughness 

factor = 0.9

Load 

Roughness 

factor = 0.8

Fully 

Independent

2 

ratio

4.34 E-8 

3.39

3.87 E-8 

3.02

2.97 E-8 

2.32

1.28 E-8 

1.00

3 

ratio

4.34 E-8 

6.09

2.42 E-8 

3.39

2.10 E-8 

2.95

7.13 E-9 

1.00

4 

ratio

4.34 E-8 

8.84

2.79 E-8 

6.68

2.29 E-8 

4.66

4.91 E-9 

1.00

The cutset fragility is calculated for each of these assumptions and convolved with the seismic 

hazard curve for the site to obtain the cutset frequency per year. The ratio of the cutset 

frequency for a particular assumption of dependence to the cutset frequency when the 

components are assumed to be fully independent is also shown in this table. It is observed that 

the ratio of cutset frequency for the cases of fully dependent to fully independent failures could 

be as much as 8.84 for the cut-set of size 4. This ratio would reduce to 4.66 for an assumed 

load roughness factor of 0.8. The obvious questions are: a) is this decrease in the cutset 

frequency (from the fully correlated case to partially correlated case) significant, and b) what is 

the proper assignment of the load roughness factor? Further, there will be many accident 

sequences containing numerous cutsets of different sizes; the ones of particular interest to our 

study form only a small subset. Therefore, the significance of assumption of dependence 

should be assessed in the overall seismic risk quantification context. 

In an EPRI study (Ref. 2), the following measure of sensitivity was used:

Effect on CDF Significance

Factor < 0.1 Major

0.1< Factor < 2 Minor

2 < Factor < 10 Moderate

Factor > 10 Major

where Factor = CDF for Revised Model / CDF for Base Case.

The applicability of this measure of sensitivity today (after more than 25 years of PRA practice) 

needs to be reexamined.

C.2.2 Model B

Model B is based on the concept that the seismic response of the equipment is random for a 

given floor motion and the seismic capacity is also random; therefore, seismic failures of 

identical and redundant components even located close to each other are not fully dependent. 
C-4

The three elements of seismic fragility analysis are: 1) structural response, 2) equipment 

response and 3) equipment capacity. Since the redundant components of our interest are 

located close to each other, we judge that they will see the same structural response. The 

seismic response of the identical redundant equipment is calculated using the same model; 

hence the equipment response is dependent. The fact that the dynamic properties of these 

equipment are generally the same makes equipment response to be even highly dependent. 

However, there is some randomness associated with the equipment response which precludes 

the possibility of perfect dependence between the equipment responses of identical redundant 

components. Similarly, we can expect some randomness in the equipment capacity although 

the components are nominally identical (their failure modes are identical). In Model B, we keep 

the variables that are common to the redundant components with respect to their fragility 

calculation as the same and the other variables are treated as random and uncorrelated. Let’s 

continue with the example component fragility used in Model A: Median ground acceleration 

capacity of 1.27g and βc of 0.4. We estimate that the variables that are fully dependent between 

the components pertain to the structural response: most variables that comprise the equipment 

response factor and most variables that comprise the equipment capacity. The factors that are 

independent between redundant components are identified in the following equation for 

component ground acceleration capacity:

A = FRS * FER1* FER2 * FCE1* FCE2 * SSE 

where 

FRS = structural response factor

FER1 and FER2 = equipment response factor for component 1 and 2 respectively

FCE1 and FCE2 = equipment capacity factor for component 1 and 2 respectively

SSE = safe shutdown earthquake peak ground acceleration.

Here, we treat the terms FER2 and FCE2 as uncorrelated between the redundant components.

We estimate the median and logarithmic standard deviation of these factors as follows:

X = Median FRS*FER1*FCE1*SSE = 1.19g

βX = 0.357

Median FER2 = 1.02

βER2 = 0.10

Median FEC2 = 1.05

βEC2 = 0.15

The cutset containing two redundant components is quantified as follows:

Fragility of cutset = Φ [ln(A/X)/βX] {Φ [ln(1/1.02)/0.10] Φ [ln(1/1.05)/0.15]}2

where Φ[.] is the cumulative normal probability distribution function.

Note that the square in the last term is to account for uncorrelated randomness between the 

components relating to the safety factors FER2 and FCE2. If there are three identical redundant 

components in the cutset, the last term will have the power (i.e., exponent) of 3.

If we accept this model, the procedure for seismic quantification would be:
C-5

1. For all components modeled in the PRA, estimate the median and β of the ground

acceleration capacity.

2. For redundant components, the fragility analyst should provide estimates of median

factor and βR for portion of equipment response and equipment capacity that are to be

modeled as uncorrelated. The median and β of the correlated portion of the equipment

fragility could be calculated from the median and β in Step 1.

3. The quantification of cutsets containing the redundant components is as illustrated

above.

4. For the remaining components, the seismic quantification is done assuming the

components in the cutsets are uncorrelated.

The theory behind this model B is to identify the common variables and independent variables

that make up the fragility calculation. This has also been recognized by Reed et al. (1985) and

their procedure is assessed to be more complete since it can treat the randomness (aleatory)

and uncertainty (epistemic) in the fragility estimates. Therefore, model B is not pursued further. 

Table C- 3 Variation of Cutset Frequency (per year) for Model B Ratio = Fully 

 Correlated / Uncorrelated 

Cutset size Fully Correlated Uncorrelated Ratio

2 7.10 E-9 1.11 E-9 6.6

3 7.10 E-9 1.75 E-10 40

4 7.10 E-9 2.75 E-11 258

C.2.3 Other models

These are:

• Assigned conditional probability

• Reed et al. (1985) Procedure (also called Reed and McCann Procedure)

• Split Fraction Method

C.3 Example of two tanks

In the following we will apply the different models for treating correlation to an example of two 

identical tanks ground mounted located next to each other. Assume that failure of both these 

tanks is a significant cutset. The fragility parameters for these tanks are

Median ground acceleration capacity Am = 0.70g
C-6

βR = 0.20

βU = 0.30

βc = 0.36

HCLPF Capacity = 0.31g

The mean seismic hazard curve from Surry seismic PRA (Reference 3) is used for illustration. 

The annual failure frequency of this cutset is calculated using the following models:

1. Fully Independent: In practice, it is rare to find two identical tanks. The PRA analyst

usually treats the two tanks as fully independent since there are differences in size,

anchorage design and failure modes.

2. Fully Dependent : This is an extreme case where the tanks are identical and have the

same failure modes

3. Mankamo model

4. Assigned conditional probability of Tank 2 failing given Tank 1 has failed; this

assignment is based on the analyst’s judgment that the conditional probability is low at

smaller ground acceleration. Note that a variation of this model is the use of “split

fraction” approach to be discussed at the November 2012 Workshop.

5. Reed and McCann procedure

6. Split Fraction method

The annual failure frequency for the joint failure of two tanks calculated using the above models

is shown in Table C.4. It is seen that the failure frequency varies over a rather narrow range.

Even difference between the upper and lower bounds (zero correlation and 100% correlation) is

only a factor of 2.3. This is not drastic compared to the impact of loss of redundancy in internal

event PRA if common cause is not properly modeled. Certain assumptions will have to be 

made in the use of the three procedures (3, 4 and 5). As no empirical data on failures of

multiple redundant identical components exist, the analyst judgment is needed.

The SSMRP methodology could be easily applied today because the computational tools and 

hardware exist. The response correlation between components at different locations could be

calculated using the probabilistic seismic response analysis method. Alternatively the thumb

rules developed by M. Bohn (Bohn and Lambright, 1990) could be used to assign the correlation

coefficients between seismic responses. Of course, these approaches lead to 100% response 

correlation when the components are located next to each other. The correlation between 

seismic capacities (“fragilities”) was treated as zero in the SSMRP since no empirical data 

existed. Our searches for such empirical data (in 1991 and today) have not been successful.

Therefore, the need for expert opinion on the correlation (more so on the capacity aspect) is

needed. 
C-7

Model Mean frequency per year

Fully Independent 1.61 E-6 

Fully Dependent 3.77 E-6 

Mankamo Model 3.16 E-6 

Assigned Conditional Probability 2.71 E-6 

Reed and McCann Procedure 1.89 E-6 

Split Fraction Method (SF = 0.8) 3.34 E-6 

Split Fraction Method (SF = 0.5) 2.69 E-6 

Split Fraction Method (SF = 0.2) 2.04 E-6 

C.4 References

Bohn, M.P., and J.A. Lambright, "Procedures for the External Event Core Damage Frequency 

Analyses for NUREG-1150," NUREG/CR-4840, SAND88-3102, Sandia National Laboratories, 

Albuquerque, NM (1990)

Electric Power Research Institute, “Surry Seismic Probabilistic Risk Assessment Pilot Plant

Review,” EPRI – 1020756, Final Report (July 2010)

Mankamo, T., “Common Load Model: A Tool for Common Cause Failure Analysis”, Electrical 

Engineering Laboratory, Report 31, Technical Research Centre of Finland, Epsoo (December 

1977)

Ravindra, M.K., H. Banon, R.H. Sues, and R.D. Thrasher, “Sensitivity Studies of Seismic Risk

Models”, EPRI NP-3562, Project 2170-5, Final Report (June 1984)

Reed, J.W., M.W. McCann, J. Iihara, and H. Hadidi-Tamjed, "Analytical Techniques for

Performing Probabilistic Seismic Risk Assessment of Nuclear Power Plants", ICOSSAR '85, 4th

International Conference on Structural Safety and Reliability, Kobe, Japan, May 1985, Volume

III, pp. 253-261 (1985) 

U.S. Nuclear Regulatory Commission, “Reactor Safety Study”, Report WASH-1400 (1975)

Table C- 4 Appendix C-1 Results of Different Models for the Two-Tank Example

D-1

APPENDIX D

SAMPLE CALCULATIONS

Please download the sample calculations from the NRC public web site with the NUREG/CR 

reports for the entry to this report.

This material consists of one PDF file (117 pages in length) and 14 MATHCAD files. The file 

names are:

PDF File: 

• PDF of Calculations.pdf

Fourteen MATHCAD files:

• Validation with Published Reference – Example of Union Components.xmcd

• Uncertainty Analysis.xmcd

• Validation of LHS Method with Multiple Integration Method.xmcd

• Validation with Published Reference – Example of intersection of Components.xmcd

• Functions defined.xmcd

• Functions defined_b.xmcd

• MC sampling.xmcd

• Three Components Case 1, Identical and Redundant components Side by side.xmcd

• Three Components Case 2, Identical and Redundant components on Different Floors.xmcd

• Three Components Case 3, Different and Redundant components Side by side.xmcd

• Three Components Case 4, Different and Redundant components on Different Floors.xmcd

• Three Components Case 5, Union of Different Components.xmcd

• Three Components Case 6, Union of Identical Components Side by Side.xmcd

• Example of 2 out of 4 Success Criteria.xmcd

December

1 2 3 4

2Simpson Gumpertz & Heger,

4695 MacArthur Court,

Newport Beach CA 92660 

3David L. Moore Consulting,

9721 SE 43rd Street,

Mercer Island WA 98040

4MK Ravindra Consulting,

15 Fortuna West,

Irvine CA 93620

1 Energy Geosciences Division

Lawrence Berkeley National Laboratory

University of California, Berkeley CA 94720

Seismic Probabilistic Risk Assessment

Seismic Fragility Functions

 Dependency of Seismic Performance

Correlation of Seismic Performance 

Seismic Qualification and Fragility Data

Random Uncertainties

Epistemic Uncertainties



NUREG/CR-7237 Correlation of Seismic Performance in Similar SSCs (Structures, Systems, 

and Components) 

December 2017