# Using Safety Margins for a German Seismic PRA

Authors: Ralf Obenland; Theodor Bloem; Wolfgang Tietsch; Jang-Bahadur Singh
Journal: Science and Technology of Nuclear Installations
 (2008)

---

## Abstract

The German regulatory guide demands the performance of a probabilistic risk assessment (PRA) including external events. In 2005, a new methodology guideline (Methodenband)  based on the current state of science and technology was released to provide the analyst with a set of suitable tools and methodologies for the analysis of all PRA events. In the case of earthquake, a multilevel verification procedure is suggested. The verification procedure which has to be used depends on the seismic risk at the site of the plant. For sites in areas with low seismic activity no analysis or only a reduced analysis is proposed. This paper describes the evaluation of safety margins of buildings, structures, components and systems for plants at sites with high seismic risk, corresponding to the German methodology guideline. The seismic PRA results in an estimation of core damage frequencies caused by earthquakes. Additionally, the described approach can also be adapted for the usage in a reduced analysis for sites with lower earthquake risks. Westinghouse has wide experience in performing seismic PRA for both BWR as well as PWR plants. Westinghouse uses the documented set of seismic design analyses dating from construction phase and from later updates, if done, as a basis for a seismic PRA, which means that usually no costly new structural mechanics calculations have to be performed.


---

## Body

## 1. Verification Procedure of the German Methodology Guideline

In the case of earthquakes, a multilevel verification procedure is suggested in the new German methodology guideline (Methodenband) [1] which requires a probabilistic analysis only for those nuclear power
plants with an earthquake intensity IDBE(MSK)>6
on the site (DBE: Design Basis
Earthquake, MSK: Medvedev-Sponheuer-Karnik-Scale,
comparable with the European macroseismic scale (EMS)). For
earthquake intensities IDBE between 6 and 7, a reduced analysis is
possible by demonstrating sufficient safety margins to carry loads of an
earthquake with an intensity of I=IDBE+1.
For earthquake intensities IDBE above 7 a full scope analysis
evaluating seismic fragilities for buildings, structures, mechanical, and electrical
components is mandatory.


## 2. Seismic Hazard Analysis

Basis for a seismic PRA is a probabilistic
seismic hazard analysis
(PSHA) for the site estimating the
frequencies for earthquakes to exceed a certain intensity as shown in Figure1. In the
PRA, the annual probability of exceedance for earthquakes will be used as
initial values for the initiating events in addition to the seismic failure
probabilities of buildings, structures, and components to estimate core damage
frequencies in different intensity intervals.Figure 1
Hazard curve of
seismic risk at plant-site.While the annual probability of exceedance is given as a function of the
earthquake intensityI, the horizontal peak ground acceleration of the design
basis earthquake is used as basis for the existing stress calculations for
structures and components. Therefore, a mapping associating peak ground
acceleration with intensity as in Figure 2
has to be established. Figure 2 shows
pairs of variates for some German plants according to the German methodology
guideline. This guideline suggests also a doubling of the peak ground
acceleration with each step in intensity, also known as Cancani correlation,
with respect to the design basis earthquake at the site of the plant. The
Cancani approximation can be improved by the usage of site specific response
spectra for different annual probabilities of earthquakes and for different
intensities, respectively. Site specific response spectra have been estimated
for
different sites in Germany. Calculation of site specific response spectra
results for example in lower peak ground acceleration values as a function of
the earthquake intensity. Typically, commonly used standardized response
spectra were applied for earthquake calculations during the construction phase
of a plant. As Figure 2 shows,
the estimation of site specific response spectra can provide quite large safety
margins in a seismic PRA.Figure 2
Classification of earthquake
intensity to peak ground acceleration according to Cancani. Site
specific spectra provide a higher level of accuracy and a possibility for
improvements.


## 3. Identifying the Plant Specific Scope of the Analysis

To perform a seismic PRA, it has to be identified which plant specific
beyond design-basis accidents, which lead directly to core damage sequences,
and which design-basis accidents can be initiated by an earthquake. Therefore,
all buildings, structures, and components have to be identified whose seismic-induced
failure could lead to such accidents. Furthermore, it has to be identified
which are the seismic relevant buildings, structures, and components of the
corresponding safety systems needed to cope the design-basis accidents.
Examples of beyond design-basis accidents are a collapse of the reactor
building, breakdown of the reactor pressure vessel, and failure of all primary
piping as well as a structural failure or loss of the integrity of the cooling
system circuit of the fuel storage pool. As design-basis accidents loss of
offsite power, loss of main heat sink and main feed water, loss of coolant
accident (LOCAs) and an interaction with flooding of safety related systems
have to be considered.For the identified structures and components a screening procedure
supported by plant walkdowns is employed to reduce the amount of detailed
investigation based on the calculation of safety factors and the estimation of
fragility curves.


## 4. Assumptions to Simplify the Analysis

To reduce the scope of the analysis some conservative assumptions can be
made. Above earthquake intensity 6, for which the analysis is done, a loss of
offsite power is directly assumed which also covers a loss of main heat sink
and main feed water, so that the amount of structures and components to be
investigated is significantly reduced by those structures and components whose
seismic-induced failure can initiate such a transient. Furthermore, a failure
of all parts of the plant which are not designed to withstand the loads of an
earthquake is assumed. As pipes are relatively robust against seismic loads,
the failure of single pipes which are connected to the reactor pressure vessel
can be added to the beyond design-basis accidents which lead directly to a core
damage. Emergency procedures and operator procedures which require human
actions outside the control room are not considered since buildings and rooms
may not be accessible after an earthquake. An exception to this are operator
actions to guarantee decay heat removal from the fuel storage pool under the
condition that its integrity is preserved, due to the long time available.


## 5. Screening

All components needed to cope with design-basis accidents as modeled in
the Level-1-PSA have to be considered for a seismic evaluation. Additionally,
all relevant passive components (e.g., heat exchangers, tanks, and piping
including their corresponding hangers and supports) have to be added. To reduce
the large amount of components, generic values for seismic rugged components
from the literature, for example [2], or
results of shake table tests can be used. The usage of the generic values for
typical plant components has to be verified by plant walkdowns.


## 6. Plant Walkdowns

Plant walkdowns are an essential part of the seismic PRA to verify the
screening done for seismic rugged components as mentioned in the previous
chapter and also to support the estimation of safety margins on the basis of
the existing stress analyses. Further goals of plant walkdowns are the
identification of components with high resistivity against seismic loads and
the identification of components where only a low resistivity is expected.
Additionally nonsafety-related components or structures have to be identified
which can impact safety-related components as a result of seismic failure, for
example, through collision or falling.Prior to the walkdowns, a detailed planning with identification of the
structures and components to be reviewed has to be done, including the
preparation of record sheets with component specific criteria and checklists.
The plant walkdowns are performed by seismic qualification and system experts
accompanied by experts from the power plant. A detailed recording of the plant
walkdowns is mandatory. The documentation of the plant walkdowns comprehends
the summary of the record and the preparation of a photo documentation.


## 7. Calculation of Safety Factors and Fragility Curves

Westinghouse uses safety margins in the existing stress calculations to
extract safety factors and estimate fragility curves as a function of the peak
ground acceleration as described in [3]. The
failure probability of structures and components can be calculated by
(1)FFailure(A,Q)=Φ[ln(A/A⌣)+βU⋅Φ−1(Q)βR],FFailure describes the probability of failure during an
earthquake with a peak ground acceleration A at the confidence level Q. Φ and Φ−1 are the distribution function of the standardized normal distribution
and its inverse distribution function. βU and βR describe the uncertainty and the scattering of the safety reserve
factor F⌣SR. The safety reserve factor F⌣SR is a product of all individual safety factors F⌣i described in (2) for the calculation of A⌣,
the horizontal peak ground acceleration with the failure probability of
50% (Median):
(2)A⌣=ADBE⋅F⌣SR=ADBE⋅∏iF⌣i,ADBE is given by the acceleration of the plant
design basis earthquake. Examples for safety factors of a building are the
strength factor with 1.5, the factor for hardening of concrete by time with
1.2, the factor for inelastic energy absorption with 1.4, the factor for
broadening of the response spectra with 1.1 or the factor for the attenuation
of intensity with depth of the building in ground with 1.1. These factors
result in a typical safety reserve factor of approximately larger than 3. Figure 3 shows
the corresponding fragility curve calculated by (1).Figure 3
Example of a fragility
curve for a building.The fragility curve, shown in Figure3 for
three different confidence levels Q,
describes the building failure probability as a function of the horizontal peak
ground acceleration. To calculate point values for the quantification of core
damage frequencies the median curve with a confidence level of 50% is
used. To derive safety factors out of the existing documents of the seismic
design analyses, the construction company of the buildings should be consulted.Examples for safety factors of a component, here a pipe, are the factors
for broadening the ground and floor response spectra with 1.1 and 1.6, the
factor for the attenuation of intensity with depth of the building in ground
with 1.1, the strength factor with 1.3, the three hinge factor with 1.2, the
factor for inelastic energy absorption with 2.2, and the factor for damping of
the floor response spectra with 1.2. These factors result in a typical safety
reserve factor of approximately larger than 7 for the example of a pipe. The
corresponding fragility curve is shown in Figure4.Figure 4
Example of a fragility
curve for components, respectively for a pipe.Because of the
high resistivity of a pipe against seismic loads only a part of the fragility
curve with a confidence levelQ of
95% is visible, whereas the median fragility curve coincides nearly with
the x-axis as indicated.The procedure for
using safety margins to calculate safety factors is described in detail in the
German methodology guideline.


## 8. Modeling and Quantification

In the last step of the full analysis within the scope of a seismic PRA
for plants at sites with high seismic risk, core damage frequencies are
calculated for individual intensity intervals in the relevant intensity area as
shown in Figure5. The
relevant intensity area reaches from a reasonable minimum intensity where no
seismic-induced failure would be anticipated for earthquakes with lower
intensities to a maximum value where  the probability for the occurrence of an earthquake
becomes negligible. According to the German methodology guideline, where no
analysis has to be done (see Section 2) for
plants with intensity 6 or less for the design basis earthquake, intensity 6 as
minimum intensity was used in the example shown in Figure 5.Figure 5
Core damage frequencies for
different intensity intervals. For comparison the corresponding annual
probability of exceedance and the fraction of seismic-induced beyond
design-basis accidents are shown. Values on they-axis are omitted
intentionally.In order to estimate core damage frequencies, the existing Level-1-PSA
model can be separately adapted for each individual intensity interval. As
frequency for the initiating event of the anticipated design-basis accident
(loss of offsite power), the annual probability of earthquakes to exceed the
maximum intensity in each intensity interval is used. The seismic-related
failures and unavailabilities of buildings, structures, and components,
estimated by the fragility curves, are superposed with the corresponding
stochastic unavailabilities.For beyond design-basis accidents which cannot
be coped with the existing safety systems, the core damage frequencies
correspond directly to the annual probability of earthquakes from the hazard
curve and the probabilities of the seismic-induced failure of buildings,
structures, and components which lead to the beyond-design-basis accidents. For
design-basis accidents the core damage frequencies result from the annual
probability of earthquakes, the assumed probability that such an accident is
caused by an earthquake and from the stochastic and seismic-related failure
probabilities of the relevant buildings, structures and components which are
needed to cope the accident. As described before, loss of offsite power is
assumed already above intensity 6.Figure5 shows an
example of calculated core damage frequencies in 11 intensity intervals from a
seismic PRA for a German nuclear power plant. With increasing intensity, the
initial annual probabilities of earthquakes become lower. In the last intensity
interval, the remaining probability of earthquakes exceeding intensity 8.5 is
directly added to core damage frequencies. At low earthquake intensities the
anticipated loss of offsite power in conjunction with the stochastic
unavailabilities of components dominates the result. This region of low
intensities contributes with approximately 40% to the overall result.
Seismic-related unavailabilities have nearly no influence. This supports the
assumption that no earthquakes with intensities below 6 are to be considered.
At high earthquake intensities the result is dominated by the seismic-induced
failure of buildings and structures leading to beyond design-basis accidents.
This region contributes with approximately 60% to the overall result.
Improvements in the analysis due to site specific response spectra, as
described in Section 2, lead to
a reduction of core damage frequencies and therefore also to a reduction of the
contribution of the high-intensity region to the overall result. The main
contribution results from the failure of buildings and structures. The failure
of components, especially of pipes, is only secondary.


## 9. Reduced Analysis

As described before, a reduced analysis is possible for plants at sites
with earthquake intensities above 6 and equal or lower than 7. The procedure
for this purpose is a considerably reduced procedure of the described full
scope analysis. The verification of resistivity against seismic loads from an
earthquake with one intensity step higher than the intensity of the design
basis earthquake is done by fragility curves for individual buildings,
structures, and components, which contribute by experience in a decisive way to
the overall result. As criteria for the choice of the buildings, structures and
components, which have a dominant influence on the overall result, experiences
from previous PRAs, generic values for seismic-rugged components, plant
walkdowns to identify components with low resistivity against seismic loads as
well as the existing seismic analyses from the construction phase of the plant
or from later updates, if done, can be used.


## 10. Summary and Experiences

Westinghouse used the procedure described by the new German methodology
guideline during the development of a seismic PRA for a German BWR. Also a
corresponding seismic PRA for a German PWR is currently in progress.Due to the high core damage frequencies at low earthquake intensities
caused by the conservatively assumed loss of offsite power in association with
the stochastic unavailabilities of components, a modeling of all available
safety systems is needed. The seismic-related unavailabilities
of components are secondary, thereby
their stability is the most important part. Normally, all documents needed for
the analysis are available at the site from the construction phase, so that no
costly new calculations have to be performed. To derive safety factors for
buildings their construction company should be consulted. The described
screening procedure results in a significant reduction of the number of
components to be analyzed and of fragility curves to be created. Plant
walkdowns can be limited to one to two weeks. An important safety factor
results from realistic site specific response spectra in comparison to the
usually conservative response spectra used for the design phase. For a full
scope analysis approximately 10 fragility curves for buildings and structures
and approximately 30 fragility curves for components and piping have to be
calculated. The overall conclusion for the development of a German seismic PRA
by using safety margins is, that the procedure described in the German
methodology guideline is feasible and realizable with reasonable effort.



---

*Source: 761897-2008-07-20.xml*