A computational risk assessment approach to the integration of seismic and flooding hazards with internal hazards

Nuclear Engineering and Design 355 (2019) 110341

Contents lists available at ScienceDirect

Nuclear Engineering and Design journal homepage: www.elsevier.com/locate/nucengdes

A computational risk assessment approach to the integration of seismic and flooding hazards with internal hazards

T

Halil Sezena, , J. Hura, C. Smithb, T. Aldemira, R. Denninga ⁎

a b

The Ohio State University, Columbus, OH 43210, United States Idaho National Laboratory, Idaho Falls, ID 83402, United States

ARTICLE INFO

ABSTRACT

Keywords: Probabilistic risk assessment External hazards Seismic response of nuclear structures Fluid-structure interaction Soil-structure interaction Flooding risk assessment

Probabilistic risk assessment (PRA) of nuclear power plants historically focuses on internal events at the plant, rather than external hazards. Although the importance of external hazards risk analysis is now well recognized, the methods for assessing the risk associated with low probability external hazards rely heavily on subjective judgment of specialists, often using conservative elements in the analysis, as is the case with the Conservative Deterministic Failure Margin approach commonly used for seismic PRA. The U.S. Department of Energy Light Water Reactor Sustainability program has been investigating the use of first principles analyses to provide a more realistic assessment of the risk of external hazards, in a process called computational risk assessment (CRA). Efforts undertaken are described in the development of CRA methods to integrate the risk associated with seismic and flooding events into traditional PRA. The results of four case studies are presented.

1. Introduction Probabilistic Risk Analysis (PRA) is a tool that has been used in the nuclear industry since the mid-1970s (NRC, 2016) to assess the safety of nuclear power plants (NPPs). It currently plays a major role in identifying vulnerabilities in NPP designs, in guiding their daily operations, in risk-informing regulations, and in prioritizing regulatory oversight. Historically, most of the emphasis of PRA has been on “internal events” in which the initiator for the event is a system failure or human error. The general approach to describing risk significant scenarios is shown in Fig. 1.1 where deviations from normal operations are captured by initiating events, which if not mitigated, can result in consequences of varying severity. There is no single “correct” approach to the decomposition of risk performed by the risk analyst and indeed the preferred approach can depend on the nature of the initiating event, analyst preferences and the intended application of the study. The traditional manner, developed for the WASH-1400 study (NRC, 1975), in which the risk analysis problem is decomposed in terms of initiating events, fixed-order event trees and fault trees has, in general, been found to work sufficiently well for internally-initiated events to provide a basis for risk-informed operation and regulation of NPPs. However, for scenarios in which the time-dependence of events can change as a function of accident variability, modeling uncertainty, interaction among different components/

⁎

subsystems of NPP or human intervention, approaches which can properly account for these factors may be necessary (Aldemir, 2013), such as the dynamic event tree (DET) approach (Amendola and Reina, 1984) which is a methodology for performing dynamic PRA (DPRA) (Aldemir, 2013). Similarly, when considering events like internallyinitiated fires or internally-initiated floods, it is necessary to consider locational dependencies (referred to as area analysis), component failures, as well as the dynamic nature of the event. Assessment of the risk of natural phenomena hazard initiators (e.g. seismic events and external floods) also requires special considerations, such as the natural frequencies of systems, and the type of structures and components (SSCs) involved. In the case of an external hazards PRA (EHPRA), the key elements to be addressed are the following (Sezen et al., 2017a,b): 1. The magnitude and frequency of the initiating event, which represents a potential threat to the safe operation of the facility. 2. The transmission of the load from the point of initiation to the safety-related SSC. The transmission involves modeling the earthquake energy from the fault to the soil surrounding the facility structures to the point of potential impacts on the performance of SSCs. In the case of flooding events, the transmission requires modeling the increase in river level associated with extended periods of rain, the surge in water associated with failure of an upstream dam or a tsunami, and the movement of water through the

Corresponding author. E-mail address: [email protected] (H. Sezen).

https://doi.org/10.1016/j.nucengdes.2019.110341 Received 10 January 2019; Received in revised form 5 September 2019; Accepted 9 September 2019 0029-5493/ © 2019 Elsevier B.V. All rights reserved.

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

Fig. 1.1. Accident scenario representation in PRA.

facility to the point of impact on SSCs. 3. The probability of SSC failure conditional upon the imposed load, e.g., the fragility due to motion in the case of an earthquake or due to water immersion, and structural damage. 4. The probability of severe fuel damage and release of radioactive material to the environment.

vulnerabilities, in 1988 the U.S. Nuclear Regulatory Commission (NRC) issued a requirement for all U.S. plants to perform Individual Plant Examinations (IPE) using a PRA or similarly structured process to identify potential plant-specific vulnerabilities arising from internally initiated events (NRC, 1988). This requirement was subsequently extended to include consideration of external events in the Individual Plant Examination of External Events (IPEEE) program. Within this program all plant operators performed at least a survey review of the risk or vulnerability of their plants to flooding events (as well as other external hazards). In NUREG-1742 (NRC, 2002), the NRC tabulated the IPEEE results obtained for flooding events both for those initiated by seismic events and by flooding events independent of a seismic initiator. Although vulnerabilities were identified at some nuclear plants, in general the conclusions of these reviews did not identify flooding as a major source of risk. However, in 2011, the same year that the tsunami struck the Fukushima plant, there was extensive flooding of the Missouri River that threatened the Fort Calhoun and Cooper nuclear plants in Nebraska and raised broader questions regarding flooding risk (World Nuclear News, 2011). Thus, in follow-up to the Fukushima event, the NRC required that all U.S. plants review their vulnerability to all potential sources of external flooding events including tsunamis, seiches, river flooding, hurricanes and the failure of upstream dams in addition to reviewing seismic vulnerabilities (Resio et al., 2012). As presented in (GAO, 2012), U.S. Government Accountability Office has noted that better models are needed to identify the risk associated with external hazards, and recommended that the NRC analyze whether licensees of operating reactors should be required to develop PRAs that address natural hazards. The NRC agreed with this recommendation. In December of 2011, a comprehensive reevaluation of the seismic hazard at NPP sites in the central and eastern U.S. was completed with funding from the U.S. NRC, Electric Power Research Institute (EPRI) and U.S. Department of Energy (DOE) (NRC, 2012) For a number of sites, this study indicated the need for increasing the magnitude of the ground motion response spectra used in establishing seismic design bases, with the potential to require some hardware backfits at plants. For a number of years, the U.S. Department of Energy (DOE) has provided funding through its Light Water Reactor Sustainability (LWRS) program to develop methods for Risk-Informed Safety Margin Characterization (RISMC) (Szilard et al., 2014) to enable the removal of unnecessary or unintended conservatism in the development of a regulatory safety case. In the 1970s, when a number of NPPs were on order and the size of NPPs was increasing rapidly, there was very limited empirical basis and computational capability to accurately assess the capability of engineered safety features (particularly the emergency core cooling system) to mitigate the consequences of design basis accidents. Consequently, regulatory analysis models were developed that

Traditional EHPRAs do address these areas. However the approach, level of detail, and conservatisms vary within the industry. This variation results in differences in the level of realism found in the EHPRA, which complicates the interpretation of the integrated risk of both internal and external hazards. For example, for the purpose of risk-informed decision-making, extreme conservatism in the seismic PRA could result in a misallocation of funding or regulatory oversight by masking potential risks from other hazards that could in fact represent the greater risk. There was a superficial assessment of external event risk in WASH1400 (NRC, 1975) and a limited assessment of external event risks for two of the five NUREG-1150 plants (NRC, 2009a), which addressed only seismic and fire external event risks. Also, a number of risk assessments were performed by the nuclear industry in the period prior to NUREG-1150, which included treatment of fire, seismic and flooding risk. These studies indicated that both seismic and fire risk could be significant contributors to risk, particularly for the older plants (Garrick, 1989). Three recent earthquakes have contributed to increased awareness and concern for seismic risk. In July of 2007, a major earthquake near the Kashiwazaki-Kariwa nuclear plant in Japan led to accelerations substantially exceeding the design basis for that plant (Gaku, 2010). At one of the units, horizontal accelerations that were experienced were more than twice the design value. Although no safety class systems failed as a result of the accident, a safety re-evaluation was performed with the addition of substantial reinforcement of structures. In 2011, the Fukushima earthquake also produced accelerations beyond the design basis of the plant, as well as producing the tsunami that resulted in the failure of critical safety systems and core damage in three units (NAS, 2014). The plants appeared to shut down properly following the earthquake strike but prior to the impact of the tsunami. It is not clear at this point whether any safety-related systems were indeed compromised by the earthquake accelerations or whether the failure of safety systems occurred only as the result of the tsunami. Although much smaller in magnitude, the most recent earthquake to raise concerns about the adequacy of seismic design margins occurred near the North Anna plant in Virginia. This earthquake also exceeded the safe shutdown design level for the plant but again with no apparent damage to safety-related equipment (Dominion, 2011). In recognition of the value of the PRA process in identifying plant 2

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

Fig. 2.1. Example of key portions of a SPRA model.

restrictions, the details of nuclear power plant designs and the results of risk assessments are not available to universities. Thus, the results of case studies described in this paper should be considered as representing the demonstration of methodologies but cannot be used to evaluate the adequacy of industrial PRAs in assessing NPP risk. Section 2 describes challenges and limitations of the traditional approaches to NPP safety assessment under seismic events. Section 3 provides an overview of the CRA approach, including the development of example surrogate accident simulation models that are fast running but have high fidelity over the range of application. Section 4 illustrates the application of CRA within the context of four case studies. Conclusions of the study are presented in Section 5.

accounted for uncertainties by using non-physical but conservative modeling assumptions (NRC, 1996). With time, it was recognized that these non-physical assumptions were not only introducing unnecessary conservatism but distract them from risk-significant activities. Thus, as experimental research led to an improved basis for realistically modeling accident phenomena, and the capabilities of computers increased, an alternative approach has been developed involving best-estimate plus uncertainty (BEPU) analysis to develop a regulatory case, rather than using conservative regulatory models (NRC, 1989). There has been only limited consideration given to validation, verification and uncertainty quantification (VVUQ) of the computer codes which support the safety case for a risk-informed BEPU submittal to the regulator. Aldemir (2013) describes previous efforts in this direction which led to the development of tools to better consider the dynamic aspects of risk assessment such as ADS (Amendola and Reina, 1984; Chang and Mosleh, 1998), MCDET (Kloos and Peschke, 2006), ADAPT (Hakobyan et al., 2008), SCAIS (Izquierdo et al., 2008) and RAVEN (Rabiti et al., 2013). Procedures have been also developed to deal with large amounts of data produced (on the order of tens of terabytes) in a user-friendly fashion for decision making (Mandelli et al., 2013). The objective of the RISMC program has been to extend the BEPU approach from the deterministic analysis of design basis accidents to a more mechanistic treatment of the probabilistic aspects of external hazard risks, referred to as computational risk assessment (CRA). Historically, because of the extent of subjective judgment in PRA, assuring the validity of PRA results has relied heavily on peer review. CRA aims at reducing reliance on such subjective judgment to the extent practical. The main objective of this paper is to demonstrate the application of CRA through case studies performed within the context of seismic and external flooding risk in an effort to decrease reliance on expert opinion and increase the realism of the analyses. The CRA studies of external flooding threats and soil-structure interaction (SSI) in seismic events were performed at the Idaho National Laboratory (INL), and seismic response of systems, structures and components (SSC) were performed at The Ohio State University (OSU) through funding provided by a DOE Nuclear Energy University Program (NEUP) grant. Because of security

2. Challenges and limitations of traditional approaches to NPP safety assessment under seismic events In a seismic margins analysis, each of the safety-related SSCs is examined to assess with high confidence the individual margin to failure under design level seismic loads. Seismic probabilistic risk assessment (SPRA) is an extension of seismic margin analysis to quantify the overall core damage frequency (CDF), and large early release frequency (LERF) resulting from SSC failures. CDF and LERF are the risk metrics typically used in risk-informed regulation (NRC, 2018). The elements of SPRA are illustrated in Fig. 2.1. There are currently two approaches recognized in the American Society of Mechanical Engineers (ASME) standard (ASME, 2009) for the evaluation of component fragilities for SPRA: the Conservative Deterministic Failure Margin (CDFM) (EPRI, 1991), and, the method of Separation of Variables (SOV) (EPRI, 1994). EPRI has developed procedures and provides training in the application of these methods. The CDFM is a conservative approach to assess the adequacy of seismic margins. It is the less expensive approach to performing fragility analysis and is widely used for NPP assessment in the U.S. For cases in which the CDFM results are unacceptably conservative, the fragility analyst may opt to treat an SSC using the more rigorous SOV approach. Some strengths in the methodologies currently in use by the industry for SPRA are the following: 3

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

• Treatment of both aleatory (stochastic) and epistemic (state-of-knowl• • • •

that have been historically experienced at the site, taking into account margin to accommodate the quantity and quality of available data. For the purpose of establishing design bases, the NRC has adopted the concept of a “probable maximum event,” which is based on the assumption that there are physical limits to flooding processes that would exceed any event that has historically occurred (Prasad et al., 2011). The “probable maximum flood” is the hypothetical flood generated in the drainage area by a probable maximum precipitation event. Similarly, the probable maximum storm surge is generated by the probable maximum hurricane (Resio et al., 2012). Although this concept of a “maximum” event is attractive to the regulator from the viewpoint of establishing bounds which are believed to provide a very high level of safety assurance, in practice it is difficult to identify physical principles that establish bounds that do not have an excessive level of conservatism. Probabilistically-based methods for establishing flood-related design criteria, which more realistically address uncertainties, as discussed in (Resio et al., 2012), would better satisfy the NRC’s policy statement on risk-informing regulations. Part 8 of the ASME standard for risk assessment describes the requirements for the analysis of seismic risk and external flood risk (ASME, 2009). The procedures for performing a flooding risk assessment are less well developed than for seismic events. Although there are computer codes that are capable of analyzing the hydraulics of flooding scenarios (Prescott et al., 2015), none are particularly wellsuited for supporting a flooding PRA in ability to address complex geometries and wave effects with high fidelity. Furthermore, there are very few data to assess the fragility of safety-related equipment to immersion in water or hydraulic impact.

edge) uncertainties. In common terminology, variability specifically relates to aleatory and not epistemic uncertainty. Well-supported by training and procedures. Widely reviewed and satisfy the requirements of the ASME PRA standard (ASME, 2009) and NRC regulatory guides for PRA (NRC, 2009b). Simple and efficient approach to the treatment of equipment fragilities. Common methodology in use among utilities that simplifies regulatory review.

There are, however, a number of aspects of the currently used approaches to SPRA that involve simplifications that either introduce unintended conservatism or are potentially a source of non-conservatism. These areas include the following:

• A stylized treatment of component fragility, which relies on consider-

• • • • •

able expert judgment. For example, the choice of logarithmic standard deviations for the epistemic and aleatory uncertainties is made with the intent of under-estimating equipment capacity. Similarly, seismic testing of equipment is typically limited to the design level load but is interpreted as characterizing the median failure level (EPRI, 1994). The use of fixed event trees to model human performance in the recovery of safety functions (e.g., implementation of FLEX equipment required as backup post-Fukushima (NEI, 2012)) and accounting for the effects of aftershocks which can be more realistically modeled with DETs. Limited treatment of common cause failure (CCF) typically using guidelines (Bohn et al., 1983) rather than analysis. Limited capability for the treatment of seismically-induced compounding sources of equipment failure such as fires and floods. Limited consideration of uncertainties, which are even greater than those associated with internal events. Simplified treatments of SSI, effect of embedment for deeply embedded structures, non-vertically propagating waves, and gapping, sliding and uplift at the interface between the soil and the basemat/foundation of structures.

3. Computational risk assessment (CRA) By its nature, the Bayesian concept of probability that provides the basis for PRA is subjective. Nevertheless, the more the physical processes can be assessed using mechanistic models rather than simplistic models with a conservative margin or subjective judgment (particularly when there is a limited relevant experience base for that judgment), the greater the confidence in the validity of the results. Mechanistic modeling has always had a role in PRA, such as the use of RELAP5 (INL, 2005) in determining the minimum number of safety trains required to prevent core damage, or the use of the National Institute of Standards and Technology (NIST) FDS code in fire risk assessment (NFPA, 2015; McGrattan et al., 2019) However, as advances have been made in speed and storage capacity of computers, potential now exists to reduce some of the uncertainty in risk assessment. This potential has provided much of the motivation for the RISMC program which addresses safety margin calculation, a subset of the more general CRA approach. CRA involves the application of high fidelity mechanistic modeling of physical processes including multi-physics problems, either directly or indirectly through the development of reduced order models (ROMs) that within a domain of application preserve the fidelity of these models or allow the error in the ROM to be quantitatively characterized. Thus, many of the tools developed in the RISMC program and in the U.S. DOE Consortium for Advanced Simulation of Light Water Reactors (CASL) program [https://www.casl.gov/], in which more fundamental modeling of light water reactor (LWR) processes have been developed, have direct application to CRA. The CRA concept involves the development and application of methods for the high fidelity deterministic assessment of accident phenomenology, stochastic modeling including the development of probability density functions (pdfs) to represent uncertainty, sampling from these distributions, determination of initiating event frequencies, assessment of system failure probabilities, and the characterization of accident risk. Subsequent to the Fukushima accident in 2011, CRA development has been initiated and applied in the areas of seismic risk and flood risk within the LWRS program. At INL, advanced computational tools are under development for external event analysis. The non-linear SSI code

One of the important sources of uncertainty in SPRA, possibly the principal source, is associated with the magnitude of the seismic hazard. This uncertainty has not been addressed by the LWRS program because a substantial joint effort had been undertaken previously by the industry and the NRC regarding the treatment of experts in addressing the associated uncertainties (Budnitz et al., 1997). The review level seismic loads on SSCs are typically assessed using finite element (FE) models (FEMs) or surrogate models (stick models) of the plant structures to which the SSCs are affixed. Uncertainty analysis is an essential component of CRA. However, the computational expense of performing detailed FE analysis limits its use in uncertainty analysis. Even with the speed and storage capacity of today’s computers, the FE codes are too computationally intensive to allow the use of tens of thousands or hundreds of thousands of samples to characterize uncertainty distributions. Thus, in order to enable RISMC types of analyses to be performed as benchmarks against which current SPRA methods can be compared, it is necessary to develop surrogate models that are faster running but retain the fidelity of the detailed models over the range applied. The seismic design criteria for a NPP are probabilistically based. The ground motion response spectrum (GMRS), which provides the characteristics of the safe shutdown earthquake to which the plant is designed, assure that, even for an event that could occur at a frequency of 1E-4 per year or less, there is high probability that safety-significant SSCs would not fail. In contrast, the design bases for hurricanes and floods are deterministic rather than risk-informed. The Code of Federal Regulations (NRC, 2019) requires that in the Final Safety Analysis Report, the applicant must consider the most severe natural phenomena 4

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

Fig. 3.1. Conceptual Approach to CRA.

• The development of more defendable guidelines regarding the de-

MASTODON (Coleman et al., 2017) is being developed to better assess the transfer of earthquake loads from the ground to the basemat of buildings containing safety related equipment. Development work is also being supported for the smooth particle hydrodynamics (SPH) NEUTRINO code to examine hydraulic loads and immersion of structures and equipment in flooding events (Prescott et al., 2015) (also see Section 4.3.1). In 2015, OSU, in collaboration with Rizzo Associates was awarded a NEUP grant (Sezen et al., 2017a,b) to develop the following:

• • • •

• A BEPU approach for the treatment of risk-informed safety margins • • • • •

gree of correlation of structural response at different locations in a facility as it affects the potential CCFs. Guidelines for the development of reduced order FEMs. Justification of implementation times for FLEX equipment in seismic events. Justification of severe accident management guidelines for seismic events. Assessment of the impact of possible aftershocks on recovery time of systems.

Through the performance of benchmark studies using the advanced analysis methods, it is also possible to justify the suitability of approximations and judgments made in the CDFM and SOV approaches to fragility analysis currently in use by the industry in the performance of SPRA. Fig. 3.1 shows the conceptual relationship among the tools required for CRA, which primarily addresses the physical response of hardware. Human response can also significantly affect the probability of core damage in a seismic event, as addressed in Case Study 2 (see Section 4.1.4). The Fragility Analysis module (as depicted by the central box in Fig. 3.1) is the principal element of CRA based SPRA and receives input from different tools and studies. Hazard Characterization at a site (which was the subject of considerable joint industry and NRC efforts in the development of the seismic hazard analysis process (Budnitz et al., 1997)), has not been included within the scope of the LWRS program and subsequently not considered within the work presented in this paper. Modeling of SSI is under development at INL. The development of the ROMs for systems, structures and components (SSCs) as well as the uncertainty analyses are accomplished using the RAVEN code (Alfonsi et al., 2013). CRA also assesses CCF of components arising from correlations in structural response. CCF is an important input to the overall assessment of system failure probability by SAPHIRE (Smith et al., 2008) or an equivalent commercial PRA code (e.g. CAFTA (1995), RISKMAN (ABS Consulting, 2013)). For DPRA, the analysis of CDF would require the use of software such as RAVEN (or ADAPT) to manage accident progression modeling as performed by the MELCOR code (Sandia National Lab, 2006) or another code for performing severe accident analysis (e.g. (MAAP5, 2016)). The MASTODON FE code (Coleman et al., 2017) has been used for SSI analysis. The SPH (Gingold and Managhan, 1977) technique has been applied to the analysis of flooding using the NEUTRINO code (Section 4.3.1) which can be relevant to a number of modules in Fig. 3.1 (e.g. hazard characterization, identification of critical SSCs).

as being developed in the RISMC program, including the development and application of surrogate models. A set of tools for SPRAs which will include the dynamic aspects of seismically induced events, such as internal floods, as well as capability to model remedial actions. The capability to evaluate the effects of possible aftershocks on potentially degraded SSCs. A methodology for the effective integration of SPRA into the traditional internal events PRA in a seamless fashion. DETs to model probabilistic time evolution of events, their potential impacts on plant equipment and the associated uncertainties. Capabilities for seismic CRA that can be exercised under the MOOSE platform (MOOSE, 2019) developed under the LWRS program and which can facilitate the solution of multi-physics problems in a fully consistent and integrated fashion.

In close collaboration with the INL, the OSU/Rizzo Associates team has developed surrogate structural models within MOOSE to advance the computational feasibility of quantifying impacts of uncertainties on risk metrics for CRA. Four case studies were used to support the development and demonstration of these models and the results were compared to those obtained from commercial software such as ANSYS (ANSYS, 2017), OpenSees (Mazzoni et al., 2006) and SAP2000 (2017) (see Sections 4.1.3, 4.1.4, 4.2.1 and 4.3.2). Although the CRA approach for performing SPRA described in this paper could result in the ability to reduce areas of conservatism in the current SPRA methods, the intent is not to replace current methods but to augment those methods in addressing complex licensing basis issues. As situations are encountered for which the standard approaches are overly conservative or are difficult to defend within a regulatory environment, the advanced methods will be available for use to support specific positions. Some potential contributions include the following:

5

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

I. II. III. IV.

4. External hazards risk assessment using CRA This section outlines case studies that have been identified to provide context and serve as examples of the application of CRA. Each of the case studies has been reported in the literature in greater detail. Sections 4.1 and 4.2, respectively, describe the approach to determine the response of SSCs and modeling of SSI. Section 4.3 illustrates how flooding risk assessment can be performed using the NEUTRINO code.

Based on the spectral shape of the target horizontal UHRS, a set of seed motions (two horizontal and one vertical acceleration time histories) were selected (Sezen et al., 2017a,b). These seed motions were modified in order to obtain adjusted motions whose response spectra closely match the target spectrum. The power spectral densities (PSD) of the adjusted motions were checked against the target PSD in NRC’s Standard Review Plan (NRC, 2014) to ensure there are no significant energy gaps in the frequency range of interest. In the nuclear industry, commonly used target spectra are the UHRS, the performance-based ground motion response spectrum (GMRS) or the foundation input response spectrum (FIRS) (Sezen et al., 2017a,b). For this project, the horizontal target was selected from seven test site locations used for demonstration hazard calculations in (EPRI, 2013). The 1E-4 per year rock UHRS for a Central Illinois Site was selected as the target spectrum. Fig. 4.1 indicates the similarity between this spectrum and the shapes provided in the NRC’s guidelines document NUREG/CR-6728 (McGuire et al., 2001) and the Bin Average Response Spectrum for a CEUS rock site from Table 7 in the Standard Review Plan (NRC, 2014). The vertical target spectrum was developed as the horizontal spectrum multiplied by the vertical-to-horizontal spectral ratio (V/H ratio) recommended in NUREG/CR-6728 (McGuire et al., 2001) for CEUS hard rock condition without any site-specific adjustment. It should be noted that the target compatible time histories developed in this project may be appropriate for SSI analysis for a structure founded on a hard rock site in CEUS, but not suitable for a structure founded on a soil site, for which a site-specific GMRS or FIRS should be used as the target for time history development. Two ground motion databases were considered for the selection of seed motions. One is the Pacific Earthquake Engineering Research Center (PEER) ground motion database for the Next Generation Attenuation (NGA)-West2 project (PEER, 2013). The other is the ground motion database provided on the compact disk accompanying NUREG/CR-6728 (McGuire et al., 2001). The PEER database for the current NGA-East project is not considered since the number of strong ground motion records in that database is not sufficient for this study. Two horizontal and one vertical time history components were developed for 18 different ground surface input motions for a CEUS rock site (Central Illinois site). The response spectrum of the generated ground motions matched the selected target spectrum (1E-4 rock UHRS) reasonably well and the matching criteria set by different guideline documents were met (Sezen et al., 2017a,b).

4.1. Seismic risk assessment – response of SSCs In investigating the response of SSCs, much of the development effort has been performed within the context of two key case studies (Sections 4.1.3 and 4.1.4). Based on the results and insights gained from the case studies, variations or extensions of these case studies were also performed, in some instances leading to important differences in results. The results of these case studies do not reflect the seismic response of a specific NPP but rather configurations similar to those expected in NPPs. Neither detailed NPP design information nor the results of SPRAs performed for actual NPPs are publicly available because of security restrictions. In this respect, the focus of the studies reported in this paper is on methodology. Because of the need to perform a large number of FE simulations associated with draws from uncertainty distributions, studies were also performed of the effect of alternative nodalization schemes and levels of approximation on ability to simulate the dynamic characteristics of a detailed FE analysis. Section 4.1.1 describes the development of characteristic time histories for the case studies. The methodology for determining the response of structures to seismic loads is described in Section 4.1.2. 4.1.1. Development of characteristic time histories Seismic risk of NPPs is associated with very rare events with a magnitude much greater and frequency of occurrence much smaller than is typically considered in building codes for common structures like office buildings, dams and bridges. In order to support the performance of case studies Rizzo and Associates undertook the development of a set of seismic time histories characteristic of events with a frequency of occurrence less than 1E-4 per year for a NPP at a Central and Eastern United States (CEUS) rock site (Central Illinois Site). The response spectrum for the set of time histories was developed to match the target spectrum for the rock Uniform Hazard Response Spectra (UHRS) for the site. In order to develop the set of design time histories, four main steps are required (Sezen et al., 2017a,b): 3 SRP bin M=6-7, R=10-50

Spectral Shape

4.1.2. Response of structures to seismic loads The starting point for the analysis of the response of safety-related SSCs begins with the dynamic load imposed on the basemat of a structure, potentially leading to failure of the structure, but more generally transmitting a load to equipment affixed to the structure. In general, FE analysis is computationally intensive. Thus, a key element of the practical application of CRA is to determine cost-effective ways to reduce the computational effort associated with modeling major structures. In this research, consideration has been given to reducing the effort associated with modeling reinforced steel water tanks (Section 4.1.2.1), concrete containment structures (Section 4.1.2.2) and auxiliary buildings (Section 4.1.2.3). Because of the limitations of the study associated with access to information on actual plant design details, the specific conclusions of the studies are representative of what can be inferred from analysis but may not be generally applicable to all designs.

NUREG 1C&2C, M=6.5 R=30

2.5

Central Illinois 1E-4 UHRS

2 1.5 1 0.5 0

0.1

1

Frequency [Hz]

10

Selection of target spectra Selection of seed motions Spectral matching Power spectral density check.

100

Fig. 4.1. Selected target spectra and spectra from SRP 3.7.1 and NUREG/CR6728 (McGuire et al., 2001).

4.1.2.1. Structural analysis of water tanks (Fan et al., 2017). Large steel 6

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

Fig. 4.2. Meshed 3D models of tank body and fluid inside.

cylindrical tanks are used in a number of NPP applications as a critical water source. In pressurized water reactors (PWRs). These condensate storage tanks (CSTs) provide the source of water to steam generators for decay heat removal in seismically-initiated events during that time period in which the primary system is at high pressure. Evaluation of the failure of CSTs under seismic loads is complicated by the dynamic interaction between the tank shell and fluid inside the vessel, sloshing motion of the free surface, capacity to resist buckling of the tank wall and other failure modes triggered by excessive hydrodynamic pressure of fluid. The availability of fast-running ROMs for predicting CST response (or more generally large water tank failure) facilitates their evaluation in SPRA. Housner (1963a,b), in one of the first attempts to study the seismic behavior of tanks, developed a simplified model for estimating the dynamic response of tanks with rigid walls. The fluid inside the tank is treated as a lumped mass connected to the tank wall with specified springs to simulate the effects of liquid oscillation. The coupled system vibrates in the horizontal plane excited by ground motions. Many current industrial standards and design guidelines such as ACI 350.3 (ACI, 2001) have employed Housner’s method for seismic design of tanks with a few modifications. However, the Housner model has serious limitations as indicated in experimental studies. The rigid wall hypothesis ignores the possible nonlinear behavior of the tank body caused by fluid interaction. Thus, the dynamic stresses and sliding effects may be underestimated for models based on rigid wall tanks. Haroun and Housner (1981) developed a new model to evaluate the seismic response of steel tanks that includes the consideration of the flexibility of the tank wall. In this model, two basic types of lumped masses of fluid named as convective and impulsive masses respectively move back and forth with the tank body. In addition, the convective and impulsive masses are connected to the tank wall with different springs. In our research, these models are developed in the SAP2000 code (SAP2000, 2017). In order to assess the performance of the simple models, a 3D detailed FEM was developed for the CST within this project using the ANSYS code (ANSYS, 2017). ANSYS was selected for its ability to include shell elements for the tank body, contained fluid elements,

specific material and geometric nonlinearities, fluid-structure interactions (FSI) effects, and corresponding contact type elements. The model assumes that the CST is a symmetric structure that is well anchored at the base plate. Thus the effect of uplift at the base is ignored. FEMs of the tank body and fluid are illustrated in Fig. 4.2. In order for there to be significant FSI, there must be intimate contact between the fluid and solid component that enables a transfer of energy from fluid to the solid and vice versa. Forces are transferred between the solid and liquid in terms of pressure and friction. In the FEM, elements with eight nodes in three degrees of freedom were attached to shell elements which describe the boundary of a deformable body. Contact and sliding between the fluid and solid surface were taken into account. Two different simplified CST models were examined based on a 2D profile (Fig. 4.3(a)). The first model was based on Housner’s method as illustrated in Fig. 4.3(b). Total stiffness of a convective mass spring is labelled as kc. Equivalent masses of convective and impulsive components are mc mi, respectively. hi is the elevation to center of gravity of the impulsive mass and hc is the height to center of gravity of the convective mass. The other model was based on the Haroun and Housner modifications (Fig. 4.3(c)). This model adds a second convective mass mc2 to model the flexible nature of the tank walls. In Fig. 4.3, hci is the height to center of gravity of the corresponding convective mass. Both of these 2D CST models were implemented with SAP2000 (2017). Full transient analyses were used to determine the dynamic response of structures subjected to acceleration time histories considering the deformation of the tank body, the sloshing effect and free surface movement, the stress distribution of the tank wall due to hydrodynamic pressure, and resistant overturning moments. Sloshing motions, resulting from fluid structure interaction, are critical to determining the potential for failure of the roof of the tank and the hydrodynamic pressure applied to the body of the tank. An increase in the input ground motions leads to larger compressive stresses, fluid pressures, reaction forces and fluid sloshing. Only a 3D CST model can accurately simulate the details of sloshing effects or the generation of standing waves in the free surface of the fluid as illustrated in Fig. 4.4. The

Fig. 4.3. Simplified CST models. 7

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

Fig. 4.4. Fluid sloshing observed under seismic ground motion.

containment model were ignored for illustration purposes and the building is modeled using the concrete material properties. Since nonlinear behavior is not expected in a reactor building under seismic loading, the contribution of rebar on the walls of reactor building is ignored in the models. This approximation is based on the realistic assumption that the entire wall component stays as elastic material with limited contribution from steel rebar during an earthquake. To create the distributed mass stick model, the dome part of the containment was transformed into hollow cylindrical sections with different diameters. Internal and external radii for those sections were derived using the geometry of the cross section of the containment structure. Transforming the dome into cylindrical sections caused the sections to have larger thicknesses than the initial dome thickness. The structure was modeled as a 3D FE, lumped mass stick, and a distributed mass stick model. Massless beam elements were used between masses for the lumped mass stick model, and beam elements with assigned uniform masses were used in the distributed mass model. Fig. 4.6 shows the stick models used along with the tetrahedral meshed FEM. For the lumped mass stick model, the masses of the containment sections were modeled as a single discrete mass connected to beam elements, which represent the stiffness of that specific section of the structure. The distributed mass stick model was created by dividing the containment building into different sections, and modeling those sections as structural beams with distributed masses. The model was meshed with a total of 107 beam elements. The 3D FEM was meshed using tetrahedral and 8-noded and 20-noded hexahedral elements. Default meshing was done with ANSYS using tetrahedral elements. Although tetrahedral elements are more efficient, in this research hexahedral elements were used in ANSYS due to one of the objectives of the project being implementation within the MOOSE framework. Only hexahedral elements were available in MOOSE at the time of the study. While meshing with hexahedral elements requires fewer elements than meshing with tetrahedral ones, meshing the dome part with hexahedral elements is not done automatically and requires manipulation to satisfy its geometric shape. Therefore, the dome had to be partitioned into twelve parts with quadrilateral cross sections. Fig. 4.6 shows ANSYS

maximum sloshing wave height increases with increasing magnitude of the ground motion accelerations. However, no simple relationship was observed between input seismic motions and output responses (Sezen et al., 2017a,b). Resistance to the overturning moment is provided by the reactions of the tank shell. Overturning moments and base shear force can be used for predicting anchorage failure. In general, the calculated response histories of overturning moments from the simplified 2D and detailed 3D models show similar trends. Fig. 4.5 shows that Haroun and Housner model (1981) overestimates the overturning moment of the 3D model throughout the entire history. On the other hand, the response history of the Housner model (1963a,b) is similar to that of 3D model. Fig. 4.5 also compares the general response for one parameter, i.e., overturning moment history for one ground motion, as an example. Response of other parameters such as reactions, stresses, displacements, and strains at various locations can vary for each model and input ground motion. Although the 3D model is the most detailed and accurate, model development and dynamic simulations are computationally expensive. If thousands of simulations are required for CRA, the 2D models may provide acceptable results quickly as long as the user is aware of the limitations of those simplified models (Sezen et al., 2017b). 4.1.2.2. Structural analysis of concrete containment building. Alternative approaches to modeling a concrete containment structure were examined with, 3D FEMs and simplified models. Lumped and distributed mass stick models of the containment structure, were developed and compared. Lumped mass stick model is one of the methods used by the industry due to its simplicity and ability to quickly determine the approximate dynamic response. Using the information provided in the SASSI manual (Lysmer et al., 1981) for a hypothetical PWR containment building, a three-dimensional FEM was created and analyzed in ANSYS. Lumped and distributed mass stick models were created and analyzed with both ANSYS (2017) and SAP2000 (2017). The elevation view of the containment example is shown in Fig. 4.6. The effects of steel rebar in the

Fig. 4.5. Comparison of overturning moment for different CST models. 8

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

Fig. 4.6. PWR example problem from SASSI Manual (left), lumped mass and distributed mass stick models (middle), and tetrahedral meshed FEM (right).

model of the containment building with tetrahedral elements. Fig. 4.7 shows both the unmeshed partitioned model and the model with hexahedral element meshing. Modal analysis was performed for the stick and 3D FEMs using SAP2000 and ANSYS programs. Dynamic characteristics including natural frequencies and mode shapes were determined. The natural frequencies obtained using both lumped mass and distributed mass stick models were found to be very close but not identical (Sezen et al., 2015). The first three modes are within a few percent of each other. While the differences in the fourth and fifth mode were more significant, the dynamic response of the containment structure seems to be primarily controlled by the first and second modes (Hur et al., 2016a; Althoff, 2017). The mass participation ratios of the first and second modes alone add up to 93% with the first and second mode mass participation ratios being 76% and 17%, respectively. The 3D FEMs were meshed using 17,000 8-noded and 15,000 20noded hexahedral elements (Fig. 4.7). The 3D model has many more modes than the stick model. Modal analysis indicated that the natural frequencies of both stick and 3D models were essentially identical for the first five modes (Althoff, 2017). Only the 3D model meshed with 20noded hexahedral elements was used in the transient dynamic analysis in this research because it provided faster results with fewer elements. Time history analyses were also performed using the El Centro earthquake ground motion. The maximum positive acceleration is 0.271 g and the negative peak acceleration is 0.313 g. The stick model (Fig. 4.6) produced results very similar to the 3D FEM with a maximum

difference of 10% (Althoff, 2017). Based on comparison of the models and analysis of the results, the following were concluded (Hur et al., 2017; Sezen et al., 2017a,b):

• The calculated first mode frequencies from all models are approximately the same. • The distributed mass stick model results are in closer agreement with the 3D FEM than the lumped mass stick model results. • The sensitivity analysis of 3D FE showed only minor differences in

natural frequencies between the models with 15,000 FE elements and 1176 FE elements. Thus fewer FE elements can be used with less computational time with acceptable accuracy.

4.1.2.3. Structural analysis of the auxiliary building. In SPRA, the degree of correlation among loads on equipment at different locations in a building is often based on expert judgement and guidelines (typically conservatively) rather than rigorous analysis (as discussed in Section 4.1.2.4). This study investigated the spatially-dependent response of an auxiliary building containing essentially identical non-structural components (NSCs) at different locations within the building as a function of the asymmetry of the building. In determining the dynamic characteristics of the auxiliary building, a modal analysis was conducted, and the seismic responses of the building and NSCs were simulated using a set of time history analyses to obtain the failure probability of NSCs under various 3D ground motion sets. The hypothetical auxiliary building (based on the Connecticut

Fig. 4.7. 3D FE unmeshed model, b) 3D FE meshed with 8-noded hexahedral elements, and c) 3D FE meshed with 20-noded hexahedral elements. 9

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

Case 0: Symmetric

Case 1: Prototype

Case 2

Case 3

Case 4

Case 5

Fig. 4.8. Auxiliary building with different levels of asymmetry.

Yankee NPP design) is a three-story reinforced concrete building (Althoff, 2017; Hur et al., 2017; Althoff et al., 2017). The structural beams, columns, and walls are not symmetrically placed, and therefore, the stiffness distribution in this building is not symmetric, as well as the mass distribution of the building. In order to represent the various levels of asymmetry/irregularity of auxiliary buildings, six cases were generated, labeled as Case 0–5 (see Fig. 4.8). The structural plans are modified to represent six cases as variations of the prototype (Case1). Case 0 represents a totally symmetric building. Case 1 is the prototype with minor asymmetry and other Cases 2 through 5 show increasing asymmetry as illustrated in Fig. 4.8. Although all cases have approximately the same floor masses and effective lateral stiffness, their Centers of Mass (CM) and Centers of Rigidity/stiffness (CR) are different. 3D FEMs were generated using beam-column elements and shell elements using SAP2000. The shell elements are used for wall and floor slab members. While simplified 2D stick models can represent limited dynamic properties of a structure, 3D structural models can capture dynamic properties of the two horizontal and the vertical directions. Since the fundamental frequencies are dynamic characteristics of structures, it is important to determine the significant number of mode shapes and their frequencies to accurately evaluate and estimate the dynamic behavior of structures subjected to seismic shakings. Depending on the structure’s characteristics, significant number of mode shapes and frequencies can vary. The mass participation ratio is helpful to determine the significant number of mode shapes and frequencies. Only the first few modes and frequencies are usually significant to evaluate the dynamic behavior of structures as shown in Table 4.1. In order to present the effects of irregularities on the dynamic behavior of the building structure, Table 4.1 summarizes the dynamic characteristics of Cases 0 (symmetric), 1 (prototype) and 5 (the most asymmetric). For Cases 0 and 1, three modes (mode numbers 1, 5, and 8 for Case 0, and 1, 5, and 7 for Case 1) present the dynamic behavior of the building in the x-direction (narrow dimension) as shown in Cumulative Mass Participation Ratio (CMPR) column. Mode 1 is shown to be the principal mode based on the values of CMPR. The CMPRs of the first mode of Cases 0 and 1 are 0.814 and 0.774, respectively, due to the lack of significant stiffness or plan irregularities. However, for Case 5, which had significant stiffness and plan irregularities, the CMPR of Mode 1 is 0.342 (much less than for the other cases), and the number of significant modes is seven. It means that each mode shape in the transverse direction for Case 5 had smaller mass participation due to torsion of the structure. For example, Modes 1–3 of Case 5 contributed 82% of the total dynamic response whereas the first mode contributed approximately 80% of the total dynamic response for Cases 0 and 1. The symmetric model (Case 0) shows similar behavior as Case 1, while the Case 5 shows greater variety of mode shapes than the other row cases. Similar results were obtained for a design with a semi-rigid slab (Althoff, 2017). For the time history analysis, a ground motion history with three

Table 4.1 Dynamic characteristics of 3D structural models of auxiliary buildings with rigid slab. Mode Number

Natural Frequency (Hz)

Mass Participation Ratio

Cumulative Mass Participation Ratio

Case 0 1 5 8

16.14 41.96 50.71

0.814 0.138 0.048

0.814 0.952 1.000

Case 1 1 5 7

16.04 41.77 49.69

0.774 0.139 0.073

0.774 0.915 0.989

Case 5 1 2 3 5 6 7 9

15.11 16.09 17.47 39.03 41.63 44.95 50.47

0.342 0.335 0.143 0.063 0.057 0.035 0.014

0.342 0.676 0.819 0.882 0.939 0.974 0.994

components was generated for a Central Illinois site, where its soil condition is assumed as hard rock. The maximum accelerations of the 1st and 2nd floors are less than 0.5 g in both horizontal directions. In the spatial response of absolute acceleration, the coefficients of variation (c.o.v.) are between 12 ~ 65% at all locations of each floor indicating the potential for substantial variability of response of an NSC depending on its location on the floor. The assessed probability of component failure is very sensitive to variation in peak acceleration. In SPRA, although the range of peak accelerations analyzed exceeds the design basis earthquake level, the accelerations typically are below the median capacity factor for components (leading to failure probabilities less than 0.5). By design (based on the high confidence of a low probability of failure criterion) (EPRI, 1991), at the design basis earthquake the failure probability of a component should be less than 1%. For a typical component with a logarithmic standard deviation of 0.5, a 65% increase in load at the design basis level would lead to the probability of failure increasing from a 1% probability to a 10% probability (a factor of ten). The vertical acceleration (z-direction) was found to have the largest c.o.v. (Hur et al., 2017; Sezen et al., 2017a,b). The amplification factor of vertical acceleration is the largest and could exceed a factor of 7 on the 2nd floor. Amplified acceleration responses of floors directly impact sensitive electronic devices, such as causing relay chatter in the high frequency portion of the spectrum, which is a particular area of concern. Such events could be captured by the detailed 3D models, while the simplified 2D mode must be modified to consider the vertical amplification factors for the acceleration response. 10

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

Depending on the degree of asymmetry and flexibility of the building slab, it may be possible to use stick-models to assess the failure probabilities of NSCs located in different locations in an auxiliary building, as illustrated in Section 4.1.3. However, for some building designs local variations in response within the building could substantially impact the range of component failures and the joint failure probability of redundant components as shown above (i.e., difference of an order of magnitude depending on location) and require a 3D analysis (Hur et al., 2017; Sezen et al., 2017a,b).

Pf = P [(R =

=

2 s1

+

s1 s 2 2 2 R1 s2

+

2 R2

s1s2

+

2 s1

+

R1 R2 2 2 R1 s2

+

2 R2

R1R2

Pf = P [(R1 =

R2

(r , s 1, s2 ) drds1 ds2

fS1, S2 (s1, s2 ) fR (r ) ds 1 ds2 dr =

F(S1) (r )

F(S2) (r ) + F(S1, S2) (r , r )] fR (r ) dr .

(4.2)

S1 < 0) r2

r1

(R2

S2 < 0)]

fR1, R2, S1, S2 (r1, r2, s1, s2 ) ds1 ds2 dr1 dr2

(4.3)

Assuming that resistance and demand models are statistically independent,

Pf =

r2

=

r1

fS1, S2 (s1, s2 ) fR1, R2 (r1, r2 ) ds1 ds2 dr1 dr2

[1 + FS1, S2 (r1, r2)

FS1 (r1)

FS2 (r2 )] fR1, R2 (r1, r2 ) dr1 dr2

r2 r 1

=

[G S1 (r1) + G S2 (r2)

G S1, S2 (r1, r2 )] fR1, R2 (r1, r2 ) dr1 dr2 (4.4)

where GX represents the complementary cdf of X. Section 4.1.3.2 illustrates an application of this approach for the quantification of CCF. 4.1.3. CRA case study 1: marginal and joint failure probabilities of nonstructural components (Hur et al., 2016b) The objective of CRA Case Study 1 is to examine CCF behavior of essentially identical equipment at different physical locations in the building. By sampling over distributions of the uncertain parameters that model structural response, the Case Study 1 illustrates the dependencies implicit in the transmission of loads through the structures and involves the failure of components for which fragility curves are obtained from testing. Case Study 1 is similar to the Correlation Coefficient method in NUREG/CR-7237 (Budnitz et al., 2017) but differs in that the uncertainty distributions associated with the structural response of the building and the accelerations to which the SSCs are exposed relate to fundamental properties of the structures, which are measurable distributions. Case Study 1 uses a 2D stick model (most frequently used ROM for the FE analysis of structures (Sezen et al., 2017a,b)) which describes the response of an auxiliary building accounting for uncertainties in the model parameters (masses and spring constants). Two essentially identical non-structural safety-related components, NSC1 and NSC2, are considered at two different levels of the building. The failure probability of each component is assessed independently in addition to calculating the joint failure probability. Fig. 4.9 illustrates: (a) the simplified model of the auxiliary building, (b) the 2D stick model used for the characterization of the building with components NSC1 and NSC2 affixed to the first and second floors of the building (the building also has a basement level), and, (c) the nonstructural components (NCS) restrained on floors. The fundamental frequency of the auxiliary building is assumed as 7.5 Hz, based on analyses performed by Kitada et al. (1999) for the fundamental frequencies of a model auxiliary building. The structure of the auxiliary building is comparatively rigid, which likely has a greater effect on the results than the low natural frequency. Nonstructural components NSC1 and NSC2 represent electrical equipment. For purposes of illustration, the fragility of the equipment was assumed to be lognormal with a median failure acceleration of 1.01 g and logarithmic standard deviations of βR = 0.28 due to random variability, and βU = 0.63 due to epistemic uncertainty. Sections 4.1.3.1 and 4.1.3.2, respectively, describe sampling process over the

(4.1)

c

R1

r

S2 < 0)]

The joint probability of failure of two components with correlated resistance models (R) and correlated strength/demand (S) models can be calculated as

• ρ :the correlation coefficient between failures of the NSC1 and NSC2 • β and β : the logarithmic standard deviations of the structural responses (loads for NSC1 and NSC2), respectively • β and β : the logarithmic standard deviation of the capacities for NSC1 and NSC2, respectively ρ • : the correlation coefficient between the structural response at the locations of NCS1 and NCS2 • ρ : the correlation coefficient for the capacity of the two coms2

r

[1

where

s1

f Domain R, S1, S2

=

4.1.2.4. Effect of correlation of loads and response on joint failure probability. Common practice in industry SPRAs has been to treat CCF by examining the condition of complete correlation and the condition of complete non-correlation to determine the potential significance of CCF. In (Bohn et al., 1983) a table of Rules of Thumb was presented as an aid to the subjective judgment of the analyst. In 2017, the NRC issued the results of a study, “Correlation of Seismic Performance in Similar SSCs” NUREG/CR-7237) (Budnitz et al., 2017) which examined four alternative approaches to the treatment of dependencies: i) Correlation Coefficient Method, ii) Conditional Probability of Failure Method, (iii) Split Fraction Method, and, (iv) Separation of Independent and Common Variables Approach (Reed-McCann method). Although the study indicates a preference for the Reed-McCann method, all of the approaches require substantial judgment on the part of the analyst, for which there is very little empirical basis. Nevertheless, NUREG/CR7237 (Budnitz et al., 2017) represents an important resource for the SPRA analyst, whether or not the risk assessment undertakes a substantial effort to quantify common cause contribution to risk. The following analyses described in this section are based on the Correlation Coefficient Method. A unique characteristic of seismic events is the high potential for CCF of safety related systems. Safety systems for NPPs typically are provided with redundancy to reduce the probability of loss of a safety function. To account for CCF of redundant components, guidelines have been developed associated with the degree of correlation to be assumed in assessing the joint failure probability of essentially identical components at different locations within a building (Bohn and Lambright, 1990). Correlation of failure probability of essentially identical components can arise from correlation in the load on the component and correlation in the capacity of the component to withstand a seismic load without failure, i.e. c

S 1 < 0) ( R

s1s2

R1R2

ponents

The conditional failure probability of a NSC (Pf ) is computed using characteristic fragility curves and the simulation results for the distribution of accelerations of the two NSCs for the given ground motion sets. The joint probability of failure of two components with the same fragility model can be found from Eq. (4.2), where f() is a pdf, and F() is a cumulative distribution function (cdf) for failure of the structure (fragility curve): 11

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

Fig. 4.9. System model showing components on the first floor (1st FL) and second floor (2nd FL).

Eq. (4.5).

M

u¨1 u¨2

+C

u1 u2

{ }

u + K u1 = 2

Mu¨g

(4.5)

k1 + k 2 k2 m1 0 where M = is the mass matrix, and K = is 0 m2 k2 k2 the stiffness matrix, C = a 0 M + a1 K is the mass and stiffness propor2 2 tional damping matrix with a0 = +1 2 and a1 = + , is the damping 1 2 1 2 ratio (5% here) and ω1 and ω2 are first and second modal frequencies of the structure, respectively. The solution of Eq. 4.5 provides: (1) the absolute floor accelerations FA1 (u¨1 ) and FA2 (u¨2 ), and (2) floor displacements FD1 (u1) and FD2 (u2 ). Using these histories of FA1 and FA2, fundamental frequencies of NSCs, Tn and a constant damping ratio of 5% for the NSC, absolute acceleration histories of NSCs were computed. The floors supporting the equipment are subjected to much smaller maximum accelerations (FA1max, FA2max) than the equipment themselves, and the floors are unlikely to fail. The accelerations experienced at the base of the NSCs are illustrated in Fig. 4.9 and shown in Fig. 4.10a and b. A suite of ground motions was applied as input for the simulations based on historical records in Los Angeles, California (SAC, 1997). The suite consists of 60 pairs of time histories at three intensity levels: 2%, 10% and 50% probabilities of exceedance in 50 years. Thus, they are more characteristic of earthquakes expected to occur in the lifetime of a plant than the low likelihood earthquakes examined in SPRA. In order to observe failures in NSCs under these loads, equipment fragilities were assumed that are substantially less rugged than would be expected in a typical nuclear power plant. Because mean fragilities were assumed, the epistemic uncertainty in the equipment response is implicit. In order to evaluate the failure probabilities of two NSCs located on different levels of the building, their peak accelerations were determined for each simulation. Fig. 4.10b provides a zoom of Fig. 4.10a to display the very few cases where the acceleration of NSC1 is larger

Fig. 4.10a. Peak acceleration of NSCs.

lognormal distributions and estimation of failure probability of the NCSs. 4.1.3.1. Sampling of models. Dynamic characteristics of the auxiliary building depend on the mass (m1 and m2) and stiffness (k1 and k2) of the first and second stories of the structure. The mean values for the mass and stiffness of the structure were estimated based on the fundamental frequency. Due to potential construction errors or variation in the dimensions of structural components and uncertainty in material properties, it was assumed that the variation of mass and stiffness is represented by normal distributions with 5% coefficient of variation for each variable. The damping effect of the building structure was also considered with damping ratio (ζB). It is assumed that the value of ζB is uniformly distributed between 2% and 5%. These values are typical damping ratios for reinforced concrete and steel structures in practice (IBC, 2006). Several properties of the structural system were considered as stochastic variables to account for uncertainties in the simulations. All variables were treated as aleatory in nature. The stochastic variables include the masses of each story the two-story building m1 and m2, stiffness of each story of the structure k1 and k2, damping of the building ζB, and fundamental periods of NCS Tn. 10,000 sample sets were generated for m1, m2, k1, k2, ζB, Tn and ground motion histories. It is assumed that all heavy NSC in an auxiliary building are installed on the first floor. Therefore, the mass of the first floor (FL1) is considerably larger than that of the second floor (FL2). In addition, the structural stiffness (k1) of the FL1 is also larger than that of FL2. Therefore, the mean values of m1 and m2 are different, the mean value of m1 is twice larger than m2, and they are independently generated from different distributions. For each sample set, a dynamic analysis was performed in order to obtain the dynamic response of two floors at the locations of the equipment and the absolute accelerations of the equipment by solving

Fig. 4.10b. Peak acceleration of NSCs within the box in Fig. 4.10(a) zoomed. 12

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

Table 4.2 Conditional failure probabilities of NSC given GM sets. Correlation of Capacities of NSCs

Pf (NSC1|GMs)

Pf (NSC2|GMs)

Pf (NSC1 ∩ NSC2|GMs)

1 0.5 0

0.61 0.61 0.61

0.71 0.71 0.71

0.61 0.57 0.52

than that of NSC2. The red line in these figures represents the case of the acceleration of NSC1 equal to the acceleration of NSC2. Fig. 4.11. Seismically-induced flooding scenario of HPI pump rooms.

4.1.3.2. Estimation of failure probability. Table 4.2 presents the conditional failure probabilities for the NSCs with different levels of assumed correlation in their capacity response. The values for fully correlated capacities were determined using Eq. (4.4). Although these probabilities are shown with two significant figures, at the fifth significant figure the joint failure probability differs (is slightly smaller than) the probability of failure of NSC1. This difference represents a small set of events from the 10,000 samples for which the acceleration at Level 1 is actually greater than the acceleration at Level 2. For cases in which both the loads on the equipment and the fragility of the equipment are fully correlated, the joint failure probability would be identical to the smaller of the marginal failure probabilities. Thus, the correlation associated with the load is close to 100%. It is also possible to account for the degree of correlation in the seismic capacities of NSC1 and NSC2. The analysis accounting for correlation in the fragility curves for the two components was performed using bivariate sampling from the log-normal fragility curves. Monte Carlo sampling was performed using one million correlated draws from the fragility curve and the database of accelerations of equipment on Floor 1 and Floor 2 of the auxiliary building (see Fig. 4.9). For each draw, the value of the peak accelerations at Levels 1 and 2 were compared with the capacity of the component. If NSC1 failed, a tally would be given to failure of that component, if NSC2 failed, a tally would be given to that component and if they both failed a tally would be registered for joint failure. The total of the tallies was then divided by the total number of iterations (one million). Three levels of correlation of the seismic capacity of the two components were studied with ρ = 0, 0.5 and 1 in Equation (4.1). Even though NSC1 and NSC2 are on different levels of the auxiliary building, the correlation of the load is essentially unity for this case. As expected, the marginal failure probabilities of NSC1 and NSC2, which are unaffected by the correlation of the component fragilities, were determined to be 0.61 and 0.71. However, for the correlation in capacities (fragilities) of the two components less than unity, the joint failure probabilities are reduced as indicated in Table 4.2. The details of the Case 1 study are provided in (Hur et al., 2016b) and (Sezen et al., 2017a,b). Case Study 1 indicates that for a stiff building, loads at different regions of the building may be highly correlated. Rules of thumb regarding the degree of correlation for equipment located on different locations within a building must be used with caution.

any specific plant. The plant has two trains of diverse auxiliary feedwater (AFW) systems for which water is supplied from redundant CSTs. The CSTs are located in a building adjacent to the auxiliary building (see Fig. 4.11). In the basement of the auxiliary building there are two rooms containing High Pressure Injection (HPI) pumps. A single charging pump is located in Room 1 and two safety injection pumps are located in Room 2. The rooms are separated by a fire door. Two primary system pilot operated relief valves (PORV) are actuated through equipment located in cabinets on the first floor of the building. In the event of loss of feed-water and charging capability, the operators must open the PORVs and implement feed and bleed operations with the HPI safety injection pumps. FLEX equipment is located on site in a protected shed (not shown in Fig. 4.11), which can provide an emergency source of AFW. It can be moved to the location of a pre-existing interface with the feed-water system and connected. The source of water available to the FLEX system is not limited in this study. In the scenario examined, a seismic event leads to failure of one or both of the CSTs in addition to loss of offsite power. Failure of both CSTs would result in the loss of the water source for AFW and ability to remove heat from the primary system of the PWR. A flow path exists from the CST building to the auxiliary building, as illustrated in Fig. 4.11, such that the basement rooms of the building can be flooded. A drain system is modeled, which is initially insufficient to prevent flooding of basement rooms but ultimately results in dryout of the rooms after the water loss from the CSTs ends. If the water level in a room exceeds 2 ft in height, it is assumed that the pumps in that room will fail to operate. The door between basement Rooms 1 and 2 would fail when the water level in the first room reaches the 5-ft level (based on an example failure analysis in the literature). For this study, it is assumed that loss of the charging pump in Room 1 is unrecoverable. However, when Room 2 dries out, there is a possibility that the HPI function is recoverable. The success path that would avoid core melting is to manually operate the PORVs to depressurize the system to the point at which the low pressure emergency core cooling system can cool the core before melting is initiated. The potential for successful recovery depends on the timing with which AFW is recovered using FLEX equipment, the availability of HPI, and the time required to recover ability to operate the PORVs if the cabinets containing control equipment are damaged by the earthquake. Compounding the event is the potential failure of cabinets containing the controls for remote operation of the PORVs and the time required for operators to recognize and fix the problem. Similarly, the occurrence of aftershocks could delay recovery operations. It is assumed that, if the system has not been depressurized by 24 h, leakage of reactor coolant will result in uncovering of the core and severe fuel damage. A DET analysis was performed using the ADAPT code (Hakobyan et al., 2008) and the severe accident analysis code MELCOR (Sandia National Lab, 2006). Twenty two branching conditions were considered. 16,537 unique sequences were analyzed of which 13,008 resulted in core damage. The analyses required 158 processor-days and were performed over a period of 11.3 calendar days.

4.1.4. CRA case study 2: integrated seismic dynamic effects (Jankovsky et al., 2016) Case Study 2 examines the dynamic aspects of seismic risk with a seismically-induced failure of a CST resulting in the flooding and failure of critical safety equipment, the need for human actions to restore those safety functions, modeling of CCF of critical components, and the impact of aftershocks on human performance within the framework of a DET. The hypothetical power plant under consideration is a large fourloop PWR. The study demonstrates the type of analysis that needs to be performed but the results cannot be considered to be representative of 13

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

The following conditions and actions affect whether or not core damage is assessed to occur in a scenario: If AFW is restored with FLEX equipment, the pressure in the primary system would decrease and this rapid loss of inventory would stop. However, there are other leakage paths from the primary system, such as through reactor coolant pump seals, that would eventually lead to core uncovering if HPI is not reestablished. Because the consequences of core damage, accidents at high primary system pressure are potentially more severe than at low pressure. At some point in time the operator will depressurize the reactor coolant system with the PORVs, if they are operable. Although this could lead to core damage if the HPI system were unavailable, operation of the low pressure emergency core cooling system would be likely to arrest core damage prior to melt-through of the lower head of the vessel and limit the severity of the accident. Aftershocks are very likely to occur following a main shock. Depending on the scenario and the magnitude of the aftershock, the aftershock can result in additional damage to a structure or the failure of safety-related equipment. Following a severe earthquake, plant staff are sent around the plant to identify any failed equipment that could significantly impact the ability to establish or maintain a safe, stable state. The occurrence of aftershocks could make plant management reluctant to expose plant workers to a hazardous environment. For the purpose of this case study, we only examine the potential to delay recovery operations for aftershocks greater than 10% of the acceleration of the main shock. A model similar to the model derived by Reasenberg and Jones (1989, 1994) was developed predict the probability of aftershocks as a function of time. Eq. (4.6) is based on two well-known earthquake “laws”: the Omori Law, describing the decrease in the rate of aftershocks as a function of time after the initial earthquake and the Gutenberg-Richter distribution describing the frequency distribution of aftershocks as a function of earthquake magnitude. T

(t ) dt 10 a

= S

PGAm PA

2.3b

1 1

p

[(T + c )1

p

(S + c )1

recovery of operation of the PORVs, recovery of AFW flow by means of FLEX equipment, and recovery of HPI function after the room is dry:

• For the recovery of AFW by use of the FLEX equipment, it was as• •

sumed that at least 1 h was required to move the equipment from its storage location and make the necessary connections. After 1 h, recovery is represented by a Weibull distribution with scale factor λ = 1.28 and shape factor k = 1. For the recovery of HPI, it was assumed that after the water level in Room 2 in Fig. 4.11 had receded through floor drains that the HPI equipment could be restarted. A Weibull distribution was assumed with the values λ = 1.5 and k = 0.85 for HPI recovery probability. For the recovery of PORVs, it is assumed that the electrical cabinet containing the control logic to open the PORVs has failed but that the cabinet can be accessed by operating staff within 30 min. Time required to diagnose the problem and to obtain some means of imposing an appropriate signal to open the valves was represented by a Weibull distribution with λ = 1.24 and k = 1.73. However, the plant staff do not become aware that the PORVs are inoperable until the first attempt to open them remotely fails.

A Simplified Flooding Model (SFM) was developed in this project to describe the flooding of compartments following a seismic event. The model solves differential equations for fluid flow under the assumption that a single water level characterizes the depth of water within a room. The mass balance for a compartment is calculated as the net sum of water flowing into and out of a room in a time step. Flow between compartments and friction in pipes are accounted for using steady state correlations. The model has been benchmarked against the FLUENT code (ANSYS, 2011). In this case study the SFM was used to examine flooding of the two HPI rooms in the basement of the auxiliary building (see Fig. 4.11). The timing of failure associated with the flooding of HPI pumps and the subsequent dry out of the HPI rooms is determined in the analyses for different leak rates from failed piping from the CSTs. The sump is located under the auxiliary building and receives water flowing through the floor drains in the auxiliary building. Three flooding scenarios were considered associated with the failure of one or two CSTs with different flow areas (Table 4.4). For the case of a single tank failure (either tank), the water level exceeds 0.67 m at 385 s into the scenario, which would result in failure of the charging pump. At 1275 s the door between the two basement rooms fails and the HPI pumps soon fail. At 4840 s, the water level is effectively zero and actions could be taken to attempt to restart the safety injection pumps. For each of the scenarios the timing of failure of the HPI due to flooding and the time of room dryout are determined using the simplified flow model. These calculations were performed prior to running of the DET. The associated overall core damage frequency is approximately 1.2E−6 per yr.

p]]

(4.6) where λ(t) is the probability of one or more aftershocks per unit time. The symbol Λ denotes the mean number of aftershocks of magnitude PGA in the interval beginning with time S and ending with time T for a main shock acceleration of PGAm. The parameters α, β, p and c are empirically determined characteristics of a site. In the analysis it was assumed that any aftershock with a magnitude of 10 percent or greater than the main shock would lead to a 15 min delay in undertaking recovery actions. In the study of a real plant, it would be necessary to evaluate the magnitude of the delay through discussions with operators within the context of actual operating procedures. The seismic hazard for this study is based on an example of a seismic hazard curve provided by Ravindra (2014). The core damage frequency is evaluated at accelerations corresponding to three seismic return frequencies: 3E−5 yr−1, 1E−5 yr−1 and 1E−6 yr−1. Because the design basis earthquake is established at a return period of 1E−4 yr−1 and the design requirements assure a high confidence of a low probability of failure, the conditional probability of core damage at the design level is small. The failure mode of the CST is assumed to be failure of the bolts fastening the CST to the floor and the shearing of feed-water lines exiting the bottom of each tank. Table 4.3 shows the accelerations and the assumed fragility curves for the two CSTs and PORV electrical cabinets. The fragility parameters used were selected to demonstrate the methodology. It should not be assumed that they are representative of any existing plant. The marginal probability of failure of a component is obtained from the cumulative distribution function of the log normal distribution. The joint failure probabilities were obtained by integrating the probability density function as in Eq. (4.3) for a bivariate log normal distribution with correlation ρ. Three time critical recovery actions are considered in this study,

4.2. SSI effects In assessing the seismic hazard at a site, it is necessary to identify potential seismic faults in the neighborhood, assess the likelihood of given levels of energy release at the locations of the faults and then propagate seismic waves through the intervening rock and soil to the facility. The SSI affects the response of the building. Of particular interest are non-linear interactions. Within the scope of the LWRS program and in collaboration with universities and specialists, INL has been investigating non-linear aspects of SSI through the development and validation of the MASTODON computer code (Coleman et al., 2017). Case Study 3 (Section 4.2.1) investigates Fukushima events using non-linear SSI analysis (Varma et al., 2015). 4.2.1. CRA case study 3: Fukushima non-linear SSI analysis (Varma et al., 2015) This study was performed to compare results from a non-linear SSI 14

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

Table 4.3 Spectral accelerations and failure probabilities for CST failure by pipe rupture (Am = 1, β = 0.4, ρ = 0.5) and PORV electrical cabinets (Am = 1, β = 0.6894, ρ = 0.5). Exceedance Frequency (yr−1)

1E−4 3E−5 1E−5 1E−6

Condensate Storage Tanks (Sa at 5 Hz)

PORV Cabinets (Sa at 7.5 Hz)

Spectral Acceleration (Basemat)

Pr (A)

Pr (AB)

Spectral Acceleration (First Floor)

Pr(A)

Pr (AB)

0.17 0.32 0.6 1.8

4.7E−6 2.2E−3 0.10 0.93

Negligible 1.6E−4 3.3E−2 0.88

0.26 0.48 0.9 2.7

0.025 0.14 0.44 0.93

0.0047 0.055 0.28 0.87

Table 4.4 Results of analysis. Return Frequency (yr−1)

Conditional Core Damage Probability

3E−5 1E−5 1E−6

6E−5 1.3E−5 0.37

soil structure interaction (NLSSI) analysis to observed ground motions at the Fukushima Daiichi plant in the Great Tohuku Earthquake. Comparisons were made between the free field accelerations (without the effect of interaction with plant structures) and recorded data for the structural response of the basemat. It is expected that the nonlinearities in SSI will have the effect of reducing peak accelerations experienced by the plant as the result of energy dissipation associated with nonlinear soil behavior, nonlinear structure behavior and dissipation associated with gapping and sliding at the soil-structure interface. An objective of the case study was to determine those features that should be included in the MASTODON Code. The industry standard code, LS-DYNA (Livermore Software Technology Corporation, 2009) was used in the study. The reactor building and turbine building for Unit 6, a Mark II BWR containment design, were modeled. This is not one of the three units in which severe fuel damage resulted from the tsunami. However, the ground acceleration experienced was greater than the design basis earthquake. Soil properties were obtained from borehole measurements made at the site. Figs. 4.12 and 4.13 show how the overall system and the structures were characterized in the FE analyses. Three types of analysis were performed: a linear analysis, a nonlinear analysis including a soil material nonlinearity in the region of facility, and a geometric nonlinearity associated with gapping and sliding. The general interactions between soil and structure are illustrated in Fig. 4.14. Fig. 4.15 illustrates the areas of interaction associated with gapping and sliding. Results are provided in Table 4.5. An attempt to simulate the gapping (as may occur at the side of a structure when the soil separates from the building) and sliding (which can occur when the shear force at

Fig. 4.13. FEM of structures (Varma et al., 2015).

Fig. 4.14. Conceptual interface interactions between soil and structure (Varma et al., 2015).

the base of the structure exceeds the shear capacity of the soil) effects using the tiebreak contact option in LS-DYNA resulted in unrealistic amplification of the acceleration. The results provided for the case including gapping and sliding were obtained by adopting values for the

Fig. 4.15. Regions of gapping and sliding (Varma et al., 2015).

Fig. 4.12. FEM for soil/structure domain (Varma et al., 2015). 15

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

Table 4.5 Comparison of peak accelerations using linear and nonlinear SSI models in free field, basemat of reactor building and basemat of turbine building (LSSI: Linear Soil Structure Interaction, NLSSI-S: Non-linear Soil Structure Interaction with non-linear soil in close proximity to building, and NLSSI-G: Non-linear Soil Structure Interaction with gap elements at interface of soil and building). Model

LSSI

NLSSI-S

Location/Direction

EW

NS

UD

EW

NS

UD

EW

NS

UD

Free Field Reactor Building Turbine Building

0.580 0.496 0.512

0.457 0.319 0.341

0.370 0.433 0.385

0.602 0.421 0.432

0.392 0.286 0.286

0.454 0.360 0.352

0.579 0.475 0.474

0.428 0.297 0.276

0.385 0.351 0.348

fracture toughness and shear retention factors for the soil in contact with the basemats of the two structures. The time history analysis was based on ground motion data obtained at a depth of approximately 130 m in the near vicinity of Unit 6 over a period of 40 s that experienced the largest accelerations. The objective of the analysis was to test the hypothesis that nonlinearities could potentially reduce the maximum accelerations in the structural basemats relative to the values measured in the free field. Only two sources of nonlinearities were explored: soil material nonlinearity and geometric nonlinearity (gapping and sliding). The effect of accounting for soil nonlinearity was to reduce the maximum accelerations at the basemats of the two structures by 29% in the EW direction 50% in the NS direction and 22% in the UD direction. With the effect of gapping and sliding taken into account, the maximum accelerations in the EW direction were reduced by 18%, in the NS direction by 33% and in the UD direction by 9%. The attempt to simulate the geometric nonlinearity using gap elements resulted in similar responses to those obtained for the analysis of soil nonlinearity. No additional reduction in response was observed due to the nonlinearity at the interface. The results of this exploratory study indicated the need for more detailed investigations including consideration of: 1). frequency and amplitude of ground motion content, 2). improved modeling of soil nonlinearities, 3). improved modeling of the soil-structure interface, and, 4) calibration or validation of nonlinearity models using experimental data. Because the load on the basemat drives the analysis of the structural response and the transmission of loads to equipment, nonlinearities could potentially have a significant impact on the conditional probability of core damage.

NLSSI-G

Fig. 4.16. SPH approximation for field variable where W denotes an interpolation kernel in which h is the influence circle (INL-EXT-15-36773, 2015; Sampath et al., 2016).

by interpolating fluid quantities of neighboring particles using weighting functions as illustrated in Fig. 4.16 (Sampath et al., 2016). 4.3.2. CRA case study 4: flooding induced station blackout analysis (Mandelli et al., 2015) This case study addressed a hypothetical risk-informed regulatory decision regarding the potential effect of a power uprate on the probability of core damage in a tsunami induced flooding event. The study involved the application of a number of RISMC computer codes: NEUTRINO to determine the extent of inundation caused by the tsunami, RELAP-7 (Chang and Mosleh, 1998) to determine conditions under which core damage occurs and RAVEN for performing statistical analyses. In the accident scenario, a seismic event causes a loss of offsite power (LOOP) due to damage to both 500 kV and 161 kV lines. The reactor successfully scrams. The diesel generators operate supplying cooling capability to the reactor. A tsunami wave subsequently hits the plant. The tsunami is simulated in the analysis by introducing a bounding container at the perimeter of the model. Twelve million simulated fluid particles were added for the ocean volume. NEUTRINO calculations were performed for different wave heights and provided a realistic visualization to aid the analyst in interpreting results. Fig. 4.17 indicates the impact of initial wave height on the extent of inundation of the plant and the failure of diesel generators and switchyard flooding. Fig. 4.18 illustrates the difference in submergence of the vents to Diesel Generator 1 (DG1) and Diesel Generator 2 (DG2) as a function of time in the flooding event. Overflow into the vents was assumed to result in the failure of the emergency diesel generators to provide backup electricity and the initiation of station blackout. The NEUTRINO code is capable not only of accurately simulating this type of event but providing a realistic visualization to aid the analyst in interpreting results. In the overall case study, a number of parameters including wave height and various system recovery times were treated as uncertain parameters and assigned distributions. The RAVEN code was used to

4.3. Flooding risk assessment With the exponential increase in computer speed and data storage capability, computational fluid dynamics methods have been developed that are widely used for predicting time-dependent hydrodynamics. Nevertheless, in order to support the assessment of internal and external floods at NPPs, a computational tool is required that is computationally efficient, can handle highly complex geometries, can be used for large flow domains, and has high fidelity. It would also be beneficial to have a tool that can provide a visual rendition of flooding conditions. The SPH method was found to be well-suited for these applications (Prescott et al, 2015). The NEUTRINO computer code, based on SPH methodology, has been adapted to satisfy these requirements. 4.3.1. NEUTRINO code development SPH was originally developed to solve astrophysical problems by Gingold and Monaghan (1977) and Lucy (1977). It is a mesh-free Lagrangian simulation implying that the solution follows the movement of the flow rather than analyzing flow equations within a fixed grid. In the SPH approach the Navier-Stokes equations for fluid flow of a continuum are approximated by a set of particles. Physical quantities are estimated

16

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al.

Fig. 4.17. Plant inundation as a function of wave height (Mandelli et al., 2015).

Fig. 4.18. Timing difference in submergence of DG vents (Mandelli et al., 2015)

select random draws from these distributions to obtain a measure of CDF. Because the intent of the safety case was to determine the acceptability of a plant power uprate, CDF were obtained at the current and proposed increased power levels to determine the differential in CDF.

less associated with hypothetical maximum conditions, as in flooding design. Acknowledgments This research was performed partially with funding from the U.S. Department of Energy, Office of Nuclear Energy’s Nuclear Energy University Programs. The support provided for the project NEUP 135132 is greatly acknowledged.

5. Conclusions The application of PRA has not only improved our understanding of plant risk but has led to a substantial decrease in plant risk (Denning and Budnitz, 2018). The example case studies described in this paper demonstrate the potential value of CRA in reducing reliance on subjective judgment in PRA and providing a more realistic characterization of the risk of external hazards. The use of ROMs enables the performance of uncertainty analysis and dynamic analysis with practical computational effort. For the operator of an NPP, PRA represents a major financial commitment. The added cost of CRA in assessing the risk of external hazards cannot be justified for all applications. However, to the extent that CRA can provide greater realism in the characterization of the risk of external hazards, the additional computational expense can be warranted in assuring that risk-informed decisions associated with the design and operation of the plant truly reduce risk. As the NRC continues to move toward risk-informed regulations, the need for greater objectivity, validation and verification in PRA also increases. The need may be particularly true for EHPRA for which the regulatory design bases are expected to become more risk-based, as in seismic design, and

Appendix A. Supplementary data Supplementary data to this article can be found online at https:// doi.org/10.1016/j.nucengdes.2019.110341. References ABS Consulting, 2013. RISKMAN for Windows, Version 14.0. ABS Consulting, Irvine, CA. ACI 350.3, 2001. Seismic Design of Liquid-Containing Concrete Structures (ACI 350.3-01) and Commentary (ACI 350.3R-01). American Concrete Institute, Farmington Hills, MI. Aldemir, T., 2013. A survey of dynamic methodologies for probabilistic safety assessment of nuclear power plants. Ann. Nucl. Energy 52, 113–124. Alfonsi, A., Diego, M., Cristian, R., Cogliati, J., Kinoshita, R., 2013. RAVEN as a Tool for Dynamic Probabilistic Risk Assessment: Software Overview (No. INL/CON-1328291). Idaho National Laboratory. Althoff, E.C., 2017. Detailed and Simplified Structural Modeling and Dynamic Analysis of Nuclear Power Plant Structures. MS Thesis. The Ohio State University. Althoff, A., Hur, J., Sezen, H., Denning, R., Aldemir, T., 2017. Seismic evaluation of reduced-order models for auxiliary buildings. SMIRT-24 Conference, Structural Mechanics in Reactor Technology. Busan, Korea.

17

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al. Amendola, A., Reina, G., 1984. DYLAM-1, A Software Package for Event Sequence and Consequence Spectrum Methodology. EUR-924, CEC-JRC ISPRA Commission of the European Communities, Ispra, Italy. ANSYS Software Solutions, 2011. ANSYS/FLUENT 12.0 User’s Guide, www.ansys.com. ANSYS Software Solutions, 2017. “User Manual”, ANSYS Inc., Canonsburg, PA, USA. www.ansys.com. ASME, 2009. American Society of Mechanical Engineers. “Addenda to ASME/ANS RAS–2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications,” ASME/ANS RA-Sa-2009. Bohn, M.P., Lambright, J.A., 1990. Procedures for the External Event Core Damage Frequency Analyses for NUREG-1150, NUREG/CR-4840. Bohn, M.P., Shieh, L.C., Wells, J.E., 1983. Application of the SSMRP Methodology to the Seismic Risk at the Zion Nuclear Power Plant (NUREG/CR-3428). US Nuclear Regulatory Commission, Washington, DC. Budnitz, R.J., Apostolakis, G., Boore, D.M., 1997. Recommendations for Probabilistic Seismic Hazard Analysis: Guidance on Uncertainty and Use of Experts, NUREG/CR6372, Vol. 2. Budnitz, R.J., Hardy, G.S., Moore, D.L., Ravindra, M.K., 2017. Correlation of Seismic Performance in Similar SSCs (Structures, Systems, and Components, NUREG/CR7237. CAFTA, 1995. Fault Tree Analysis System for Windows, Version 3.1, User's Manual. SAIC and EPRI. Chang, Y.H., Mosleh, A., 1998. In: Dynamic PRA Using ADS with RELAP5 Code as its Thermal Hydraulic Module, Proc. PSAM 4. Springer-Verlag, New York, pp. 2468–2473. Coleman, J.L., Slaughter, A., Veeraraghavan, S., Bolisetti, C., Numanoglu, O.A., Spears, R., Hoffman, W., Hurt, E., 2017. MASTODON Theory Manual (No. INL/EXT-1741930). Idaho National Lab. (INL), Idaho Falls, ID. Denning, R.S., Budnitz, R.J., 2018. Impact of probabilistic risk assessment and severe accident research in reducing reactor risk. Prog. Nucl. Energy 102, 90–102. Dominion (Virginia Electric and Power Company), 2011. Characterization of the North Anna Seismic Event of August 23, 2011,” Report to U.S. Nuclear Regulatory Commission, Washington, D.C. EPRI, 1991. Electric Power Research Institute, A Methodology for Assessment of Nuclear Plant Seismic Margin, Revision 1,” EPRI NP-6041-SL, Electric Power Research Institute, Palo Alto, California. EPRI, 1994. Electric Power Research Institute, Methodology for Developing Seismic Fragilities, EPRI TR-103959, Electric Power Research Institute, Palo Alto, California. EPRI, 2013. Electric Power Research Institute, “EPRI (2004, 2006) Ground-Motion Model (GMM) Review Project”, 3002000717. Fan, J., Sezen, H., Hur, J., Althoff, E., Denning, R., Aldemir, T., 2017. Structural modeling and seismic analysis of condensate storage tanks. Proc. SMIRT-24 Conference, International Association for Structural Mechanics in Reactor Technology. Busan, Korea. Gaku, S., 2010. Experience of NCO Earthquake and Restart of the Kashiwazaki-Kariwa NPP. Tokyo Electric Power Company. GAO, 2012. U.S. Government Accountability Office. “Natural Hazard Assessments Could be More Risk-Informed.” Report to Congressional Requesters, GAO-12-465, Nuclear Regulatory Commission. https://www.gao.gov/assets/600/590431.pdf. Garrick, B.J., 1989. Lessons learned from 21 nuclear plant probabilistic risk assessments. Nucl. Technol. 84 (3), 319–330. Gingold, R.A., Monaghan, J.J., 1977. Smoothed Particle Hydrodynamics; Theory and Application to Non-spherical Stars. Monthly Notices of the Royal Astronomical Society, pp. 375–398. Hakobyan, A., Aldemir, T., Denning, R., Dunagan, S., Kunsman, D., Rutt, B., Catalyurek, U., 2008. Dynamic generation of accident progression event trees. Nucl. Eng. Des. 238 (12), 3457–3467. Haroun, M.A., Housner, G.W., 1981. Seismic design of liquid storage tanks. ASCE J. Tech. Councils 107 (1), 191–207. Housner, G.W., 1963a. The dynamic behavior of water tanks. Bull. Seismol. Soc. Am. 53 (2), 381–387. Housner, G.W., 1963. Dynamic Pressure on Fluid Containers, Technical Information (TID) Document 7024, Chapter 6, and Appendix F, U.S. Atomic Energy Commission. Hur, J., Kose, M., Sezen, H., Denning, R., Aldemir, T., 2016a. Development of seismic response models of a condensate storage tank. Seoul, Korea. PSAM13 13th International Conference Probabilistic Safety Assessment and Management. Hur, J., Sezen, H., Denning, R., Aldemir, T., 2016b. Assessment of the effect of structural model fidelity on the failure probability of nonstructural components. Seoul, Korea. PSAM13 13th International Conference Probabilistic Safety Assessment and Management. Hur, J., Althoff, E., Sezen, H., Denning, R., Aldemir, T., 2017. Seismic assessment and performance of nonstructural components affected by structural modeling. Nucl. Eng. Technol. 49 (2), 387–394. IBC, ICC, 2006. International Building Code. International Code Council, Inc. (formerly BOCA, ICBO and SBCCI) 4051 60478-5795. INL, Idaho National Laboratory, 2005. RELAP5-3D Code Manual Volume I: Code Structure, System Models and Solution Methods, Vol.1, Revison 2.4, INL-EXT-9800834. INL, Idaho National Laboratory, 2015. 3D Simulation of External Flooding Events for the RISMC Pathway, INL-EXT-15-36773. Izquierdo, J.M., et al., 2008. SCAIS (Simulation Code System for Integrated Safety Assessment): current status and applications. ESREL 2008. Saf., Reliability Risk Anal. 121–128. Jankovsky, Z., Denning, R., Aldemir, T., Sezen, H., Hur, J., 2016. Application of dynamic probabilistic risk assessment to a seismically-induced internal flood event. PSAM 13 13th International Conference Probabilistic Safety Assessment and Management.

Seoul, Korea. Kitada, Y., Hirotani, T., Iguchi, M., 1999. Models test on dynamic structure-structure interaction of nuclear power plant buildings. Nucl. Eng. Des. 192, 205–236. Kloos, M., Peschke, J., 2006. MCDET: a probabilistic dynamics method combining monte carlo simulation with the discrete dynamic event tree approach. Nucl. Sci. Eng. 153, 137–156. Livermore Software Technology Corporation, 2009. LS-DYNA Theory Manual. Lucy, L.B., 1977. A numerical approach to testing the fission hypothesis. Astronomical J. 82 (12), 1013–1924. Lysmer, J., et al., 1981. SASSI – A System for Analysis of Soil-Structure Interaction, UCB/ GT/81-02. University of California, Berkeley. MAAP5, 2016. Modular Accident Analysis Program – MAAP5 v5.04 for Windows, 3002007340, EPRI, Palo Alto, CA. Mandelli, D., et al., 2015. A flooding induced station blackout analysis for a pressurized water reactor using the RISMC toolkit. Science and Technology of Nuclear Installations Vol. 2015. Mandelli, D., Yilmaz, A., Aldemir, T., Metzroth, K., Denning, R., 2013. Scenario clustering and dynamic probabilistic risk assessment. Reliability Eng. Syst. Saf. 115, 146–160. Mazzoni, S., McKenna, F., Scott, M.H., Fenves, G.L., 2006. OpenSees command language manual, Pacific Earthquake Engineering Research (PEER) Center. McGrattan, K., Hostikka, S., McDermott, R., Floyd, J., Vanella, M., 2019. Fire Dynamics Simulator Technical Reference Guide, Volume1: Mathematical Model, sixth ed. NIST Special Publication 1018-1. McGuire, R.K., Silva, W.J., Constantino, C.J., 2001. Technical Basis for Revision of Regulatory Guidance on Design Ground Motions: Hazard- and Risk-Consistent Ground Motion Spectra Guidelines, NUREG/CR-6728. U.S Nuclear Regulatory Commission. MOOSE, 2019. Multiphysics Object Oriented Simulation Environment. http:// mooseframework.org. (accessed on May 5, 2019). NAS, National Academy of Sciences, 2014. Lessons Learned from the Fukushima Nuclear Accident for Improving Safety of U.S Nuclear Plants. The National Academies Press. NEI, Nuclear Energy Institute, 2012. Flexible coping strategies (FLEX) implementation guide, NEI 12-06, Washington, D.C. NFPA, 2015. Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, NFPA-805. National Fire Protection Association. NRC, Nuclear Regulatory Commission, 1975. The Reactor Safety Study, WASH-1400. NRC, Nuclear Regulatory Commission, 10 CFR 50.46, 1966. “Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors (1974) and Appendix K to 10 CFR Part 50, ECCS Evaluation Models, Code of Federal Regulations. NRC, Nuclear Regulatory Commission, 1988. Individual Plant Examination for Severe Accident Vulnerabilities, GL 88-20. NRC, Nuclear Regulatory Commission, 1989. Regulatory Guide 1.157, Best-Estimate Calculations of Emergency Core Cooling System Performance. NRC, Nuclear Regulatory Commission, 2002. “Perspectives Gained from the Individual Plant Examination of External Events (IPEEE) Program,” NUREG-1742. NRC, Nuclear Regulatory Commission, 2009a. Severe Accident Risks: an Assessment for Five U.S. Nuclear Power Plants, Final Summary Report. NUREG-1150. NRC, Nuclear Regulatory Commission, 2009b. Regulatory Guide 1.200, “An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,” Rev. 2. NRC, Nuclear Regulatory Commission, 2012. Central and Eastern United States Seismic Source Characterization, Joint NRC, EPRI, DOE Report, NUREG-2115. NRC, Nuclear Regulatory Commission, 2014. Standard Review Plan, NUREG-0800, Section 3.7.1. NRC, Nuclear Regulatory Commission, 2016. WASH-1400, The Reactor Safety Study, The Introduction of Risk Assessment to the Regulation of Nuclear Power Plants, NUREG/ KM-0010. NRC, Nuclear Regulatory Commission, 2018. An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.174 Revision 3. NRC, Nuclear Regulatory Commission, 2019. Title 10 Code of Federal Regulations, Part 52.79, “Contents of Applications; Technical Information in Final Safety Analysis Report. PEER, Pacific Earthquake Engineering Research Center, 2013. NGA-West2 Ground Motion Prediction Equations for Vertical Ground Motion, PEER Report No. 2013/24, University of California, Berkeley, CA. (2013). Prasad, R. et al., 2011. Design-Basis Flood Estimation for Site Characterization at Nuclear Power Plants in the United States of America, NUREG/CR-7046. Prescott, S., Mandelli, D., Sampath, R., Smith, C., Lin, L., 2015. 3D, Simulation of External Flooding Events for the RISMC Pathway (No. INL/EXT-15-36773). Idaho National Lab (INL), Idaho Falls, ID. Rabiti, C., Alfonsi, A., Mandelli, D., Cogliati, J., Martineau, R., Smith, C., 2013. Deployment and Overview of RAVEN Capabilities for a Probabilistic Risk Assessment Demo for a PWR Station Blackout, INL/EXT-13-29510. Idaho National Laboratory, Idaho Falls, ID. Ravindra, M.K., 2014. Session III. SPRA methodology seismic fragility analysis. Proceeding of Post-Symposium Seminar: Seismic PRA: Post-Fukushima Implementation. North Carolina. Reasenberg, P.A., Jones, L.M., 1989. Earthquake hazard after a Mainshock in California. Science 243, 1173–1176. Reasenberg, P.A., Jones, L.M., 1994. Earthquake aftershocks: update. Science 265, 1251–1252. Resio, D.T., Wamsley, T.V., Cialone, M.A., Massey, T.C., 2012. The Estimation of Very Low Probability Hurricane Storm Surges for Design and Licensing of Nuclear Power Plants in Coastal Areas, NUREG/CR-7134. US Nuclear Regulatory Commission, Washington, DC.

18

Nuclear Engineering and Design 355 (2019) 110341

H. Sezen, et al. SAC Joint Venture Steel Project Phase 2, 1997. “Project Title: Develop Suites of Time Histories” Pasadena, CA. Sampath, R., Montanari, N., Akinci, N., Prescott, S., Smith, C., 2016. Large-scale solitary wave simulation with implicit incompressible SPH. Ocean Eng. Marine Energy 2 (3), 313–329. https://doi.org/10.1007/s40722-016-0060-8. Sandia National Laboratories, 2006. NUREG/CR-6119, “MELCOR Computer Code Manuals, Vol. 2: Reference Manuals,” Version 1.8.6, Sandia National Laboratories. SAP2000 Program, 2017. Computers and Structures, Inc., Berkeley, CA. www.csiberkeley. com. Sezen, H., Hur, J., Kose, M.M., Denning, R.S., Aldemir, T., 2015. Mechanistic and probabilistic seismic assessment of structures and components in nuclear power plants. Manchaster, U.K.. Proc. SMIRT-23, Paper ID 651, International Association for Structural Mechanics in Reactor Technology. Sezen, H., Aldemir, T., Denning, R.S., Hur, J., Alemdar, F., Vaidya, N., Smith, C., 2017b. Uncertainty quantification in seismic probabilistic risk using detailed and surrogate models. Proc. SMIRT-24 Conference, International Association for Structural

Mechanics in Reactor Technology. Busan, Korea. Sezen, H., et al., 2017. Advanced Mechanistic 3D Spatial Modeling and Analysis Methods to Accurately Represent Nuclear Facility External Event Scenarios, Final Project Report NEUP 13-5142. https://neup.inl.gov/SiteAssets/Final%20%20Reports/FY %202013/13-5142%20NEUP%20Final%20Report.pdf (accessed on July 5, 2019). Smith, C.L., et al., 2008. Systems Analysis Programs for Hands-On Integrated Reliability Evaluations (SAPHIRE) Technical Reference, INL/EXT-05-00327, Rev. 1. Idaho National Laboratory, Idaho Falls, ID. Szilard, R., Smith, C., Youngblood, C.R., 2014. RISMC Advanced Safety Analysis Project Plan, FY 2015–2019, Light Water Reactor Sustainability Program, INL/EXT-1433186. Idaho National Laboratory, Idaho Falls, ID. Varma, A., Seo, J., Coleman, J., 2015. Application of Nonlinear Seismic Soil-Structure Interaction Analysis for Identification of Seismic Margins at Nuclear Power Plants, Light Water Reactor Sustainability Program, INL/EXT-15-37382. World Nuclear News, 2011 “US Plants on Flood Alert. http://www.world-nuclear-news. org/RS-US_plants_on_flood_alert-2006114.html (accessed on July 6, 2019).

19