Abstract
The German regulatory guide demands the performance of a probabilistic risk assessment (PRA) including external events. In 2005, a new methodology guideline (Methodenband) based on the current state of science and technology was released to provide the analyst with a set of suitable tools and methodologies for the analysis of all PRA events. In the case of earthquake, a multilevel verification procedure is suggested. The verification procedure which has to be used depends on the seismic risk at the site of the plant. For sites in areas with low seismic activity no analysis or only a reduced analysis is proposed. This paper describes the evaluation of safety margins of buildings, structures, components and systems for plants at sites with high seismic risk, corresponding to the German methodology guideline. The seismic PRA results in an estimation of core damage frequencies caused by earthquakes. Additionally, the described approach can also be adapted for the usage in a reduced analysis for sites with lower earthquake risks. Westinghouse has wide experience in performing seismic PRA for both BWR as well as PWR plants. Westinghouse uses the documented set of seismic design analyses dating from construction phase and from later updates, if done, as a basis for a seismic PRA, which means that usually no costly new structural mechanics calculations have to be performed.
1. Verification Procedure of the German Methodology Guideline
In the case of earthquakes, a multilevel verification procedure is suggested in the new German methodology guideline (Methodenband) [1] which requires a probabilistic analysis only for those nuclear power plants with an earthquake intensity on the site (DBE: Design Basis Earthquake, MSK: Medvedev-Sponheuer-Karnik-Scale, comparable with the European macroseismic scale (EMS)). For earthquake intensities between 6 and 7, a reduced analysis is possible by demonstrating sufficient safety margins to carry loads of an earthquake with an intensity of . For earthquake intensities above 7 a full scope analysis evaluating seismic fragilities for buildings, structures, mechanical, and electrical components is mandatory.
2. Seismic Hazard Analysis
Basis for a seismic PRA is a probabilistic seismic hazard analysis (PSHA) for the site estimating the frequencies for earthquakes to exceed a certain intensity as shown in Figure 1. In the PRA, the annual probability of exceedance for earthquakes will be used as initial values for the initiating events in addition to the seismic failure probabilities of buildings, structures, and components to estimate core damage frequencies in different intensity intervals.
While the annual probability of exceedance is given as a function of the earthquake intensity , the horizontal peak ground acceleration of the design basis earthquake is used as basis for the existing stress calculations for structures and components. Therefore, a mapping associating peak ground acceleration with intensity as in Figure 2 has to be established. Figure 2 shows pairs of variates for some German plants according to the German methodology guideline. This guideline suggests also a doubling of the peak ground acceleration with each step in intensity, also known as Cancani correlation, with respect to the design basis earthquake at the site of the plant. The Cancani approximation can be improved by the usage of site specific response spectra for different annual probabilities of earthquakes and for different intensities, respectively. Site specific response spectra have been estimated for different sites in Germany. Calculation of site specific response spectra results for example in lower peak ground acceleration values as a function of the earthquake intensity. Typically, commonly used standardized response spectra were applied for earthquake calculations during the construction phase of a plant. As Figure 2 shows, the estimation of site specific response spectra can provide quite large safety margins in a seismic PRA.
3. Identifying the Plant Specific Scope of the Analysis
To perform a seismic PRA, it has to be identified which plant specific beyond design-basis accidents, which lead directly to core damage sequences, and which design-basis accidents can be initiated by an earthquake. Therefore, all buildings, structures, and components have to be identified whose seismic-induced failure could lead to such accidents. Furthermore, it has to be identified which are the seismic relevant buildings, structures, and components of the corresponding safety systems needed to cope the design-basis accidents. Examples of beyond design-basis accidents are a collapse of the reactor building, breakdown of the reactor pressure vessel, and failure of all primary piping as well as a structural failure or loss of the integrity of the cooling system circuit of the fuel storage pool. As design-basis accidents loss of offsite power, loss of main heat sink and main feed water, loss of coolant accident (LOCAs) and an interaction with flooding of safety related systems have to be considered.
For the identified structures and components a screening procedure supported by plant walkdowns is employed to reduce the amount of detailed investigation based on the calculation of safety factors and the estimation of fragility curves.
4. Assumptions to Simplify the Analysis
To reduce the scope of the analysis some conservative assumptions can be made. Above earthquake intensity 6, for which the analysis is done, a loss of offsite power is directly assumed which also covers a loss of main heat sink and main feed water, so that the amount of structures and components to be investigated is significantly reduced by those structures and components whose seismic-induced failure can initiate such a transient. Furthermore, a failure of all parts of the plant which are not designed to withstand the loads of an earthquake is assumed. As pipes are relatively robust against seismic loads, the failure of single pipes which are connected to the reactor pressure vessel can be added to the beyond design-basis accidents which lead directly to a core damage. Emergency procedures and operator procedures which require human actions outside the control room are not considered since buildings and rooms may not be accessible after an earthquake. An exception to this are operator actions to guarantee decay heat removal from the fuel storage pool under the condition that its integrity is preserved, due to the long time available.
5. Screening
All components needed to cope with design-basis accidents as modeled in the Level-1-PSA have to be considered for a seismic evaluation. Additionally, all relevant passive components (e.g., heat exchangers, tanks, and piping including their corresponding hangers and supports) have to be added. To reduce the large amount of components, generic values for seismic rugged components from the literature, for example [2], or results of shake table tests can be used. The usage of the generic values for typical plant components has to be verified by plant walkdowns.
6. Plant Walkdowns
Plant walkdowns are an essential part of the seismic PRA to verify the screening done for seismic rugged components as mentioned in the previous chapter and also to support the estimation of safety margins on the basis of the existing stress analyses. Further goals of plant walkdowns are the identification of components with high resistivity against seismic loads and the identification of components where only a low resistivity is expected. Additionally nonsafety-related components or structures have to be identified which can impact safety-related components as a result of seismic failure, for example, through collision or falling.
Prior to the walkdowns, a detailed planning with identification of the structures and components to be reviewed has to be done, including the preparation of record sheets with component specific criteria and checklists. The plant walkdowns are performed by seismic qualification and system experts accompanied by experts from the power plant. A detailed recording of the plant walkdowns is mandatory. The documentation of the plant walkdowns comprehends the summary of the record and the preparation of a photo documentation.
7. Calculation of Safety Factors and Fragility Curves
Westinghouse uses safety margins in the existing stress calculations to extract safety factors and estimate fragility curves as a function of the peak ground acceleration as described in [3]. The failure probability of structures and components can be calculated by
describes the probability of failure during an earthquake with a peak ground acceleration A at the confidence level Q. and are the distribution function of the standardized normal distribution and its inverse distribution function. and describe the uncertainty and the scattering of the safety reserve factor . The safety reserve factor is a product of all individual safety factors described in (2) for the calculation of , the horizontal peak ground acceleration with the failure probability of 50% (Median):
is given by the acceleration of the plant design basis earthquake. Examples for safety factors of a building are the strength factor with 1.5, the factor for hardening of concrete by time with 1.2, the factor for inelastic energy absorption with 1.4, the factor for broadening of the response spectra with 1.1 or the factor for the attenuation of intensity with depth of the building in ground with 1.1. These factors result in a typical safety reserve factor of approximately larger than 3. Figure 3 shows the corresponding fragility curve calculated by (1).
The fragility curve, shown in Figure 3 for three different confidence levels Q, describes the building failure probability as a function of the horizontal peak ground acceleration. To calculate point values for the quantification of core damage frequencies the median curve with a confidence level of 50% is used. To derive safety factors out of the existing documents of the seismic design analyses, the construction company of the buildings should be consulted.
Examples for safety factors of a component, here a pipe, are the factors for broadening the ground and floor response spectra with 1.1 and 1.6, the factor for the attenuation of intensity with depth of the building in ground with 1.1, the strength factor with 1.3, the three hinge factor with 1.2, the factor for inelastic energy absorption with 2.2, and the factor for damping of the floor response spectra with 1.2. These factors result in a typical safety reserve factor of approximately larger than 7 for the example of a pipe. The corresponding fragility curve is shown in Figure 4.
Because of the high resistivity of a pipe against seismic loads only a part of the fragility curve with a confidence level Q of 95% is visible, whereas the median fragility curve coincides nearly with the -axis as indicated.
The procedure for using safety margins to calculate safety factors is described in detail in the German methodology guideline.
8. Modeling and Quantification
In the last step of the full analysis within the scope of a seismic PRA for plants at sites with high seismic risk, core damage frequencies are calculated for individual intensity intervals in the relevant intensity area as shown in Figure 5. The relevant intensity area reaches from a reasonable minimum intensity where no seismic-induced failure would be anticipated for earthquakes with lower intensities to a maximum value where the probability for the occurrence of an earthquake becomes negligible. According to the German methodology guideline, where no analysis has to be done (see Section 2) for plants with intensity 6 or less for the design basis earthquake, intensity 6 as minimum intensity was used in the example shown in Figure 5.
In order to estimate core damage frequencies, the existing Level-1-PSA model can be separately adapted for each individual intensity interval. As frequency for the initiating event of the anticipated design-basis accident (loss of offsite power), the annual probability of earthquakes to exceed the maximum intensity in each intensity interval is used. The seismic-related failures and unavailabilities of buildings, structures, and components, estimated by the fragility curves, are superposed with the corresponding stochastic unavailabilities.
For beyond design-basis accidents which cannot be coped with the existing safety systems, the core damage frequencies correspond directly to the annual probability of earthquakes from the hazard curve and the probabilities of the seismic-induced failure of buildings, structures, and components which lead to the beyond-design-basis accidents. For design-basis accidents the core damage frequencies result from the annual probability of earthquakes, the assumed probability that such an accident is caused by an earthquake and from the stochastic and seismic-related failure probabilities of the relevant buildings, structures and components which are needed to cope the accident. As described before, loss of offsite power is assumed already above intensity 6.
Figure 5 shows an example of calculated core damage frequencies in 11 intensity intervals from a seismic PRA for a German nuclear power plant. With increasing intensity, the initial annual probabilities of earthquakes become lower. In the last intensity interval, the remaining probability of earthquakes exceeding intensity 8.5 is directly added to core damage frequencies. At low earthquake intensities the anticipated loss of offsite power in conjunction with the stochastic unavailabilities of components dominates the result. This region of low intensities contributes with approximately 40% to the overall result. Seismic-related unavailabilities have nearly no influence. This supports the assumption that no earthquakes with intensities below 6 are to be considered. At high earthquake intensities the result is dominated by the seismic-induced failure of buildings and structures leading to beyond design-basis accidents. This region contributes with approximately 60% to the overall result. Improvements in the analysis due to site specific response spectra, as described in Section 2, lead to a reduction of core damage frequencies and therefore also to a reduction of the contribution of the high-intensity region to the overall result. The main contribution results from the failure of buildings and structures. The failure of components, especially of pipes, is only secondary.
9. Reduced Analysis
As described before, a reduced analysis is possible for plants at sites with earthquake intensities above 6 and equal or lower than 7. The procedure for this purpose is a considerably reduced procedure of the described full scope analysis. The verification of resistivity against seismic loads from an earthquake with one intensity step higher than the intensity of the design basis earthquake is done by fragility curves for individual buildings, structures, and components, which contribute by experience in a decisive way to the overall result. As criteria for the choice of the buildings, structures and components, which have a dominant influence on the overall result, experiences from previous PRAs, generic values for seismic-rugged components, plant walkdowns to identify components with low resistivity against seismic loads as well as the existing seismic analyses from the construction phase of the plant or from later updates, if done, can be used.
10. Summary and Experiences
Westinghouse used the procedure described by the new German methodology guideline during the development of a seismic PRA for a German BWR. Also a corresponding seismic PRA for a German PWR is currently in progress.
Due to the high core damage frequencies at low earthquake intensities caused by the conservatively assumed loss of offsite power in association with the stochastic unavailabilities of components, a modeling of all available safety systems is needed. The seismic-related unavailabilities of components are secondary, thereby their stability is the most important part. Normally, all documents needed for the analysis are available at the site from the construction phase, so that no costly new calculations have to be performed. To derive safety factors for buildings their construction company should be consulted. The described screening procedure results in a significant reduction of the number of components to be analyzed and of fragility curves to be created. Plant walkdowns can be limited to one to two weeks. An important safety factor results from realistic site specific response spectra in comparison to the usually conservative response spectra used for the design phase. For a full scope analysis approximately 10 fragility curves for buildings and structures and approximately 30 fragility curves for components and piping have to be calculated. The overall conclusion for the development of a German seismic PRA by using safety margins is, that the procedure described in the German methodology guideline is feasible and realizable with reasonable effort.
Acknowledgments
The authors gratefully acknowledge the persons who developed the section in the new German procedure guideline in which the procedures to perform a seismic PRA have been described. Special thanks are dedicated to the site personal for their valuable support during a multilevel development of a seismic PRA to verify the procedures described in the new German procedure guideline.