options for the treatment of uncertainty in seismic safety assessment of nuclear power plants

Pollack Periodica Preview

POLLACK PERIODICA An International Journal for Engineering and Information Sciences

DOI: 10.1556/Pollack.5.2010.1.x Vol. 5, No. 1, pp. xx–xx (2010)

www.akademiai.com

HU ISSN 1788–1994 © 2010 Akadémiai Kiadó, Budapest

OPTIONS FOR THE TREATMENT OF UNCERTAINTY IN SEISMIC PROBABILISTIC SAFETY ASSESSMENT OF NUCLEAR POWER

PLANTS

Tamas J. KATONA

Nuclear Power Plant Paks, 7031 Paks, Hungary, e–mail: [email protected]

Received 21 December 2009; accepted 8 February 2010

Abstract: One of the most complex cases for assessing the nuclear power plant safety is the evaluation of the response of the plant to an earthquake and calculation of the core damage frequency related with this. Plant level fragilities are convolved with the seismic hazard curves to obtain a set of doublets for the plant damage state. The standard methodology of the description of randomness and epistemic uncertainty of the fragility is based on the use of lognormal distribution. In the practice, because of large number and variety of types of components, variety of failure modes, further simplification is needed in spite of simplicity of the mathematic description of the fragility and its uncertainty. Sophisticated modeling and screening methods have to be applied for plant fragility development requiring enormous experience. Several practical assumptions utilized in the seismic PSA showing certain analogy with interval type description of uncertainties. In the paper an attempt is made for outlining some new options for nuclear power plant seismic fragility development based on the interval and p-box concept. The possibility for derivation of conditional probability of failure for cumulative absolute velocity is also highlighted. Keywords: Nuclear power plant, Seismic fragility, Uncertainty, Interval modeling

1. Introduction

The nuclear power production is an industry with high potential risk. Risk is expressed as triplets

{ }iii LpSR = , (1)


2 T. J. KATONA

Pollack Periodica 5, 2010, 1

where iS is an identification or description of scenario i, ip is the probability of that scenario and iL is a measure of the consequences/losses of that scenario. The consequences of nuclear accidents might be enormous; therefore high level of safety is required. Development of risk analysis techniques and experience gained in the application area has made it possible to evaluate quantitative measures of the safety. One of the most complex cases for assessing the nuclear power plant (NPP) safety is the evaluation of the response of the plant to an earthquake load and the risk related with this. The safety analysis demonstrates whether the reactor shall be shut down, cooled-down, the residual heat shall be removed from the core In case of an earthquake and the radioactive releases shall be limited below the acceptable level. In the practice the core damage frequency is the required output of the analysis. Well-defined set of plant systems and structures and components (SSCs) are required to be functional during and after the earthquake for complying with the above requirement. Some of these SSCs are passive, e.g. the pressure retaining boundaries. They shall sustain the vibratory load remaining leak-tight; however some plastic deformation, ductile behavior might be allowed. In some cases the deformation has to be limited to the elastic for ensuring some active functions. Building structures and equipment supporting structures might be also loaded to plastic region up-to the level, which does not impair the intended safety functions. The active systems functionality requires qualification for the vibratory motion as well as availability of supporting functions, e.g. electrical power supply. The frequencies of core damage caused by an earthquake are calculated by plant logic convoluting with component fragilities, see [1] and [2]. Event trees are constructed to simulate the plant system response. Fault trees are needed for the development of the probability of failure of particular components taking into account all failure modes. The hazard is expressed as complementary probability: 1-cumulative probability function, i.e. probability that the peak ground acceleration (PGA) exceeds a given value. The fragility is defined as the conditional probability of core damage as a function of a - PGA at free surface. In the probabilistic safety assessment for seismic events (seismic PSA) modeling of complex component behavior requires Boolean description of sequences leading to failure. Plant level fragility is obtained by combining component fragilities according to the Boolean-expression of the sequence leading to core damage. The plant level fragility is defined as the conditional probability of core damage as a function of free field PGA at the site. Plant level fragilities are convolved with the seismic hazard curves to obtain a set of doublets for the plant damage state. For evaluation of core damage frequency the doublets { }ijij fp , has to be obtained,

where ijf is the seismically induced plant damage state frequency,

( )∫∞

′′−=0

adda

dHaff j

iij , (2)

https://www.researchgate.net/publication/222802124_Seismic_fragilities_for_nuclear_power_plant_studies?el=1_x_8&enrichId=rgreq-2c74a8bc-63fa-4c75-82b5-866a84eedaf6&enrichSource=Y292ZXJQYWdlOzIzMzgxNjI0NztBUzoxMDM5NDYxNDgzODQ3NzBAMTQwMTc5NDEwMTI1Ng==


SEISMIC PROBABILISTIC SAFETY ASSESSMENT OF NUCLEAR POWER PLANTS 3


where ijp is the discrete probability of this frequency jiij pqp = , iq is the probability

associated with of thi − fragility curve, ( )iaf and the jp is the probability associated

with thj − hazard curve, jH .

The fragility curve, ( )iaf is the thi − representation of the conditional probability of core damage (plant failure resulting into core damage). The dadH j is the probability density function of the applied seismic load expressed in terms of peak ground acceleration, taken from the thj − hazard curve.

The acceptable level of the annual probability of reactor core damage is: 510− or less. Since the level of probability to be assessed is very low, the assessment of seismic loads, i.e. assessment of seismic hazard has to be performed up to very low level of annual probability: 710− or less. Consideration of uncertainty in both fragility and seismic hazard is important for adequate safety assessment. The above formulation uncouples the uncertainties in the load and resistance parameters, embodied in the in the fragility and load probability density functions respectively. These uncertainties are usually of different origins and it is convenient to be able to treat them separately. Considering the latest results of seismic safety analysis of nuclear power plants there is an obvious need for further development. Some of the reasons have to be mentioned:

• The basis of the methodology outlined above has been developed in early eighties. It was motivated by the need of assessment of seismic (or even more generally, external event) vulnerabilities of existing power plants. The methodology has been applied for over 50 nuclear power plants worldwide.

• The seismic probabilistic safety assessments of plenty of nuclear power plants show that the earthquakes are the dominating contributors to the core damage, i.e. to the overall risk. This experience became very important for countries where the regulation sets probabilistic targets for safety. In these cases the seismic PSA results are considered together with results of PSA for internal initiators for justification of compliance with probabilistic targets. Moreover it is required also, that the initiators should have a balanced contribution to the total core damage frequency. For example, in case of Paks nuclear power plant, the contribution of seismic events to total core damage frequency exceeds 75%. This is valid for the other plants, too (see for example Fig. 1 showing a qualitative representation of PEGASUS-project results for a Swiss NPP [3]).

Comparing the probability density function of core frequency due the different contributors, one can see, the seismic contributor probability density function is spread over wide range of values, and dominates at tails of distribution. The findings indicate that the seismic probabilistic safety assessment results are very much affected by inherent uncertainties of the methodologies for quantification the seismic hazard and plant fragility. Uncertainties play essential role while dealing with very low probability earthquakes, due to lack of statistical evidence for rare events. As it is to see in Fig. 2 the uncertainties dominate at low probabilities [4].


4 T. J. KATONA


1.E-08 1.E-07 1.E-06 1.E-05 1.E-04 1.E-03

Core Damage Frequency [per year]

Prob

abili

ty D

ensi

ty

Total Core Damage

Non-Seismic Events

Seismic Events

Mean

Median

Fig. 1. Probability density function of the core damage frequency ([3] for qualitative comparison)

Fig. 2. Hazard curves for NPP Paks site [4]

It has to be mentioned: concentrating the designer effort for safety improvement for annual frequencies lower than 10-5 might be useless; practically there is very limited chance for increase of safety which would lead to better picture as it is plotted in Fig. 1.




Considering the fragility aspects of the issue, the analysis might not take into account the real robustness of nuclear design while assessing the fragility of the SSCs. The methodologies for fragility development might be a’priori conservative for accounting the randomness of the phenomena (aleatory uncertainty). Also the modeling of the structure and description of its behavior is uncertain (epistemic uncertainty). There are limited only experimental evidences regarding behavior of complex structures and their testing is also difficult (the real earthquakes produce empirical evidences). As it can be seen in [1] and [2] basis for definition of the fragility is mainly based on extrapolation of the design and qualification testing information. Wide use of generic fragilities and simplified conservative screening rules increase also the seismic core damage frequency. It has to be mentioned that in the practice the seismic fragility development needs enormous experience and specific knowledge in seismic and structural engineering, also involvement very high qualified system engineers. Experience shows that plants survive much larger earthquakes than it has been considered in the design base. One can conclude that the design basis capacity does not provide information about failure in case of a particular earthquake. The plants show extreme robustness and very moderate response as it was the case at Onagawa NPP in 2005, Shika NPP in 2007, Kashiwazaki-Kariwa NPP in 2007, Hamaoka NPP in 2009. Best example is the case of Kashiwazaki-Kariwa NPP, where the Niigata-Chuetsu-Oki earthquake in 2007 caused a 0.67g maximum horizontal acceleration (at base mat of the Unit 1). The safety classified SSCs designed for PGA 0.27g survived the earthquake without damage and loss of function while the non-safety structures were heavily damaged. Nevertheless the world’s largest rated NPP was shut down, only two of seven units started to operate again after more than two years after the earthquake. Obviously, there is a need for reliable justification of plant safe status after felt earthquake for avoiding long shutdown time and consequent economic losses. Recently international the research activities are going on, for example in the frame of International Atomic Energy Agency, in the area of hazard characterization and fragility development triggered mainly by Onagawa and Kashiwazaki-Kariwa nuclear power plant cases. In case of new generation of plants the seismic contribution to the total core damage frequency became a more critical issue since the internal events core damage frequency is very low. The new plants design features affecting the functioning in case of earthquake are rather different from those in old vintage plants. The empirical fragility development (assumptions regarding robustness) might not be applicable for the new designs. Therefore new developments and R&D effort have to be made for improving the methodology of seismic PSA and fragility analysis. In the paper the authors view is presented regarding possibilities for improvements of seismic fragility developments for nuclear power plants. Two aspects of treatment of the uncertainty for plant fragility are considered:

• possibility for derivation of conditional probability of failure for cumulative absolute velocity as load parameter, instead of PGA;

• utilization of some new achievements in probability theory like interval and p-box theory for the better description of SSCs behavior.



6 T. J. KATONA


The paper highlights some options for further discussion and consideration rather than a closed up methodology.

2. Representation of the fragility

2.1. Development of the fragility

Following the logic represented by Eq. (3), the uncertainty in plant level fragility is displayed by developing a family of fragility curves; the weight (probability) assigned to each curve is derived from the fragility curves of components appearing in the specific plant damage state accident sequence, i.e. the process of development of plant fragility starts with identification of failure modes and corresponding conditional probability distribution function for SSCs required for ensuring the safety. The capacity for a given failure mode is characterized by a lognormal probability distribution. The lognormal distribution is the consequence of representing the capacity C as a product of the median capacity mC and factors iX , which are random variables accounting the different (random value) margins to fail:

∏=

=n

iim XCC

1. (3)

According to the central limit theorem for products, the distribution of the dependent variable tends to be lognormal regardless of the distribution of the independent basic variables iX . The capacity might be expressed also in terms of SSE capacity, when taking SSEC the design basis capacity for the reference instead of mC median capacity, and

∏=

∏=

==n

iiSSE

n

iim XkCXCC

11, (4)

where SSEm CCk = . This concept is based on the accounting factors of safety, i.e. margins, introduced during design procedure. For example, for structures the factor of safety can be expressed as SRS FFFF µ= ,

where SF represents the ration of ultimate strength, µF accounts the ductility and

SRF is the structural response factor accounting the margin for covering the response variability due to variability of the ground motion and deviation between design and actual damping, modeling assumptions, etc.




The SRF can be expressed as product of particular factors: ∏ iF . The same method is applied further while describing the equipment response factor. Further details see in [1]. Thus, the capacities of respective failure modes may be assumed log-normally distributed with median capacities and logarithmic standard deviations to account for uncertainty in the parameters. Considering the epistemic and aleatory uncertainty, the capacity for a given failure mode may be described by the following expression:

URmCC εε = (5)

where Rε is a log-normally distributed random variable having a unit median value and a logarithmic standard deviation Rβ representing the uncertainty due to randomness, and Uε is a log-normally distributed random variable with a unit median value and a logarithmic standard deviation Uβ representing the epistemic uncertainty. According to this the frequency of failure f ′ at any non-exceedance probability level Q can be written as follows:

( ) ( )⎥⎥⎦

⎤

⎢⎢⎣

⎡ +=′

−

RUm QCaf

βϕβφ

1ln , (6)

where ( )affPQ ′<= , and ϕ is standard normal cumulative distribution function. According to [1] and [2] the High Confidence of Low Probability of Failure capacity is correlated by median capacity as follows:

( ) CUR eCeCHCLPF mmcapacity βββ 33.265.1 −+− == , (7)

where 22URC βββ += .

Once the potential failure modes of a particular SSC are identified, failure criteria are to be established from which the median capacities are estimated. For each failure mode, the median capacities are to be evaluated by conducting limit state analyses using the specific failure criteria with the applied loading and operating conditions, etc.

3. Issues in fragility development and proposals for improvements

3.1. Fragility versus CAV

The design basis capacity SSEC does not provide sufficient information about possibility of failure of complex systems like nuclear power plants or its rather complex SSCs in case of earthquake. The capacities SSEC and mC are scaled in PGA. The




8 T. J. KATONA


experience shows that the PGA is not the most appropriate damage indicator. One can say, that the structure will not fail for sure if the design base earthquake (or Safe Shutdown Earthquake - SSE) will happen (high confidence of low probability of failure - HCLPF). However, it is not obvious whether the structure will resist or fail if an earthquake will happen with PGA higher than those for SSE. Besides of the randomness of the resistance of the structure, damage of the structure may depend on the PGA, length of strong motion, frequency content of the vibratory motion, etc. Therefore it is rather difficult to validate the fragility as conditional probability of failure versus PGA. The studies performed by EPRI regarding failure indicators show that the cumulative absolute velocity (CAV) could be better correlated to damage rather than the PGA [5]. The EPRI studies validate the lower bound of standardized CAV for damage of non-engineered structures. U.S. NRC Regulatory Guide 1.166 defines the criteria for exceedance of operational base earthquake (OBE) level. Recently the case of Kashiwazaki-Kariwa NPP motivates other type of studies: finding of damage indicators, including CAV, empirical intensity scales, etc. relevant for nuclear power plant SSCs. CAV is calculated as simple integral over the time history of absolute value of acceleration component:

( )∫=τ

0dttaCAV . (8)

The standardized CAV is calculated applying a noise-filter for the amplitudes less than ±0.025g [6]. This condition affects also the length of the time history to be taken into account. The variability of standardized CAV at fixed PGA could be essential. This is illustrated on the Fig. 3. Obviously CAV is depending on several features of the acceleration time history: maximum amplitude (PGA), time of strong motions T, spectral composition of the time history, etc. Most explicit, nearly linear dependence might be expected regarding length of time window. Considering time histories with same spectral composition (PSD), CAV is depending on the PGA approximately linearly. One can calculate also the CAV corresponding to the design response spectra via generation of artificial time histories reproducing the design spectra and integrating the time history over the strong motion window. The variability of CAV caused by variability of spectral composition of the time history might be limited if the required accuracy for reproduction of design spectra is fulfilled (assuming also that the strong motion window is also fixed in the design). For the use of CAV in the seismic PSA there are several steps to be made. The trivial one is to convert the methodology based on PGA into methodology using standardized CAV via establishing a relationship between CAV and PGA (see Fig. 3):

( )CAVga 1−= . (9)




Fig. 3. Correlation between PGA and CAV (developed on the basis of [7])

In this case the CAV has to be calculated for spectra and time window used in the design. The variability of CAV should be accounted in this case, e.g. using some fractiles, which are defined on the empirical distribution for set of artificially generated time histories fitting for the design spectra. Obviously there is no benefit from this procedure. Dependence of CAV as damage indicator on different features of the vibratory motion (length of strong motion, frequency content, PGA) mentioned above indicates that probability of damage/failure is depending on a load vector ( )L,, 21 xx=X rather than on a single parameter

( ) ( )∫=R

fail dxdxxxPxxhP LLL 212121 ,,,, (10)

where ( )L,, 21 xxh represents the hazard, i.e. the ( )L,, 21 xxh is the probability density function of applied loads in terms of CAV and ( )L,, 21 xxP denotes the conditional distribution function of failure. This approach might seem theoretically precise, however definition of the dependence of fragility on the components of the load vector requires enormous effort. Also the characterization hazard should correspond to the description of fragility.


10 T. J. KATONA


The real need is to establishing a method based on use of CAV as a nonnegative single load parameter 0≥x . (For the sake of simplicity of writing CAV will be denoted below simple by x.). Eq. (2) should be rewritten as follows:

( ) ( )∫∞

=0

dxxPxhPfail . (11)

Assuming that, if a failure occurs for a value of CAV equal to x, then it is occurs for all values larger than x. In this case the conditional probability distribution function

( )xP coincides with the cumulative probability distribution function of the failure load parameter λ , i.e. of the smallest value of the load parameter that the structure is unable to withstand [8],

( ) ( )xxP ≤= λProb . (12)

From the equation above we can calculate the average value of the failure load parameter, i.e. the average CAV-value of failure:

( )∫∞

′′=0

xddx

xdPxλ . (13)

With other words, for the effective use of CAV in fragility analysis, the value λ has to be evaluated from the empirical data (damages of earthquakes, fragility tests) for all type of SSCs and failure modes. Obviously, the experience and knowledge embodied in the fragility development in terms of PGA should be utilized in the frame of a CAV based methodology, too. Moreover, the use of fragilities expressed in terms of PGA might be reasonable in case of some component types and failure modes.

3.2. Options for fragility representation and uncertainty accounting

Not practical to quantify the seismic PSA models using continuous families of seismic hazard curves and associated equipment fragility distributions. Instead of using families of seismic hazard curves, { }jj Hp , as well as the set of equipment fragility

distribution, { }ii fq , point-estimates of hazard and fragility are used with subsequent uncertainty analyze. Moreover, in the practice the hazard curve is approximated by stepwise function with low number of intervals (<10) and the same might be done for the approximate representation of fragility curve. Eq. (2) might be rewritten as follows:

( )∫∞

∑= ⎪⎭

⎪⎬⎫

⎪⎩

⎪⎨⎧

⎟⎠⎞

⎜⎝⎛≈

′−=

0 1

~n

kk

kk a

dadHfda

addHaff ∆ , (14)




where ( )af and addH ′ denote the selected point estimates of hazard and fragility

sets. Each failure fraction f~

represents the mean conditional likelihood for the given seismic induced failure at the designated seismic acceleration interval [ ]1, +kk aa . For example, in case of seismic PSA for Paks NPP, seven acceleration ranges have been defined [9]. The lower bound is 0.07 g, this corresponds to the lowest seismic capacity for all SSCs. The upper bound 1.0 g is the highest acceleration evaluated in the seismic hazard analysis. The intervals ka∆ have been defined assuming that the frequencies may change more slowly at higher accelerations. The recent practice the analysis of uncertainties is based on the probability theory: point estimates are used in combination with Monte-Carlo sensitivity analysis. Another method for describing and quantifying uncertainty in the model represented by Eq. (14) can be based on interval probability or p-box theory. Instead of point estimates, the upper and lower bounds of the distribution functions might be used for replacing the sets { }jj Hp , and { }ii fq , by probability boxes

specified by a left side and a right side distribution functions. For the fragility the following representation can be applied (see e.g. [10] and [11])

{ } ( ) ( )[ ]xFxFfq ii ,, → , (15)

where ( ) ( )[ ]xFxF , is the probability-box specified by a left side ( )xF , and a right side

( )xF distribution functions, where ( ) ( )xFxF ≤ for all ℜ∈x , consisting of all non-

decreasing functions ( )xF from the reals into [0,1] so, that ( ) ( ) ( )xFxFxF ≤≤ .

( ) ( )[ ]xFxF , is a p-box for a random variable x whose distribution ( )xF is unknown

except that it is within the p-box. From a lower probability measure P for a random variable X , one can compute upper and lower bounds on distribution functions using formula

( ) ( )

( ) ( ).

,1

xXPxF

xXPxF

x

x

≤=

>−= (16)

It is often convenient to express a p-box in terms of its inverse functions d and u defined on the interval of probability levels [0, 1]. The function u is the inverse function of the upper bound on the distribution function and d is the inverse function of the lower bound. These monotonic functions are bounds on the inverse of the unknown distribution function F ,


12 T. J. KATONA


( ) ( ) ( )pupFpd ≥≥ −1 , (17)

where p is probability level. The most trivial case for the use of p-box is the screening according to ruggedness of the component. The screened out SSCs with certain HCLPF capacity are assumed to resist a given level of vibratory motion. The failure fractions for each group of components are determined by their respective screening fragility distributions. An adequate quantification of uncertainty is important when similar types of equipment are combined in a single group in the PSA model, based on the similarity of seismic capacities and are expected to fail at approximately the same acceleration. The rugged components might be described by p-box with a lower bound x (PGA or any other damage indicator) below of that no failure may occur and an upper bound of x above that the failure will occur for sure. In this case the only information needed (or available) is that

⎪⎩

⎪⎨⎧ ≤

=

⎪⎩

⎪⎨⎧ ≤

=

,otherwise,1, if,0

,otherwise,1, if,0

xxP

xxP

fail

fail

(18)

where p-box might be defined in case when the minimum, maximum or median and/or other percentiles of failure distribution are known. The probability bounds might be calculated for cases in which the distribution family is specified by interval estimates of the distribution parameters. If the bounds on mean, µ and standard deviation σ are known, bounds on the distribution can be obtained by computing the envelope of all lognormal distributions L that have parameters within the specified intervals:

( ) ( )

( ) ( ),min

,max

1

1

pLpu

pLpd

−

−

=

=

αα

αα

(19)

where ( ) [ ] [ ]{ }2121 ,,,, σµσσµµµσµα ∈∈∈ , see Fig. 4. Real benefit from this type of representation of probability distribution might be obtained if the fragility of a particular failure mode of a component is known approximately only, small sample size of damage histories, inconsistency of data, or the modeling of failure component is uncertain (e.g. if the set of possible failure modes might be incomplete).




Fig. 4. p-box for lognormal distribution with ( ) [ ] [ ]{ }2,1,2,1, σµσσµµµσµα ∈∈∈

The same procedure might be applied generally, i.e. to the fragility and hazard functions. Interval representation might be also applied to the Eq. (14) as it is shown below

[ ] [ ]{ }∑→∑⎪⎭

⎪⎬⎫

⎪⎩

⎪⎨⎧

⎟⎟⎠

⎞⎜⎜⎝

⎛

==

n

kkkkk

n

k kk hhff

daHdf

11 ,,,

~~ (20)

where [ ]kk ff , and [ ]kk hh , are stepwise interval representations of the point

estimates of hazard ( ) ( )da

adHah = , and fragility functions ( )af in equation (14).

Considering the trivial case of known lognormal distribution for upper and lower bounds of the box the 5% and 95% of confidence might be selected and for the

acceleration intervals [ ]1, +kk aa and [ ]kk ff , pairs might be calculated as it is shown

in Fig. 5. It seems that some practical assumptions in the seismic PSA, e.g. the screening are based on considerations, which could be interpreted easily by interval algebra and p-boxes.


14 T. J. KATONA


Fig. 5. Bounding distributions and pairs [ ]1, +kaka and [ ]kfkf , for Eq. (20)

3.3. Modeling of component and plant failure

The basic seismic PSA methodology (see Eq. (2)) requires combination (convolution) of the family of plant level fragility curves with component fragility curves according to the Boolean expression for the accident sequence. Assuming that a system is composed by two components and each component has n fragility curves, with specified probabilities, the procedure consists of performing the required operation (union or intersection) on two components at a time, for each of the n fragility curves. When the uncertainties in the median fragilities of two components are independent, this results in 2n fragility curves, representing the fragility of the combined event, which are then condensed back to n curves. If the median fragility uncertainties are perfectly correlated, only n fragility curves result. In either case, the final n fragility curves of the combined event are then combined with the n curves of another component. This process is continued until all the component fragilities have been combined as specified by the Boolean expression, finally resulting in n plant level fragility curves. Considering the practical applications of seismic PSA there are plenty of failure modes to be accounted in the model. Proper modeling and accounting of ductile behavior of structures is of great importance (see e.g. [10]). Active components typical failure modes are the stretching or loosing, distortion/deformation, drop out of parts, impact/contact, flooding/spraying. Typical failure modes of passive components are breaking, distortion/deformation, drop out of




parts, impact/contact, flooding/spraying. Typical numbers of failure modes identified for different types of components are:

• for heat exchangers (e.g. damage of main body, flange part, heat exchanging tubes, supports, nozzles);

• for valves (e.g. malfunction of drive, yoke damage, leakage from valve seat, loss of structural integrity);

• for horizontal pumps (e.g. damage of fixes, supports, damage of shaft, shaft joints, mechanical seal, bearing, loss of power, damage of nozzle part).

The methods mentioned above allow convolution of several failure modes in the fault tree of a component. Calculation of failure fractions for load intervals [ ]1, +kk aa provides certain flexibility in the plant modeling especially when the plant model represented by event trees depends on the excitation level for example due to onset of new global failure modes, e.g. soil liquefaction. Explicit numerical methods exist for computing bounds on the result of addition, subtraction; multiplication and division of random variables when only bounds on the input distributions are given (see e.g. [11] and [12]). These algorithms have been implemented in software and have been extended to transformations such as logarithms and square roots, other convolutions such as minimum, maximum and powers, and other dependence assumptions.

Conclusion

Seismic probabilistic safety assessment became recently high importance. Reliable methods for justification of the plant safety is needed for the cases when earthquakes hits the plant and causing practically no damage and shorten the shutdown periods after the events is rational. Adequate assessment of seismic safety of newly developed and built plants is also required. Therefore the weak points of existing seismic PSA methodologies and the options for improvements have to be identified. One of the basic issues of seismic PSA development is the definition of component and plant fragilities. Sparse statistical information exists on behavior of complex structures/machines under earthquake loads. Fragility test of components might be very expensive. The experimental data does not provide information on all possible failure modes. Epistemic uncertainty in the failure modeling might be substantial. One possible way for the seismic PSA improvements might be the utilization of bounding approach as outlined in the paper. A bounding approach to risk analysis extends and complements traditional probabilistic analyses when analysts cannot specify precise parameter values for input distributions or point estimates in the model, precise probability distributions for some or all of the variables in the risk model, nature of dependencies between variables or even the exact structure of the risk model. Upper and lower bounds on parametric values can be provided, typically from expert elicitation. There are several advantages of utilization of interval and p-box description of uncertainties. The proposals for improvement of fragility description outlined in the paper represent combination interval analysis and probability theory. Probability bounds can be


16 T. J. KATONA


calculated for distribution families using only interval estimates for the parameters or having information only on {min, max} or {min, max, mode} or {min, max, mean} of the variable. Explicit numerical methods exist for computing bounds on the result of addition, subtraction, multiplication and division of random variables when only bounds on the input distributions are given. These methods are successfully used in other areas of risk analysis. In the seismic PSA practice the component fragility development is based on the design information anchored into PGA. Other representation of load, for example using cumulative absolute velocity as load parameter may improve the calculation of probability failure. As outlined in the paper, for the improvement of fragility description using CAV the average value of the failure load parameter, i.e. the average CAV-value of failure has to be empirically determined.

References

[1] Kennedy R. P., Ravindra M. K. Seismic fragilities for nuclear power plant risk studies, Nuclear Engineering and Design, Vol. 79, 1984, pp. 47–68,

[2] ANSI/ANS-58.21-2003, External Events PRA Methodology, March 2003. [3] Richner M., Tinic S., Ravindra M. Comparison of PEGASOS results with other modern

PSHA studies, OECD/CSNI-Workshop on Recent Findings and Developments in PSHA Methodologies and Applications, Lyon, April 7-9, 2008, pp. 573–591.

[4] Tóth L., Győri E., Katona T. J. Current Hungarian practice of seismic hazard assessment: methodology and examples, OECD/CSNI-Workshop on Recent Findings and Developments in PSHA Methodologies and Applications, Lyon, April 7-9, 2008, pp. 313–344.

[5] ASCE/SEI 43-05, Seismic Design Criteria for Structures, Systems, and Components in Nuclear Facilities, 2005.

[6] U.S. NRC Regulatory Guide 1.208, A Performance-Based Approach to Define the Site-Specific Earthquake Ground Motion, March 2007.

[7] Akkar D. S., Gülkan P. Estimation of cumulative absolute velocity (CAV) from a recently compiled strong ground-motion database for Turkey, Paper presented at Joint Meeting of WA1 and WA3 of IAEA EBP Seismic, Vienna, 18 May 2009.

[8] Augusti G. Some observations on the calculation of structural failure probability, Meccanica, Vol. 10, No. 1, 1975, pp. 61–63.

[9] Elter J. Insights from the seismic probabilistic safety analysis of Paks Nuclear Power Plant, International Conference on Reliability, Safety and Hazard, Mumbai 2005 (ICRESH05), in Reliability, Safety and Hazard: Advances in Risk-informed Technology, Editor: P.V. Varde, 2006, pp. 381–387.

[10] Ivanyi M. Ductility of steel structures: The model of interactive hinge, Pollack Periodica, Vol. 1, No. 1, 2006, pp. 5–34.

[11] Ferson S, Kreinovich V., Ginzburg L., Myers D. S., Sentz K. Constructing probability boxes and Dempster-Shafer structures, Unabridged version, SAND2002-4015, Unlimited Release, Printed January 2003.

[12] Tucker W. T., Ferson S. Probability bounds analysis in environmental risk assessments, Applied Biomathematics, 100 North Country Road, Setauket, New York, 2003, www.ramas.com/pbawhite.pdf

options for the treatment of uncertainty in seismic safety assessment of nuclear power plants

Documents