Development of the DQFM method to consider the effect of correlation of component failures in seismic PSA of nuclear power plant

Development of the DQFM method to consider the effect of correlation of

component failures in seismic PSA of nuclear power plant

Yuichi Watanabea, Tetsukuni Oikawab,1, Ken Muramatsub,*

aSheet Products Research Department, Materials and Processing Research Center, NKK Corporation, Koukan-cho, Fukuyama-city,

Hiroshima-ken 721-0931, JapanbSafety Analysis Laboratory, Japan Atomic Energy Research Institute, Tokai-mura, Naka-gun, Ibaraki-ken 319-1195, Japan

Received 11 January 2000; accepted 15 April 2002

Abstract

This paper presents a new calculation method for considering the effect of correlation of component failures in seismic probabilistic safety

assessment (PSA) of nuclear power plants (NPPs) by direct quantification of Fault Tree (FT) using the Monte Carlo simulation (DQFM) and

discusses the effect of correlation on core damage frequency (CDF).

In the DQFM method, occurrence probability of a top event is calculated as follows: (1) Response and capacity of each component are

generated according to their probability distribution. In this step, the response and capacity can be made correlated according to a set of

arbitrarily given correlation data. (2) For each component whether the component is failed or not is judged by comparing the response and the

capacity. (3) The status of each component, failure or success, is assigned as either TRUE or FALSE in a Truth Table, which represents the

logical structure of the FT to judge the occurrence of the top event. After this trial is iterated sufficient times, the occurrence probability of

the top event is obtained as the ratio of the occurrence number of the top event to the number of total iterations.

The DQFM method has the following features compared with the minimal cut set (MCS) method used in the well known Seismic Safety

Margins Research Program (SSMRP). While the MCS method gives the upper bound approximation for occurrence probability of an union

of MCSs, the DQFM method gives more exact results than the upper bound approximation. Further, the DQFM method considers the effect

of correlation on the union and intersection of component failures while the MCS method considers only the effect on the latter. The

importance of these features in seismic PSA of NPPs are demonstrated by an example calculation and a calculation of CDF in a seismic PSA.

The effect of correlation on CDF was evaluated by the DQFM method and was compared with that evaluated in the application study of the

SSMRP methodology. In the application study, Bohn et al. showed that correlation had a significant effect on CDF and may vary it by up to an

order. However, in the results calculated by the DQFM method correlation varied CDF by at most 2 or 3 times compared with CDF for a case

where no correlation was assumed. Although some factors should further be examined, this implied that the MCS method may have overestimated

the effect of correlation on CDF and the effect of correlation on CDF may not be so significant as that evaluated in the SSMRP.

q 2002 Published by Elsevier Science Ltd.

Keywords: Seismic probabilistic safety assessment; Nuclear power plant; Fault Tree; Monte Carlo simulation; Core damage frequency; Correlation of failure;

Seismic core melt frequency evaluation-2

1. Introduction

Seismic probabilistic safety assessments (PSAs) of

nuclear power plants (NPPs) have been widely conducted

since early 1980s, especially in the USA to evaluate core

damage frequency (CDF) induced by earthquakes and to

identify vulnerability of NPPs to earthquakes. Since many

large earthquakes have occurred in Japan, the Japan Atomic

Energy Research Institute (JAERI) has developed

a methodology for seismic PSAs of NPPs and applied this

method to a hypothetical BWR plant, which is termed ‘Model

Plant’ [1]. The Model Plant is a 1100MWe BWR/5 plant with

a Mark-II type containment located on an actual site of NPPs

on the Pacific coast of northeastern area in Japan.

It is well known that the results of seismic PSAs have

large uncertainty, especially in seismic hazard curves and

capacity (fragility) data. Budnitz pointed out in his review

paper [2] that the numerical uncertainties can be certainly

large, dominantly caused by the uncertainty in the seismic

hazard evaluation and that the uncertainties in the fragility

0951-8320/03/$ - see front matter q 2002 Published by Elsevier Science Ltd.

PII: S0 95 1 -8 32 0 (0 2) 00 0 53 -4

Reliability Engineering and System Safety 79 (2003) 265–279

www.elsevier.com/locate/ress

1 Currently on loan to the Office of the Nuclear Safety Commission.

* Corresponding author. Tel.: þ81-29-282-5815; fax: þ81-29-282-6147.

E-mail address: [email protected] (K. Muramatsu).

http://www.elsevier.com/locate/ress

estimates per se make smaller but important contributors to

the overall uncertainty. He also pointed out that the

correlations among failures are not understood well and

the differences between assuming full correlation and zero

correlation can also amount to an order of magnitude

difference in CDF in some cases. Ravindra [3] selected the

question of correlation between seismic failures as one of

the issues that are not fully addressed in the current seismic

PSAs.

The significance of the effect of correlation in seismic

PSAs have been recognized and studied in some papers

[4–10]. Ravindra [6] discussed the effect of correlation

and showed that correlation between component failures

may have large effect on CDF when an extreme

assumption of full dependence due to correlation was

assumed although a realistic consideration of dependencies

would result in much lower effect. Based on his sensitivity

analysis, Fleming [10] also pointed out that the correlation

may have significant effect on failure probability of a

system.

If identical two components are located side by side in a

building, there is high response dependency and the

responses of these components are correlated. Similarly, it

is thought that the capacities of identical two components

are correlated. Here, the former is called the correlation of

response and the latter is called the correlation of capacity.

If one component fails, it is likely that the other component

will also fail when responses and/or capacities of com-

ponents are correlated. When the degree of correlation

increases, the probability of simultaneous failure of multiple

components (intersection of component failures) increases

and the occurrence probability of union of component

failures decreases. An NPP consists of redundant systems,

which have a large number of components, and the failures

of the systems and core damage are usually represented by

an union of many intersections of component failures.

Therefore, correlation might significantly influence con-

ditional failure probabilities of systems, conditional core

damage probability (CDP) and CDF. The significance of the

effect of correlation in seismic PSAs has been recognized.

In the phase-1 of the Seismic Safety Margins Research

Program (SSMRP) [11], analysis procedures were devel-

oped to estimate the risk of an earthquake-caused radio-

active release from a commercial NPP. A system analysis

code, SEISIM (Systematic Evaluation of Important Safety

Improvement Measures), was developed to evaluate occur-

rence probabilities of accident sequences and CDF with

consideration of the effect of correlation. The SEISIM code

computes the accident sequence probability as upper bound

of occurrence probability of the sequence (upper bound

approximation) represented by an union of minimal cut sets

(MCSs). In this MCS method, the effect of correlation on

occurrence probability of an intersection of component

failures is considered and the effect of correlation on that of

an union of component failures is ignored since it is thought

that the effect on the intersection is much more significant

than the effect on the union.

In ‘Application of the SSMRP Methodology to the

Seismic Risk at the Zion Nuclear Power Plant’ [4] (hereafter

called the application study of the SSMRP), Bohn et al.

concluded that correlation had a significant effect on CDF

and may vary it by up to an order. However, ignoring the

effect of correlation on the occurrence probability of union

and the use of upper bound approximation might cause

overestimation of CDF.

The present authors developed a new calculation method

to consider the effect of correlation on the occurrence

probability of both union and intersection of component

failures and to obtain more exact results than the upper

bound approximation. This new method directly quantifies

Fault Tree (FT) using the Monte Carlo simulation and

calculates the occurrence probability of a top event as

follows: (1) Response and capacity of each component are

generated according to their probability distribution. (2) For

each component whether the component is failed or not is

judged by comparing the response and the capacity. (3) The

status of each component, failure or success, is assigned as

either TRUE or FALSE in a Truth Table, which represents

the logical structure of FT to judge the occurrence of the top

event. After this trial is iterated sufficient times, the

occurrence probability of the top event is obtained as the

ratio of the occurrence number of the top event to

the number of total iterations. In the second step, the effect

of correlation of response was considered by correlating the

compositions of variabilities of responses that are caused by

a common source; this method is described in Refs. [12,13].

However, it is difficult to treat arbitrarily given correlation

coefficient data since the degree of correlation is discretely

varied in this manner. Then, a mathematical technique was

applied to make responses correlated according to the

arbitrarily given correlation coefficient data; this method is

described in Ref. [12]. The correlation of capacity as well as

response can be considered by the same ways. The

developed calculation method was named the DQFM

(direct quantification of Fault Tree using the Monte Carlo

simulation) method.

The feasibility of the DQFM method was confirmed by

calculation of failure probability of a system [12,13] and the

DQFM method was incorporated into the SECOM (seismic

core melt frequency evaluation)-2 code, which is a systems

reliability analysis code for seismic PSAs developed by

JAERI [14].

First, this paper reviews treatment of correlation in

existing works and their limitations and then introduces

calculation method of the DQFM method. Next, this paper

shows effect of correlation on occurrence probability of an

union of component failures and intersection of component

failures. Further, CDFs calculated by the DQFM method

and the MCS method were compared to evaluate the effect

of correlation on CDF.

Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279266

2. Definition and nature of correlation in seismic PSAs

In a seismic PSA, responses and capacities of

components are usually treated as random variables and

correlation of response and capacity of component is an

essential issue when one considers the simultaneous failure

probability of multiple components. Reed et al. [5] defined

and explained the correlation of component failures as

follows (their explanation has been rearranged by the

present authors):

“Physically, dependencies exist due to similarities in

both response and capacity parameters. For example, if two

components are located side by side in a building, there is

high response dependency. The structural capacities of two

identical pumps are highly correlated. Then, if one pump

fails due to an earthquake, it is likely that the other pump

will also fail.”

In this paper, the correlation of failure is defined as any

dependency among failures of components that arise from

common sources of variability of their responses and

capacities. For example, common source of the variability

of response of two pumps of similar design on the same

floor include the uncertainties in the seismic motion, soil

amplification of the seismic wave and the building

response. The common sources of the variability of

capacity of the two pumps include the similarity in

material properties and design of weakest parts. The

strength of correlation of capacity would depend on the

degree of similarity in design and the method of capacity

evaluation. Here, the dependency of response means the

correlation of response; the dependency of capacity means

the correlation of capacity.

Correlation influences the occurrence probabilities of not

only the intersection but also the union of multiple

component failures. In case of no correlation, the occurrence

probability of intersection of component failures is the

product of the failure probabilities of the components. When

the degree of correlation among the component failures

increases, the occurrence probability of intersection of

component failures increases and the occurrence probability

of union of component failures decreases.

The variability of response or capacity of a component is

usually treated as a combination of the uncertainty due to

lack of knowledge and the uncertainty due to randomness.

The former is some times called epistemic uncertainty and

the latter is called aleatory uncertainty. In this paper,

however, this separation is not performed although it is

theoretically possible and will be necessary for conducting

an uncertainty analysis.

Mathematically, the strength of correlation between two

random variables Xi and Xj is expressed by a correlation

coefficient ðrÞ defined by the following equation

r ¼CovðXi;XjÞffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi

VarðXiÞVarðXjÞp ; ð1Þ

where CovðXi;XjÞ is covariance coefficient between Xi and

Xj, VarðXiÞ is variance of Xi defined by the following

equations

VarðXiÞ ¼ E ðXiÞ2

� �2 ðEðXiÞÞ

2; ð2Þ

CovðXi;XjÞ ¼ EðXiXjÞ2 EðXiÞEðXjÞ; ð3Þ

where EðXiÞ and EðXiXjÞ are defined by the following

equations using probability density function f ðXiÞ and

f ðXi;XjÞ:

EðXiÞ ¼ð1

21Xif ðXiÞdXi; ð4Þ

EðXiXjÞ ¼ð1

21

ð1

21XiXjf ðXi;XjÞdXi dXj: ð5Þ

3. Consideration of effect of correlation

in the existing works

3.1. Treatment of correlation in the SSMRP, NUREG-1150

and other works

3.1.1. Evaluation of responses and correlation

In the phase-1 of the SSMRP, the SMACS (seismic

methodology analysis chain statistics) code was developed

to probabilistically calculate the seismic responses of

structures, systems and components. In the application

study of the SSMRP, a large number of multiple time

history analyses of responses were performed by the

SMACS code. Correlation and variability of responses

were determined from the results of those response analyses.

Finally, the occurrence probabilities of accident sequences

and CDF were calculated by the SEISIM code using these

values.

In the risk assessments for the Surry and Peach Bottom

NPPs of the NUREG-1150 risk assessments (hereafter

called NUREG-1150), a set of rules were formulated as

shown in Table 1, which predicted the ‘exact’ correlation

with adequate accuracy [8,9,15]. These rules were based on

the examination of a large number of responses in the

application study of the SSMRP, which showed a distinct

pattern to the values of correlation that existed between the

various types of responses.

On the other hand, the effect of correlation of capacities

was examined by a sensitivity analysis, assuming that the

capacities of components were perfectly correlated or

independent because of the lack of data for the correlation

of capacities in the application study of the SSMRP [4]. In

NUREG-1150, the capacities of components were assumed

to be independent [8,9].

According to the concept suggested by Reed et al. [5]

correlation of responses and/or capacities of components

can be determined by the following way. The variabilities of

responses and/or capacities of the components can be

decomposed on the basis of source of variabilities and

Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279 267

correlation is expressed as the fraction of the variabilities

caused by the common sources in the total of the

variabilities. On the basis of their concept, correlation of

response can be determined without the time history

analyses of responses.

3.1.2. Calculation of occurrence probabilities of accident

sequences taking account of correlation

In the SEISIM code, the occurrence probabilities of

MCSs that contained correlated component failures were

calculated and incorporated in the calculation of occurrence

probabilities of accident sequences and CDF.

In this method, correlation of component failures was

treated as follows: if the correlation between the responses

and the correlation between the fragilities (the fragility in

Ref. [4] means the capacity in this paper) are known for two

components, then the coefficient of correlation between the

failures of these two components (‘correlation of com-

ponent failures’) was defined by Eq. (6) [4,15]

rC ¼bR1bR2ffiffiffiffiffiffiffiffiffiffiffiffiffi

b2R1 þ b2

F1

q ffiffiffiffiffiffiffiffiffiffiffiffiffib2

R2 þ b2F2

q rR1R2

þbF1bF2ffiffiffiffiffiffiffiffiffiffiffiffiffi

b2R1 þ b2

F1

q ffiffiffiffiffiffiffiffiffiffiffiffiffib2

R2 þ b2F2

q rF1F2; ð6Þ

where rC is a correlation coefficient between the component

failures 1 and 2, bR1 and bR2 standard deviations of the

logarithms of the responses of components 1 and 2, bF1 and

bF2 standard deviations of the logarithms of the fragilities of

components 1 and 2, rR1R2 a correlation coefficient between

responses of components 1 and 2, and rF1F2 is a correlation

coefficient between the fragilities of components 1 and 2.

The correlation coefficient defined by Eq. (6) was the

correlation coefficient between logarithms of ratios of

responses to capacities for components 1 and 2 since

responses and capacities of components were treated as

random numbers that were subject to the lognormal

distribution.

The occurrence probability of an accident sequence

ðPðACC SEQÞÞ that leads to core damage was expressed by

the following expression:

PðACC SEQÞ ¼ PðMCS1 < MCS2 < · · · < MCSnÞ: ð7Þ

The SEISIM code can use the following three upper bounds:

PðACC SEQÞ ¼ 1 2Y

i

½1 2 PðMCSiÞ�; ð8Þ

PðACC SEQÞ ¼Xn

i

PðMCSiÞ; ð9Þ

PðACC SEQÞ ¼Xn

i

PðMCSiÞ2X

ði;jÞ[t

PðMCSi > MCSjÞ;

ð10Þ

where PðMCSiÞ is the occurrence probability of the ith

MCS, t is the set of all MCSs that lead to core damage and n

is the number of MCSs in t.

Eq. (8), gives the exact occurrence probability of an

union of MCSs only when the component failures among

MCSs are independent of one another, otherwise it gives an

approximation to upper bound of the occurrence probability

of an union of MCSs. Eq. (9) is an upper bound on the

probability of an union. It does not account for interactions

between cut sets and is, therefore, not an accurate bound

when cut set probabilities are high. Eq. (10), which is based

on Hunter [16] and is called Hunter’s upper bound in this

paper, is an improvement on Eq. (9) because it is obtained

by subtracting the probabilities of certain pairs of cut sets

from the sum, thereby taking some interaction between cut

sets into account.

Since Eq. (8) seems to have been used most widely, we

assume that Eq. (8) is used for the MCS method.

The occurrence probability of an MCS in the equation

was obtained by n-dimensional numerical integration of a

multivariate lognormal distribution with correlation coeffi-

cients for all pairs of component failures in the MCS, which

were defined by Eq. (6).

3.1.3. Limitations of treatment of correlation in the SSMRP

and NUREG-1150

In the SSMRP and NUREG-1150 method, since the

occurrence probability of accident sequence is calculated by

Eq. (8), only the effect of correlation on occurrence

probability of the intersection of component failures can

be considered and the effect of correlation on that of the

union of component failures is ignored. Therefore, failure

probabilities of systems, CDP and CDF with consideration

of correlation of component failures are always larger than

Table 1

Rules for assigning response correlation for NUREG-1150

1. Components on the same floor slab, and sensitive to the same spectral frequency range (i.e. zero period acceleration (ZPA), 5–10 Hz, or 10–15 Hz) will be

assigned response correlation ¼ 1.0

2. Components on the same floor slab, sensitive to different ranges of spectral acceleration will be assigned response correlation ¼ 0.5

3. Components on different floor slabs (but in the same building) and sensitive to the same spectral frequency range (ZPA, 5–10 Hz or 10–15 Hz) will be

assigned response correlation ¼ 0.75

4. Components on the ground surface (outside tanks, etc.) shall be treated as if they were on the grade floor of an adjacent building

5. ‘Ganged’ valve configurations (either parallel or series) will have response correlation ¼ 1.0

6. All other configurations will have response correlation equal to zero


those without consideration of correlation in the MCS

method. Justification for this simplification is that the

correlation of component failures strongly influences the

occurrence probability of intersection of component

failures and the effect of the correlation on occurrence

probability of union of component failures is much smaller

[4]. Further, ignoring the effect on union gives conservative

results.

If a system consists of components in parallel, failure of

the system is expressed as the component failures combined

by AND-gates in FT (intersection of component failures).

On the other hand, if a system consists of components in

series, failure of the system is expressed as the component

failures combined by OR-gates in FT (union of component

failures).

Since FTs for safety systems of an NPP normally contain

many component failures combined by OR-gates, the

correlation among them might significantly influence the

failure probabilities of the systems. However, it is difficult

for the MCS-based methods to analyze this effect.

3.1.4. Effect of correlation on CDF evaluated in the

application of the SSMRP to the Zion plant

In the application study of the SSMRP, Bohn et al.

concluded that effect of correlation on a risk analysis that

was dominated by single failures, especially structural

failures, were relatively minor. For the cases where the

dominant risk contributors were pairs of component

failures, such as electrical components, correlation had a

significant effect on CDF and may vary it by up to an order

[4]. However, they noted that the effect of correlation on

CDF might be overestimated because of the upper bound

approximation.

3.2. Consideration of correlation in the JAERI method

3.2.1. Seismic PSA procedures at JAERI

The seismic PSA procedures developed at JAERI have

the following three steps [17]: evaluation of seismic hazard,

evaluation of responses and capacities of components in

systems and evaluation of failure probabilities of systems,

CDP and CDF.

The responses of components are evaluated by a response

factor method, which is one of the characteristic features in

the seismic PSA method of JAERI [18]. The response factor

for each building or component (structure, piping and other

equipment) in an NPP accounts for the difference between

the response and the response evaluated in design, which is

generally conservative. The response factor is defined as the

ratio of design responses to actual responses of component,

building, etc. and is treated as random variable that is

subject to the lognormal distribution. The variances and

median of response factors were determined by comparison

between design calculation and detailed analysis and by

engineering judgment using available data.

In the JAERI method, failure probabilities of systems,

CDP and CDF are calculated by the SECOM-2 code. They

can be calculated by the following three methods:

1. the Boolean Arithmetic Model (BAM) method [19],

which gives an exact numerical result

2. the MCS method used in the SSMRP method that

gives a result of upper bound approximation using Eq.

(8), and

3. the DQFM method, which is described in Section 4.

3.2.2. Calculation of failure probability of a system taking

account of correlation in the response factor method

Abe [7] examined the effect of correlation of responses

on failure probability of a system by using the Monte Carlo

simulation as the first step on this issue at JAERI. In their

method, the response factor of each component was

sampled for each trial in the Monte Carlo simulation to

determine the response of the component on condition that

response factors of all components were fully correlated.

Since the response of a component is calculated by dividing

its design response by its response factor, the sampling of

the response factor is equivalent to the sampling of

response. The failure probability of the component was

calculated from the capacity of the component and the

sampled response. The failure probabilities of all com-

ponents were assigned into FT and the failure probability of

a system was calculated by using the BAM method at this

trial. This procedure was iterated sufficient times and the

distribution of failure probabilities of a system was

obtained. Mean value of the distribution was calculated as

the failure probability of the system. By this method, the

effect of correlation of responses on component failures

combined by AND-gates and OR-gates can be considered.

However, this method can consider the effect of correlation

only when responses or capacities are fully correlated since

it uses the BAM method. Considering the effect of

correlation, they calculated a failure probability of a small

system and concluded that correlation did not affect the

results of seismic PSAs.

4. Calculation method of DQFM method taking account

of correlation

4.1. Calculation flow of the DQFM method

The calculation flow of the DQFM method to calculate

the occurrence probability of a top event such as system

failure and core damage consists of the following seven

steps as is shown in Fig. 1. First, FT structure, capacity data

and response data of each component in the FT are given as

input (step 1). In each trial of the Monte Carlo simulation,

the values of response and capacity of a component are

sampled according to their probability distributions (step 2).

Whether the component is failed or not is judged by


comparing the values of response and capacity of the

component (step 3). The steps 2 and 3 are repeated for every

component (step 4). Here, arbitrarily given correlation of

responses and capacities of the components are considered

in the manner as described in Section 4.2. The failure or

success of each component is assigned as either TRUE or

FALSE to a Truth Table, which represents the logical

structure of the FT to judge the occurrence of top event. This

trial is iterated sufficient times and occurrence number of the

top event is counted (step 5). The occurrence probability of

the top event is obtained by dividing the number of

occurrences of the top event by the number of total iterations in

the simulation (step 6). The calculation steps 1–6 are

repeated to calculate the occurrence probability of the top

event at every seismic motion level (step 7).

If CDP is obtained as occurrence probability of a top

event, CDF is obtained by integrating the product of CDP

and occurrence frequency of earthquake with respect to

seismic motion level.

This method has the following advantages:

1. This method can treat an arbitrarily given correlation of

response and capacity.

2. This method can consider the effect of correlation on the

occurrence probability of the union of component

failures as well as the intersection of component failures.

3. Further, this method can provide a more exact result than

the result of the upper bound approximation, if the Monte

Carlo simulation is performed by sufficient iteration.

Fig. 1. Flow chart of DQFM method.


4.2. Consideration of correlation by the DQFM method

As described in Section 3.1.1, correlation coefficients

between responses of components can be determined by the

time history analyses of response or the concept suggested

by Reed et al. [5]. In order to calculate failure probabilities

of systems, CDP and CDF with consideration of the

obtained correlation coefficients, responses of components

has to be made correlated according to the obtained

correlation coefficients in the Monte Carlo simulation.

First, this section describes the method making random

numbers correlated and the method making responses

correlated in the Monte Carlo simulation.

Correlation among many random numbers can be

expressed by the following correlation matrix (V), which

shows correlation of every pair of random variables

V ¼

1 rðx2;x1Þ· · · rðxn;x1Þ

rðx2;x1Þ1

..

. . ..

rðxn;x1Þrðxn;x2Þ

1

266666664

377777775; ð11Þ

where xi is random variable and rðxi; xjÞ the correlation

coefficient between xi and xj defined by Eq. (1). The random

numbers that are subject to the normal standard distribution

and are correlated according to the correlation matrix (V)

can be obtained by transforming independent random

numbers of normal standard distribution with the following

equation

y1

y2

..

.

yn

266666664

377777775¼ M

x1

x2

..

.

xn

266666664

377777775; ð12Þ

where xi is the independent random number and yi is the

correlated random number and M is a lower triangular

matrix that holds for Eq. (13).

V ¼ MMt; ð13Þ

where M t is the transposed matrix of M. The element of M

must be real number in this case. The matrix (M) can be

obtained by decomposing the correlation matrix V into M

and M t with the use of Cholesky decomposition [20].

As described in Section 3.1, the correlation coefficients

between responses of components at a given seismic motion

level are usually defined by the correlation coefficients

between logarithms of responses of components since the

responses are treated as random variables of the lognormal

distribution. If the correlation matrix for the logarithms of

responses of components is obtained, the responses are

generated in the Monte Carlo simulation as follows. The

correlated random numbers of the normal standard

distribution (yi) that is subject to the obtained correlation

matrix is generated as shown above and the correlated

response of component ðiÞ; which is subject to the lognormal

distribution, is determined by the following equation

Ri ¼ Rim expðbiyiÞ; ð14Þ

where Ri is the response of component ðiÞ; Rim the median of

Ri, bi the standard deviation of logarithm of Ri. With this

technique, logarithms of the responses can be made

correlated in accordance with the correlation coefficients

in the correlation matrix V.

In the case where responses of some components are

fully correlated, these components can be grouped into ‘a

response group’ and correlation coefficients among the

response groups are assigned into the correlation matrix. By

grouping, the dimensions of correlation matrix can be

reduced to make calculation more efficient.

If correlation coefficient of capacities of components is

obtained and the correlation matrix for capacity can be

determined, the SECOM-2 code can also treat correlation of

capacity by the way described above. However, because of

lack of correlation data for capacity as mentioned in Section

3 the effect of correlation of capacity can merely be

evaluated by a sensitivity analysis under the present

conditions.

Furthermore, if sources of uncertainty were separated

into randomness (aleatory) and lack of knowledge or

modeling (epistemic) uncertainty and their respective data

for distribution parameters of correlation coefficients were

obtained, we believe that it is possible to expand the DQFM

method to perform uncertainty analysis by adding another

loop of Monte Carlo iteration.

5. Discussion of effect of correlation on failure

probability of system

This section demonstrates the effect of correlation on

occurrence probability of an union of many component

failures and that of an union of many intersections of

component failures using a sample problem.

5.1. Sample problem

5.1.1. Sample system

To show the effect of correlation on occurrence

probability of an union of many component failures and

that of an union of many intersections of component

failures, a multiple train system whose train contains

sufficient number of components in series, is suitable for a

sample system.

The residual heat removal (RHR) system was chosen as

the sample system in our study. The RHR system, which

originally consisted of three trains, was simplified to a two

train system in the Model Plant PSA. The sub FT for the

train A of the RHR system, which shows a part of the FT

for the whole RHR system, (hereafter called sub FT for


Fig

.2.

Sub

FT

of

trai

nA

of

RH

Rsy

stem

.


the train) is shown in Fig. 2. This FT also includes the

support system for the train A of the RHR system. In the sub

FT for the train, there were 26 seismically induced

component failures and seven non-seismic (random) fail-

ures. Most of the component failures were combined by OR-

gates except two pairs of pumps, which were combined by

AND-gates in the sub FT for the train. In the FT of RHR

system, sub FTs for the trains A and B were combined by

AND-gates [1]. Thus, the failure of RHR train was basically

represented by an union of many component failures and the

failure of the RHR system was represented by an union of

many intersections of component failures.

Components in the system were installed on the ground

or in the following three buildings: reactor building, control

building, sea water heat exchanger building.

5.1.2. Calculation condition

The failure probability of the RHR system and that of a

train of the RHR system were calculated for the following

four conditions. The capacity data used here was prepared

from the data for the Model Plant PSA at JAERI (base data)

[21] and are shown in Table 2.

(A) Independent case. The responses and capacities of

components were assumed to be completely independent.

(B) Partially correlated response case. The components

were grouped into 27 response groups on the basis of

installation locations and natural frequencies of components

and the responses were made fully correlated for the

components in the same response group.

The correlation coefficients among the 27 response

groups were determined according to the NUREG-1150

rules shown in Table 1 and were assigned into the

correlation matrix (V). In this case some elements in the

matrix M, which is obtained by decomposing the matrix V,

were complex numbers since some correlation existed

among the response groups that were on different floors in

the same building and were different natural frequencies

although these response groups had to be independent of one

another on the rules. This result implied that the rules used

in NUREG-1150 are not mathematically consistent in a

rigorous sense. Then, small correlation coefficient 0.3 was

assigned into the elements for those response groups in the

correlation matrix V to make the elements in the matrix M

be real numbers. Fig. 3 shows the correlation matrix used for

the calculation of the partially correlated case.

In this case, the responses of many components were

assumed to be partially correlated. The standard deviation of

logarithm of the response ðbiÞ in Eq. (14) was assumed to be

equal to that of the response factor for each component.

(C) Fully correlated response case. The responses of the

components in the same building were assumed to be fully

correlated regardless of installation locations or natural

frequencies of components.

(D) Fully correlated response and capacity case. In the

Model Plant PSA, all components were grouped into generic

categories similarly to NUREG-1150. For example, all

motor operated valves located on piping with different

diameters were placed into a single generic category, and

similarly, all motor control centers were placed into another

generic category.

The components in the same generic category can be

found in the same train and in different trains. For example,

Fig. 3. Correlation matrix for partially correlated response case.


components such as RHR heat exchangers A1, A2, B1 and

B2 were in the same generic category and the RHR heat

exchangers A1 and A2 were installed in the same train A

and the RHR heat exchangers A1, B1 were installed in

different trains A and B.

The capacities of the components in the same generic

category were assumed to be fully correlated and the

responses of components were assumed to be correlated

similarly to the fully correlated response case.

Since the conditions (B), (C) and (D) assumed some

correlation in response and/or capacity of component, these

were called ‘correlated cases’ and since the conditions (B) and

(C) assumed correlation only in response, these were called

‘correlated response cases’ in the following descriptions.

The responses of components were correlated in the train

and correlated among trains for the correlated cases.

Moreover, the capacities of components were correlated in

the train and correlated among trains when the capacities of

the components in the same generic category were

correlated.

5.2. Calculation results

Figs. 4 and 5 show failure probabilities of the RHR train

A and the failure probabilities of the RHR system calculated

by the DQFM method and the BAM method for the

independent case. In the DQFM method, the Monte Carlo

simulation was performed by 100 000 iterations at each

seismic motion level. As shown in these figures, the failure

probabilities of the RHR train A and the RHR system

calculated by the DQFM method agreed with those

Table 2

Seismic capacity data used in JAERI’s seismic PSA

Capacity evaluation Component class Median (Gals) Uncertainty

br bu

Evaluation by JAERI based on

specific component design (A)

Startup transformer with ceramic tube 650 0.25 0.25

Emergency diesel generator (EDG) 2156 0.25 0.31

Condensate storage tank 813 0.25 0.29

Estimation from proving tests (B) Vertical pump 2225 0.22 0.32

LPCS pump 2225 0.22 0.32

RHR pump 2225 0.22 0.32

CCW pump 2225 0.22 0.32

Horizontal pump SLC pump 3920 0.25 0.27

RCIC pump 3920 0.25 0.27

EECW pump 3920 0.25 0.27

Motor operated valve 6468 0.26 0.60

Check valve 6468 0.20 0.35

RCIC turbine 2587 0.25 0.27

Instrumentation rack 10 241 0.48 0.74

Switchgear/power center 8085 0.29 0.66

Logic panel/instrumentation panel 10 241 0.48 0.74

Control panel/motor control center 5929 0.48 0.74

Control rod drive housing 4722 0.20 0.35

Scaling based on evaluation by JAERI (C) EDG day tank 1716 0.15 0.20

EDG fuel tank 3324 0.25 0.45

SLC tank 3324 0.25 0.45

RHR heat exchanger 2638 0.20 0.35

EECW heat exchanger 5420 0.30 0.53

EECW heat exchanger (HPCS) 5420 0.30 0.53

Use of US generic data (D) Battery 2244 0.31

Transformer 8624 0.28

Piping 3.24 £ 102t-m 0.18

Special treatments for initiating events

based on analysis at JAERI

or use of values from

seismic PSAs in US

Loss of offsite power (A) 650 0.25 0.25

Large LOCA (D) 3067 0.35 0.40

Medium LOCA (C) 2699 0.47 0.30

Small LOCA (C) 1729 0.50 0.30

Reactor vessel rupture (D) 10 270 0.26 0.28


calculated by the BAM method for the independent case;

these results showed that the DQFM method can accurately

calculate failure probabilities of the train and the system

[12,13].

(A) Effect of correlation on occurrence probability of an

union of component failures. Fig. 4 shows the calculated

failure probabilities of RHR train A for the correlated

response cases comparing with the independent case. The

failure probabilities for the correlated response cases were

much smaller than the failure probability for the indepen-

dent case. The failure probability for the fully correlated

response case was smaller than that for the partially

correlated response case since the degree of correlation of

component failures for the fully correlated case was larger

than that for the partially correlated case in the train. The

failure probability for the fully correlated response and

capacity case was smaller than that for the fully correlated

response case since the correlation of capacities of the

component in the same generic category as well as the

correlation of response decreased occurrence probability of

an union of component failures. The same tendency of the

calculation results was also seen on the RHR train B. Since

the failure of RHR train was represented by an union of

many component failures, these results showed that

correlation of component failures considerably decreased

the occurrence probability of an union of many component

failures.

(B) Effect of correlation on occurrence probability of an

union of many intersections of component failures. Fig. 5

shows the calculated failure probabilities of the RHR system

for the correlated response cases comparing with the

independent case. The failure probabilities for the correlated

response cases were larger than the failure probability for

the independent case at low seismic, motion levels (below

about 700 Gals). At higher seismic motion levels (above

about 700 Gals), however, the failure probabilities for these

correlated cases were smaller than the failure probability for

the independent case. Generally, correlation of component

failures raises the occurrence probabilities of intersections

of component failures while it lowers the occurrence

probability of an union of component failures. The former

effect was more significant at the low seismic motion levels

and was less significant at the high seismic motion levels in

these cases.

The failure probability for the fully correlated response

and capacity case was much larger than that for the fully

correlated response case at all the seismic motion levels; this

result showed the correlation of capacity of the components

in the same generic category that increased occurrence

probability of intersections of component failures had

dominant effect.

Since the failure of the RHR system was represented by

an union of many intersections of component failures, these

results showed that correlation of component failures

increased occurrence probability of an union of many

intersections of component failures in some conditions and

considerably decreased it in other conditions compared with

the independent case. This implies that the effect of

correlation on occurrence probability of union of com-

ponent failures should not be ignored when one takesFig. 5. Conditional failure probability of RHR system calculated for

independent case correlated cases.

Fig. 4. Conditional failure probability of train A of RHR system calculated

for independent and correlated cases.


account of effect of correlation of component failures. The

next section discusses the effect of correlation on CDF.

6. Discussion of effect of correlation on CDF

CDFs of the Model Plant calculated by the MCS method

and the DQFM method were compared to evaluate the effect

of correlation on CDF. Here we use Eq. (8) as the MCS

method for comparison purpose, because Eq. (8) is most

widely used for calculating CDFs and the SECOM-2 code is

not capable of using other equations. Thus, if Eq. (9) or (10)

is used, the comparison results may be slightly different.

6.1. Calculation condition

For performing CDF calculation, an integrated FT is

adopted as a system model in the Model Plant PSA at

JAERI. A simplified illustration of an integrated FT is

shown in Fig. 6. In this study the seismically induced core

damage that was caused by loss of off-site power (LOSP)

was considered since the CDF caused by the LOSP

dominated over 60% of total CDF. The LOSP was assumed

to be caused by the failure of a startup transformer with

ceramic insulator tubes since the failure probability of

startup transformer was much larger than the other

components causing LOSP on the basis of the base data.

The core damage caused by the LOSP was represented

by about 120 basic events such as component failures and

non-seismic failures. The components were installed in the

reactor building, the control building, the sea water heat

exchanger building and on the ground as the components in

the RHR system were installed. The startup transformer,

which was assumed to cause the LOSP, was installed on the

ground and the failure of that was assumed to be

independent of the failures of components in safety

functions.

In the Monte Carlo simulation, CDP was obtained by

100 000 iterations at every seismic motion level on the basis

of the base data [21]. Responses and capacities of

components were assumed to be correlated according to

the four cases including the independent case in Section 5

similarly to the calculation of failure probabilities of the

RHR system.

6.2. Effect of correlation on CDF evaluated by the DQFM

method and the MCS method

Fig. 7 shows calculated CDPs obtained by the DQFM

method, the MCS method and the BAM method. For the

independent case, the CDP calculated by the DQFM method

agreed with that calculated by the BAM method; this result

showed the DQFM method can accurately calculate CDP as

well as failure probability of a system.

In the results of the DQFM method, the CDPs for the

partially correlated response case and the fully correlated

Fig. 6. Simplified illustration of an integrated FT. Fig. 7. Conditional CDP calculated by DQFM, MCS and BAM methods.


response case were larger than the CDP for the independent

case at low seismic motion levels (below about 700 Gals).

However, at high seismic motion levels (above about

700 Gals) the CDPs for these cases were smaller than the

CDP for the independent case. The CDP for the fully

correlated response and capacity case was larger than that

for the fully correlated response case at all the seismic

motion levels. Since the core damage was represented by an

union of many intersections of component failures as well as

the failure of RHR system, these results showed the

similar tendency as the results of the RHR system shown

in Section 5.

For the independent case, the CDP calculated by the

MCS method was larger than that calculated by the BAM

method since the CDP calculated by the MCS method is the

upper bound approximation. Further, in the results of the

MCS method, CDP increased when degree of correlation

increased since the CDP is calculated with consideration of

effect of correlation only on the intersection of component

failures. In summary, CDP calculated by the MCS method

was much larger than that calculated by the DQFM method

especially when correlation was considered.

Fig. 8 shows CDF per unit acceleration, which is the

product of CDP and occurrence frequency of earthquake per

unit acceleration, as a function of acceleration level. In the

figure, CDF per unit acceleration was normalized by the

peak value calculated by the DQFM method for

the independent case. CDF per unit acceleration is

significantly varied by the change of CDP at low seismic

motion levels, since the occurrence frequency of earthquake

is large at those levels. Thus, CDF per unit acceleration

calculated by the MCS method was larger than that

calculated by the DQFM method for each of correlated

cases.

At the low seismic motion levels small fluctuation of

CDP, which was caused by insufficient iteration in the

DQFM method, made the CDF per unit acceleration

fluctuated. Although CDF is obtained by integrating CDF

per unit acceleration with respect to seismic motion level,

the fluctuation did not considerably influence CDF. CDF per

unit acceleration calculated by the DQFM method

agreed with that calculated by the BAM method for

the independent case as shown in Fig. 8 and this result

showed that the DQFM method could accurately

calculate CDF.

Table 3 shows the ratios of the CDFs for the correlated

cases to the CDF for the independent case. By correlation,

CDF was varied by about 2.5 times in the results of the

DQFM method and was varied by about 6 times, at

maximum, in the results of the MCS method compared with

the independent case. Table 4 shows the ratio of CDF

calculated by the MCS method to that calculated by the

DQFM method; the ratio shows degree of overestimation of

CDF caused by the MCS method. The ratio was 3.3 for the

fully correlated response and capacity case while it was at

most 1.3 for the independent case.

Although Bohn et al. concluded that correlation had a

significant effect on CDF and may vary it by up to an order

in the application study of the SSMRP, the results of the

present study showed that the MCS method overestimated

CDF especially when correlation was considered and

implied that the effect of correlation on CDF would not be

so significant as that evaluated in the SSMRP.

Since the effect of correlation on CDF values depend on

various conditions, the present authors are evaluating the

influence of the following factors. However, they expect

Fig. 8. CDF per unit acceleration calculated by DQFM, MCS and BAM

methods.

Table 3

Ratio of the CDFs for the correlated cases to the CDF for the independent case

DQFM method MCS method

Independent case 1.0 1.0

Partially correlated response case 1.3 2.1

Fully correlated response case 1.3 2.7

Fully correlated response and capacity case 2.4 6.2


that qualitative results obtained in this study will not depend

on these factors.

(a) In this study, initiating event LOSP was assumed to be

caused by a single failure of component, which was

independent of the component failures in safety

functions as mentioned in Section 6.1. If the initiating

event is caused by multiple components failures, which

are correlated with one another, and are correlated with

the component failures in safety functions, correlation

may considerably vary CDF.

(b) The number of seismically induced component failures

in the system model for this study was much smaller

than that in the SSMRP. The effect of correlation on

CDF might be varied by the number of component

failures.

(c) The correlation coefficient of component failures is

determined by Eq. (6) and this relation shows that the

correlation coefficient of component failures depends

not only on the correlation coefficients between

respective responses and capacities, but also on the

variances in these responses and capacities. The

variances in responses of components in the Model

Plant PSA at JAERI are comparatively larger than

those in the SSMRP. Thus, the effect of correlation on

CDF might be varied by variances in responses and

capacities.

7. Conclusion

The authors developed a new method for considering

the effect of correlation of component failures in seismic

PSA by DQFM. In the DQFM method, occurrence

probability of a top event is calculated as follows: (1)

Response and capacity of each component are generated

according to their probability distribution. In this step, the

response and capacity can be made correlated according to

a set of arbitrarily given correlation data. (2) For each

component whether the component is failed or not is

judged by comparing the response and capacity. (3) The

status of each component, failure or success, is assigned as

either TRUE or FALSE in a Truth Table, which represents

the logical structure of FT to judge the occurrence of the

top event. After this trial is iterated sufficient times,

the occurrence probability of the top event is obtained as

the ratio of the occurrence number of the top event to the

number of total iterations.

The DQFM method has the following features compared

with the MCS method used in the well known SSMRP. The

DQFM method gives more exact results than the upper

bound approximation that the MCS method provides.

Further, this method considers the effect of correlation on

the union and intersection of component failures while the

MCS method only considers the latter.

The comparison between CDF calculated by the DQFM

method and that calculated by the MCS method for the case

of the Model Plant showed that CDF can be overestimated

by the MCS method especially when correlation was

considered. Moreover, the effect of correlation on CDF

evaluated by the DQFM method may not be so significant as

that evaluated in the SSMRP because of the effect of the

consideration of correlation of failures which reduces the

probability of union of components and was not easy for

MCS-based FT quantification methods.

References

[1] Risk Analysis Laboratory. Summary report of seismic PSA of BWR

Model Plant. JAERI-Research 99-035; 1999 (in Japanese).

[2] Budnitz RJ. Current status of methodologies for seismic probabilistic

safety analysis. Reliab Engng Syst Safety 1998;62:71–88.

[3] Ravindra MK. Seismic PSAs—issues, resolutions and insights.

Proceedings of the OECD/NEA Workshop on Seismic Risk, 10–12

August 1999, Tokyo, Japan, NEA/CSNI/R8(99)28; November 2000.

p. 431–41.

[4] Bohn MP Shieh LC, Wells JE, Cover LC, Bernreuter DL, Chen JC,

Johnson JJ, Bumps SE, Mensing RW, O’Connell WJ, Lappa DA.

Application of the SSMRP methodology to the seismic risk at the Zion

Nuclear Power Plant, NUREG/CR-3428; 1983.

[5] Reed JW, McCann Jr. MW, Iihara J, Hadidi-Tamjed H. Analytical

techniques for performing probabilistic seismic risk assessment of

Nuclear Power Plants. Proceedings of Fourth International Con-

ference on Structural Safety and Reliability (ICOSSAR’85); 1985.

[6] Ravindra MK, Johnson JJ. Seismically induced common cause

failures in PSA of nuclear power plants. Transactions of the 11th

International Conference on Structural Mechanics in Reactor

Technology (SMiRT-11), vol. M04/1; 1991.

[7] Abe K, Inui E, Tanaka T, Kato Y. Development and application of

computer codes to quantify the effect of correlation of responses on

the system reliability. Transactions of the 11th International

Conference on Structural Mechanics in Reactor Technology

(SMiRT 11), vol. 03/1; 1991.

[8] Lambright JA, Bohn MP, Daniel SL, Johnson JJ, Ravindra MK,

Hashimoto PO, Mraz MJ, Tong WH, Brosseau DA. Analysis of core

Table 4

Ratio of the CDF calculated by the MCS method to the CDF calculated by the DQFM method

CDF(MCS method)/CDF(DQFM method)

Independent case 1.3

Partially correlated response case 2.1

Fully correlated response case 2.8

Fully correlated response and capacity case 3.3


damage frequency: Peach Bottom Unit 2 external event, NUREG/CR-

4550; 1989(Peach Bottom Unit 2 is the name of a plant).

[9] Bohn MP, Lambright JA. Procedures for the external event core

damage frequency analyses for NUREG-1150, NUREG/CR-4840;

1990.

[10] Fleming KN, Mikschl TJ. Technical issues in the treatment of

dependence in seismic risk analysis. Proceedings of the OECD/NEA

Workshop on Seismic Risk, August 1999, Tokyo, Japan, NEA/CSNI/

R(99)28; November 2000. p. 253–68.

[11] Wells JW, George LL, Cummings GE. Seismic safety margins

research program, Phase I final report—systems analysis (Project

VII), NUREG/CR-2015, vol. 8; 1984.

[12] Watanabe Y, Oikawa T, Muramatsu K. An analysis of correlation of

response in the system reliability analysis in a seismic PSA of a

Nuclear Power Plant. Proceedings of the 20th CNS Nuclear

Simulation Symposium; 1997.

[13] Oikawa T, Kondo M, Mizuno Y, Watanabe Y, Fukuoka H,

Muramatsu K. Development of systems reliability analysis code

SECOM-2 for seismic PSA. Reliab Engng Syst Safety 1998;62:

251–71.

[14] Muramatsu K, Ebisawa K, Matsumoto K, Oikawa T, Kondo M,

Fukuoka H. Development of seismic PSA methodology at JAERI.

Proceedings of the Third International Conference on Nuclear

Engineering (ICONE-3); 1995. p. 1333–40.

[15] Bohn MP, Lambright JA, Daniel SL, Johnson JJ, Ravindra MK,

Hashimoto PO, Mraz MJ, Tong WH. Analysis of core damage

frequency: Surry Power Station Unit 1 external events, NUREG/CR-

4550; 1989.

[16] Hunter D. An upper bound for the probability of a union. J Appl Prob

1976;13:597–603.

[17] Sobajima M, Muramatsu K, Ebisawa K. Seismic probabilistic safety

assessment methodology development and application to a Model

Plant. Proceedings of the 10th Pacific Basin Nuclear Conference;

1996. p. 629–36.

[18] Ebisawa K, Abe K, Muramatsu K, Itoh M, Kohno K, Tanaka T.

Evaluation of response factors for seismic probabilistic safety assess-

ment of nuclear power plants. Nucl Engng Des 1994;147:197–210.

[19] Leverentz FL, Kirch H. User’s guide for the WAM–BAM computer

code, EPRI 217-2-5; 1976.

[20] Bodewig E, Matrix calculus, Amsterdam: North-Holland; 1959.

[21] Oikawa T, Kondo M, Watanabe Y, Shiraishi I, Hirose J, Muramatsu

K. Insights from the Seismic PSA of the BWR Model Plant at JAERI.

International Topical Meeting on Probabilistic Safety Assessment

(PSA’99), Washington, DC; 1999. p. 77–84.


Documents

Development of the DQFM method to consider the effect of correlation of component failures in seismic PSA of nuclear power plant