Methodology and results of the seismic probabilistic safety assessment of Krško Nuclear Power Plant

Nuclear Engineering and Design 182 (1998) 59–72

Methodology and results of the seismic probabilistic safetyassessment of Krs' ko Nuclear Power Plant

M. Vermaut a,*, Ph. Monette a, P. Shah a, R.D. Campbell b

a Westinghouse Energy Systems Europe, Boule6ard Paepsem 20, 1070 Brussels B, Belgiumb EQE International, Ir6ine, CA, USA

Received 1 September 1997; accepted 30 September 1997

Abstract

A seismic IPEEE (Individual Plant Examination for External Events) was performed for the Krs' ko plant. Themethodology adopted is the seismic PSA (probabilistic safety assessment). The Krs' ko NPP is located on a mediumto high seismicity site. The PSA study described here includes all the steps in the PSA sequence, i.e. reassessment ofsite hazard, calculation of plant structures response including soil–structure interaction, seismic plant walkdowns,probabilistic seismic fragility analysis of plant structures and components, and quantification of seismic core damagefrequency (CDF). Relay chatter analysis and soil stability studies were also performed. The seismic PSA describedhere is limited to the analysis of CDF (level 1 PSA). The subsequent determination and quantification of plantdamage states, containment behaviour and radioactive releases to the outside (level 2 PSA) have been performed forthe Krs' ko NPP but are not further described in this paper. The results of the seismic PSA study indicates that, withsome upgrades suggested by the PSA team, the seismic induced CDF is comparable with most US and WesternEurope NPPs located in high seismic areas. © 1998 Elsevier Science S.A. All rights reserved.

1. Introduction

This paper describes the seismic probabilisticsafety assessment (PSA) performed for the Krs' koplant. Krs' ko is a Westinghouse 2 loop PWR. Thesafe shutdown earthquake level specified for de-sign is 0.3 g PGA, with Reg. guide 1.60 designresponse spectra.

The seismic PSA is one of the options forperforming a seismic Individual Plant Examina-tion for External Events (IPEEE), i.e. examining

NPPs for beyond design basis loadings. A seismicmargins assessment is another alternative. How-ever, for peak ground accelerations (PGAs) above0.5 g, a PSA is the only acceptable method. ThePSA study was conducted in strict accordancewith the criteria specified by the USNRC for theevaluation of NPPs for beyond design basis eventsand was reviewed by the IAEA.

The seismic PSA described here is limited to theanalysis of core damage frequency (CDF)(level IPSA). The subsequent determination and quantifi-cation of plant damage states, containment be-haviour and radioactive releases to the outside(level 2 PSA) have been performed for the Krs' ko

* Corresponding author. Tel.: +32 2 5568111; fax: +32 25568926.

0029-5493/98/$19.00 © 1998 Elsevier Science S.A. All rights reserved.

PII S0029-5493(97)00274-4

M. Vermaut et al. / Nuclear Engineering and Design 182 (1998) 59–7260

Fig. 1. Krs' ko NPP site fractile hazard curves.

NPP but are not further described in this paper(Shah et al., 1996).

The different sections of this paper describe thesuccessive building blocks of the seismic PSAstudy. Obviously, no detailed methodology de-scriptions can be provided for each of the sec-tions. This paper intends to illustrate theapplication of the seismic PSA methodology tothe Krs' ko plant, using the Krs' ko specific assump-tions, inputs and results.

2. Seismic hazard

A site-specific seismic hazard analysis was pre-pared for the Krs' ko NPP site by the University ofLjubljana Institute of Structural and EarthquakeEngineering. The process of the Krs' ko NPP siteseismic hazard analysis is not further described inthis paper; only results from the process, to beused in the Krs' ko seismic PSA, are included here.

The hazard analysis has resulted in the determi-nation of probabilistic hazard curves and uniform

hazard response spectra. The probabilistic hazardcurves expressing frequency of exceedance as afunction of PGA are shown in Fig. 1. PGA is themotion input parameter in terms of which seismicfragilities (see Sections 3 and 4) are most com-monly expressed. Fig. 2 shows the probabilisticresponse spectral accelerations corresponding to auniform hazard of 10000 years. These spectralshapes, referred to as Uniform Hazard Spectra(UHS) were used in the calculation of soil–struc-ture interaction and building response analysis(Section 3)

2.1. Local earthquakes.

Accelerographs installed in the buildings of theKrs' ko NPP and surroundings have recorded sev-eral local earthquakes of small magnitude in thepast. All records show very short duration ofstrong ground motion (less than 1 s). The inputenergy of such ground motion is very small. Highfrequencies are clearly predominant in the re-sponse spectra for the local earthquakes (sharp

M. Vermaut et al. / Nuclear Engineering and Design 182 (1998) 59–72 61

Fig. 2. Krsko NPP site uniform hazard spectra (UHS) for 10000 years return period.

peaks occurring in the frequency range 11–12Hz). Accelerograms, obtained at the foundationsof buildings simultaneously with the free fieldmotion, are systematically much smaller than atthose on the surface. Studies following a 1989local earthquake at Krs' ko NPP have aimed atnumerically simulating this reduction in accelera-tion. According to experience, such ground mo-tions do not damage buildings and equipmentlocated in the buildings. Rather, the concern isrestricted to functional failures of devices such asrelays which are sensitive to high frequency albeitsmall displacement motion.

Theoretically, these frequently occurring smalllocal earthquakes could affect the shape of theUHS and the seismic hazard curves, leading to ahigher seismic risk. However, acceleration spectra,traditionally used for design of structures andused for the fragility analyses of this Krs' ko seis-mic PSA study, do not provide any informationon the duration of ground motion and do nottake this parameter into account, which is of greatimportance as a measure of input energy. It was

therefore deemed not correct to combine the influ-ence of strong earthquakes with ‘standard’ char-acteristics (larger magnitude earthquakes fromdistant sources), of weak local earthquakes withshort duration and predominant high frequencies.The characteristics of the first type are defined byspectra obtained by the probabilistic seismic haz-ard analysis as described above (results shown inFigs. 1 and 2). The second type corresponds tosmall local earthquakes. An idealized spectrum(see Fig. 3) is used to represent the latter. It wasconcluded from the seismic hazard analysis thatpeak ground accelerations greater than 0.5 g werenot expected from local earthquakes. However,data is insufficient to develop a probabilistic de-scription of the hazard due to local earthquakes.The approach taken in the Krs' ko PSA study is toassume that a local earthquake PGA of 0.6 g willnot be exceeded in less than 10000 years, makingthe local earthquake PGA hazard comparablewith the PGA hazard for distant earthquakes.

Structural response studies performed on anequivalent basis for the local and distant earth-


Fig. 3. Statistics of six recorded local earthquakes and proposed local earthquake response spectrum.

quakes show that response spectra for the distantearthquakes generally exceed the correspondingspectra for local earthquakes. Exceptions wherethe local earthquake spectra exceed the distantearthquake spectra are limited to some higherbuilding elevations, and to a narrow frequencyband around 11–12 Hz. Given the non-damagingcharacter of local earthquakes, only the impact ofthe local earthquake spectra on the relay seismiccapacity evaluations is considered to be of anysignificance.

3. Soil–structure interaction and building responseanalysis

For seismic PSA purposes, it is of fundamentalimportance to obtain realistic estimates of struc-tural responses to the postulated seismic events.In general, floor response spectra and structuremember forces developed for the final safety anal-ysis report (FSAR) are considered to be conserva-tively biased. Hence it was decided to generatenew seismic structural responses using currentstate-of-the-art techniques, and to avoid any in-tentional bias in the analysis with respect to soil–

structure modeling. In order to generate seismicresults in a form convenient for the developmentof structural and equipment fragilities (Section 4),a probabilistic approach was adopted.

The structures included in the study were themain complex (MC), the diesel generator building(DOB) and the essential service water intakestructure (ESWIS). The MC is formed by thereactor building, intermediate building, controlbuilding, fuel handling building, auxiliary build-ing and component cooling building. Since all thebuildings at the MC are on a common founda-tion, the analysis was performed considering all ofthem.

The objectives of this part of the study weretwofold:� To estimate median structure forces and the

variability about the median for all majorstructures of interest, for input to the seismicfragility analysis of these plant structures (Sec-tion 4).

� To develop probabilistic floor response spectrain all major structures for use in the seismicfragility analysis of equipment located withinthe plant structures.


The approach to probabilistic response analysiswas to perform multiple deterministic SSI analy-ses using the methodology described here below.Input motion and SSI parameters (structural fre-quency and damping, and soil shear modulus anddamping) were sampled following the Latin Hy-percube Sampling method. As a result of multipledeterministic analyses using the sampled inputvalues, distributions were obtained of the analysisresults i.e. loads in structural elements and in-structure response spectra. These distributions arethen described by the median (50th percentile)values and the variability (represented e.g. in the84th percentile curve).

As both the seismic hazard and the structure/component fragility curves (consistently) use thePGA as the reference seismic input parameter,SSI and probabilistic structural response analysiswere performed for a reference PGA value. How-ever, direct scaling of results from one earthquakelevel to another is not strictly correct due tonon-linearity in soil behaviour. Also, due to thecomplexity of the structural model and the proba-bilistic (multiple time history) analysis methodused, a single level of earthquake was desiredrather than multiple earthquakes. Past studieshave shown that the greatest risk comes fromearthquakes twice to three times the SSE. For theKrs' ko PSA, twice the SSE level was chosen as thelevel that would challenge the weaker elements ofthe plant which would govern risk. For thosecomponents with much higher capacity, scalingthe response for an input of twice the SSE wouldtend to be conservative since higher input levelsthat would challenge these components wouldresult in more attenuation in soil–structuralamplification.

In probabilistic response analysis, the charac-teristics of the free-field ground motion is definedby the shape of the median uniform hazard spec-trum (UHS) corresponding to a return period ofinterest. For the Krs' ko PSA, the VHS shapecorresponding to the 10000 year return periodwas used (see Fig. 2).

The elements of the SSI and probabilistic re-sponse analysis are outlined below. The approachis based on work performed under the SSMRP(Seismic Safety Margins Research Program,

NUREG/CR-2015, 1981). Analysis results arealso provided below.� Specifying the free-field ground motion. Since

the SSE level for Krs' ko is 0.3 g PGA, themedian UHS shape for the probabilistic analy-sis was anchored to a PGA of 0.6 g. To per-form the probabilistic analysis, an ensemble of30 earthquakes was developed to capture therandomness of the seismic input. The median(50% non-exceedance probability-NEP)matches the median UHS, and the 84th percen-tile (84% NEP) of the spectra matches the 84thpercentile of the UHS, as is shown on Fig. 4(UHS spectra anchored to 0.6 g PGA). Toaccount for the effects of deconvolution in theSSI analysis of the main complex, the motionat the embedment depth of this structure wasdetermined by deconvolving the surface ensem-ble of the time histories, using soil propertiescompatible with the other analysis steps. Forcomparison with Fig. 4, Fig. 5 shows the com-parison between the 50% and 84% NEP of thedeconvolved spectra with the 50% and 84%NEP UHS.

� Development of the soil models, i.e. definingthe soil profile and performing the site responseanalysis. For the low strain soil properties andthe dynamic soil properties, best estimate val-ues were obtained from previous studies. A siteresponse analysis was performed for the 0.6 gPGA level to establish median strain compat-ible soil properties. For the probabilistic SSIand response analysis, the distribution of soilparameters was required. A lognormal distri-bution was taken for each parameter (soil shearmodulus and soil damping), with a coefficientof variation based on previous work and expertjudgement.

� Calculating the foundation impedance func-tions and wave scattering effects. The highstrain soil properties obtained above were usedto develop impedance functions for the threestructures (MC, DGB, ESWIS).

� Determining the fixed-base dynamic character-istics of the structure. Structural models devel-oped for the original Krs' ko design analysis(and reported in the FSAR) are representativeof current procedures, and may be considered


Fig. 4. Response spectra of the ensemble of time-histories vs. 10000 years return period UHS.

as best estimate models for the purpose of thisstudy. SSI effects were incorporated using founda-tion impedance functions to replace the soilsprings representing the supporting soils flexibilityin the original design analysis. As for the soilproperties, the structural frequencies and struc-tural damping are probabilistic parameters whichwere assigned lognormal distributions and typicalcoefficients of variation representing all modellingand random uncertainty in the estimation of themedian values. The largest variabilities for theKrs' ko analysis are in the soil parameters.� Performing the SSI analysis, i.e. combining theprevious steps to calculate the response of thecoupled soil–structure system.

The SSI and structural response analysis resultsof interest include peak accelerations, maximummember forces, and floor acceleration time histo-ries. These quantities are needed for downstreamfragility development.

Floor acceleration time histories computed foreach of the 30 simulations performed were post-processed into 5% damped floor response spec-tra. For each location, the spectral accelerationswere fitted to a lognormal distribution and themedian and 84th percentile values were ex-tracted. An example comparison between thecalculated median in-structure response spectraand the Krs' ko FSAR design spectra is given inFig. 6 (the example applies to the main com-plex). The most notable difference between theFSAR and the median centered spectra is thefrequency at which the spectral peak occurs.This shift can be explained through a shift inthe dominant frequency of the SSI and struc-tural response, which is caused by the lower me-dian soil stiffness properties corresponding tothe 0.6 g PGA earthquake level which is higherthan the 0.3 g PGA SSE level used in theFSAR.


Fig. 5. Response spectra of the ensemble of deconvolved time-histories vs. 10000 years return period UHS.

3.1. Local earthquakes

As indicated in Section 2, a distinction wasmade between low energy local earthquakes andlarge magnitude distant earthquakes.

Deterministic SSI and structure response analy-ses were performed for a representative localearthquake which was determined to be an ap-proximate 84th percentile amplification fromrecorded close-in earthquakes. Response wascompared, on an equivalent basis (a median re-sponse analysis of a 84% NEP close-in free-fieldinput response spectrum), to results from the re-sponse analyses (84% NEP response to 50% NEPfree-field input) for distant earthquakes.

Analysis showed that the local earthquake free-field motion is attentuated considerably. Indeed,the system (soils+structure) frequency is not in

the amplified portion of the input spectra of thelocal earthquake. In contrast, the distant sourceswith low frequency cause significantly higher re-sponse. Therefore, it is generally seen that thefloor response spectra from the distant earth-quakes envelop the corresponding floor responsespectra calculated for the local earthquake. How-ever, for a limited number of locations at higherelevation in the buildings, the local earthquakedid induce a higher response than the distantsources, in the limited 11–12 Hz frequency range.However, based on the fact that local earth-quakes, with a very short duration and smallenergy input are deemed not to cause damage tostructures or cause equipment to structurally fail,the exceedances of the local over the global re-sponse spectra are only taken into account in theseismic capacity assessment of relays (Section 6).


Fig. 6. Comparison of FSAR vs. median probabilistic response spectrum (Reactor Containment Base, East-West Translation).

4. Fragility analysis

Background on the probabilistic seismic fra-gility curve representation and development isprovided in IAEA-TECDOC-724, 1993.

4.1. Seismic walkdowns

Seismic walkdown must be performed as partof the seismic IPEEE process. Also, past experi-ence in conducting seismic PSA and seismic mar-gin assessments has shown that the walkdown isgenerally a very beneficial task in a seismicIPEEE. A walkdown conducted by experiencedengineers is valuable in order to identify anypotential seismic vulnerabilities and using knowl-edge regarding the performance of structures andequipment in strong motion seismic events, screenout the inherently very rugged components andassemble data on components for which plantspecific fragility curves will be developed (to a

required level of detail as described in Section4.2).

The Krs' ko PSA seismic walkdown extensivescope of the survey included:� structures (MC, DGB, ESWIS)� safe shutdown equipment (available from the

internal event PSA being performed on theKrs' ko plant) including support systems:pumps, tanks, heat exchangers, diesel generatorsystem, batteries, HVAC, electrical cabinets

� piping and piping components (per P&IDs):support configurations, II/I issues, valve opera-tor proximity,...

� cable trays: sample� instrumentation and tubing (per P&IDs)� all structures and equipment which could rep-

resent an interaction hazard to the safe shut-down equipment were identified during thewalkdownThe general observation from the walkdown

was that the design was conservative and that the


plant was quite rugged. Potential vulnerabilities ofa few items of equipment were observed.

These included:� poor anchorage welding on few electrical

cabinets� low bending capacity of support legs of one

tank (the corresponding low seismic capacitywas confirmed from the fragility calculations ofthe tank)

� control room ceiling support requiredreinforcementFixes were recommended for the above issues,

as they could be easily fixed and would increasethe seismic capacity of the components to a gener-ally adopted screening level (as per Section 4.2).

Seismic-fire and seismic-flooding interactionwalkdowns were also performed, in order to iden-tify potential seismic sources of fire and floodingrespectively.

4.2. Screening le6el for seismic fragility analysis

From the safe shutdown equipment lists andfollowing the seismic walkdowns of the plant, 37equipment items (i.e. individual components orgroups of components) were retained for fragilityanalysis, in addition to the essential structures(MC, DGB, ESWIS).

However, from a verification of the impact onCDF, it was determined that structures and com-ponents could be ‘screened out’ if their high confi-dence of low probability of failure (HCLPF) wasabout 0.74 g PGA or greater or their mediancapacity was about 2.0 g PGA or greater. If itcould be determined through a conservative anal-ysis that the screening level was exceeded for astructure or component, no further detailed fra-gility analysis would be performed, and the con-servatively low screening capacity level would beassigned to that structure or component. Theimpact of this conservatism on the resulting CDFis marginal.

4.3. Seismic fragilities of plant structures andequipment

Seismic fragility curves were calculated forplant structures and components. The seismic fra-

gility of a component is defined by a curve thatgives the conditional probability of failure as afunction of the reference seismic input motionparameter (PGA in the case of the Krs' ko study).Randomness and uncertainty are trackedthroughout the fragility analysis and incorporatedinto a family of probabilistic curves (IAEA-TEC-DOC-724, 1993).

Sources of plant documentation to supportthe fragility analyses included original designanalysis, seismic qualification reports, plantdrawings as well as data and notes on expectedlimiting failure modes collected during the walk-downs.

The determination of the seismic capacity ofplant structures normally requires the evaluationof a number of parameters such as strength, in-elastic energy dissipation, response characteris-tics,… including the determination of medianfactors and associated variabilities. For all theKrs' ko structures, the single strength parameterwas demonstrated to be sufficiently high for thescreening seismic capacity level to be met, with-out further detailed evaluation of inelastic en-ergy dissipation nor evaluation of thevariabilities associated with the various parame-ters contributing to the seismic capacity.

Similarly, the seismic capacity of the majorityof plant safe shutdown components was foundto exceed the screening level. Provided fixes arecarried out to the seismic vulnerabilities iden-tified during the walkdown, the following is asmall list of components for which capacitieswere calculated to be below the screening level.

MedianComponent HCLPF(g)capacity (g)

0.78 0.31Condensate storagetank

DG control cabinets 0.461.251.11 0.48Refueling water

storage tankBattery chargers 0.581.59

0.67DG fuel oil tank 1.64


It should be noted that the calculated seismiccapacities of the DG control cabinets and thebattery chargers are based on the design qualifica-tion level. It is expected that higher seismic capac-ities could be demonstrated if qualification testreports to such levels were available.

4.4. Screening of soils stability issues

The evaluation of the potential for soil liquefac-tion is a requirement of the IPEEE. The soilstability evaluations were therefore performed andit was concluded that the HCLPF was in excess of0.7 g, which is consistent with the screening leveladopted for the structures and components.

The following list summarizes the credible soilrelated issues for which an evaluation or verifica-tion was performed:� liquefaction potential for yard area soils sup-

porting ESW piping and electrical duct bank� settlement of soils underlying the safety related

plant structures� lateral earth pressure on partially buried safety

related buildings as well as stability of theessential service water (ESW) pumphouse andintake structure against sliding

� stability of the river bank slope at the ESWbuilding and the potential impact of its failureon the intake structure

5. Risk quantification

The frequencies of core damage are calculatedby combining the component and structures fra-gilities described in earlier sections, with the plantlogic. Event and fault trees are constructed toidentify the accident sequences which may lead tocore damage.

The risk quantification process described here islimited to the calculation of core melt frequency(level 1 PSA). The subsequent determination andquantification of plant damage states, contain-ment behaviour and radioactive releases to theoutside (level 2 PSA) were performed for theKrs' ko NPP but are not further described in thispaper (Shah et al., 1996).

The Krs' ko NPP SPSA was performed in such away as to employ much of the work done in theinternal events analysis of the Krs' ko IndividualPlant Evaluation (IPE). That is, the event treesand fault trees developed for the internal eventsanalysis would at most need to be modified toaddress the specific aspects of the plant or systemsresponse to a particular seismic event.

5.1. Seismically induced initiating e6entdetermination and frequency calculation

Seismically induced initiating events consideredin the CDF quantification are outlined below. Thelist of initiating events is constructed based on thefollowing process:1. A choice is made of buildings, structures and

equipment used to determine the plant statusfollowing the seismic event.

2. Given the failure of each of the items listed instep 1, the plant disposition is defined. Failureswith similar results are grouped together intofailure groups.

3. A hierarchy among initiating events is devel-oped. The order of the hierarchy is such that,if one initiating event occurs, the occurrence ofother initiating events further down the hier-archy are of no significance in terms of plantresponse.

4. The conditional probability of failure for eachfailure group is determined from the fragilitycurves of the components in the failure group.

The failure groups defined for the Krs' ko seis-mic initiating events are described below.� Building structure or steam generator failure.

Either of these failures is conservatively as-sumed to cause direct seismically induced coredamage with containment breach or contain-ment bypass.

� RCS component failure. The failure of any ofthose components is assumed to lead to a largeLOCA. The RPV support failure case is as-sumed to lead to direct core damage.

� Large primary pipe break. This failure is afunction of the RCS equipment supports.

� Medium primary pipe break. This categoryincludes all pipes of sufficient size to produce amedium LOCA event. The probabilities are


estimates based on calculations for appropriatelysized piping calculated in the SSMRP Zion analy-sis (Bohn et al., 1990). The latter piping seismicfragility figures were evaluated to conservativelyrepresent the Krs' ko specific piping seismicfragilities.� Small primary pipe break. This category in-cludes all pipes of sufficient size to produce asmall LOCA event. The probabilities are esti-mates based on calculations for appropriatelysized piping calculated in the SSMRP Zion analy-sis (Bohn et al., 1990). In addition, the failuremode of the reactor coolant pumps which leads todamage of the seals causes a leakage equivalent tothe small LOCA.� Emergency service water pumphouse failure.This failure leads to loss of the ESW systems,leading eventually to the loss of component cool-ing water system heat removal ability.� Secondary side pipe break.� ATWS due to control rod insertion failure.� Loss of off-site power.Note that since the switchyard ceramic conduc-tors have a high probability of failure during aseismic event, loss of off-site power was alsoconsidered to be combined with all other initiat-ing events. A generic seismic fragility based on USelectrical grids was used for the Slovenian electri-cal grid. The probability of the loss of off-sitepower was assumed to be based on a referencegrid fragility curve from the U.S. Very little datawas available on the failure probability of theSlovenian grid. During the IPE the loss of powerevents at the plant were researched and the grid,at least, from the IPE perspective was found tohave a similar failure probability to the U.S.grids.

Westinghouse has performed several seismicPSAs considering the loss of off-site power as wellas transients where off-site power was not lost. Inall cases, it was found that for plants with arugged seismic design such as Krs' ko, the domi-nant plant risk contributions all come from theloss of off-site power cases. For the Krs' ko seismicPSA an evaluation was performed up-front whichindicated that the cases with off-site power wouldnot be dominant and, hence, were not expandedinto event trees and fault trees.

5.2. Seismic e6ent trees and fault trees

For each initiating event, an event tree modelsthe plant system performance, and hence the acci-dent sequences leading to different plant states.The event trees developed for the Krs' ko NPPinternal events IPE were used as the basis for theseismic event trees. Systems which are not seismi-cally qualified are assumed to fail (such as theinstrument air system). No cases were found thatwould indicate that the continued operation of anon-seismic system or component after the earth-quake would be more detrimental than the case ofthe loss of the system or component. In the caseof instrument air, the instrument air operatedvalves were assumed to fail the designed loss ofinstrument air position. However, considerationof the valve failing seismically to a different posi-tion was taken and its failure probability inte-grated into the seismic fault trees.

The seismic fault trees are defined by the seis-mic event tree nodes and those components andsupport systems which are required for successfulsystem operation represented by the event treenode. The seismic fault trees are put in parallelwith the internal events analysis fault trees, i.e.random and seismic fault trees are combined inthe CDF quantification process. Several assump-tions affecting the construction of seismic faulttrees are:� Similar redundant components, generally lo-

cated in close proximity, simultaneously failwith a probability equal to that of one compo-nent. This (conservatively) removes train re-dundancy while simplifying the seismic faulttrees.

� Off-site power is assumed not to be recoverable(within 24 h). Events which take credit forsystem recoveries are generally not possiblewithin the first 24 h after an earthquake.

� Operator actions required within 10 min afterthe occurrence of the earthquake are assumedto fail.

� Systems which are not classified as seismiccategory 1 are conservatively assumed to fail atany seismic activity level (e.g. instrument air).The human reliability assessment, HRA,

methodology followed in the IPE was according


Fig. 7. CDF quantification results summary.

to Swain, 1987. In general, the same failure prob-abilities were also used for the seismic PSA. Forruggedly designed plants such as Krs' ko with seis-mically well designed control rooms an evaluationwas made that 10 min represents a conservativevalue for assuming no operator action after aseismic event.

5.3. Seismic hazard inter6als

For the CDF quantification, the range of PGAof interest was split into a number of intervals:

1Seismic interval 0.15–0.25 g2 0.25–0.35 g

0.35–0.50 g34 0.50–0.70 g

0.70–0.90 g56 0.90–1.10 g

For each interval, the median PGA was se-lected to represent the interval. The correspond-ing frequency of occurrence was set equal to thefrequency of occurrence of PGA values withinthe interval, as obtained from the seismic hazardcurves (see Fig. 1).

5.4. Core damage frequency quantification results

Compilation and quantification of the faulttrees and event trees leads to insight into themost important core damage sequences, andthe most important core damage cutsets i.e.the components whose failures contribute themost to core damage. Fig. 7 illustrates thedistribution of core melt frequency contribu-tions from the different seismic intervals.

A review of CDF quantification resultsleads to the following observations.


� The significant contributors to core melt fromthe first two seismic intervals (PGA B0.35 g)are DG random failures combined with theloss of off-site power.

� For higher PGA levels, seismic failures ofcomponents begin to appear in parallel withthe random failures and loss of off-sitepower. The significant seismic failures ofcomponents involve the diesel generator con-trol panel, the battery chargers, the conden-sate storage tank, and the refueling waterstorage tank. As indicated in Section 4, thefailure probabilities of battery chargers andDG control panels assumed in the analysisare considered to be conservatively high asthey were based on limited seismic qualifica-tion documentation.

� The station blackout initiating event repre-sents more than half of the total seismic coredamage frequency. Therefore, if plant modifi-cations are made as a result of the seismicPSA, they should focus on improvements thatlower the contribution to core damage by sta-tion blackout. Also, from the level 2 analysis,the plant damage states which represent thestation black-out sequences contribute by farthe largest frequency to containment failureand containment bypass (Shah et al., 1996).

6. Relay evaluation

A relay chatter evaluation was also performedas part of the Krs' ko IPEEE. The purpose of theevaluation was to verify the capacity of relaysagainst chattering, and/or the acceptability of re-lay chatter in a seismic event. A progressivescreening of relays based on at least one of thefollowing criteria was performed:1. The best estimate seismic capacity of the relay

is higher than the screening level of 2.0 g PGA,which is consistent with the screening leveladopted for plant equipment.

2. Relay chatter which occurs does not affect theability to achieve and maintain safe shutdown.

Progressive screening was applied to extensivelists of relays, switches, contactors and breakersavailable from plant equipment databases. Screen-

ing was performed in any sequence which wouldpermit rapid elimination of groups of relays fromthe lists. IN summary, the screening was based onthe following:� solid state relays and some contacting

devices, such as mechanically actuated con-tacts, are considered seismically rugged.

� seismic capacity against chattering is deter-mined for relay types for which test data,generic industry data,… are available. Relaydemand was calculated from floor spectraand cabinet amplification. As explained inSection 2, the local earthquake floor responsespectra were taken into consideration as wellas the distant earthquake response spectra. Ofthe probabilistic relay capacity description,only the median (best estimate) capacity valuewas calculated for the relay types and com-pared with the 2.0 g PGA median capacitycriterion. A significant number of relays couldbe screened out as the criterion was met.

� relays whose change of state can be toleratedas having no adverse impact on safe shut-down (no spurious seal-in or latch occurswhich would prevent the system from per-forming its safe shutdown function, or pre-vents control resets and operational controlsuch as pump restart from the control roomor other normal point of control), and/orwhich can be reset by operator action (withina reasonable time, assumed for the purposeof this evaluation as 30 min to 1 h, and ac-cording to existing procedures and based onaccessibility of required indications) arescreened out.Nearly all relays in the plant were screened

out following the above process. The list of re-lays requiring operator action to reset needs tobe evaluated further to determine if the operatorwill have time after the seismic event to reset allof the relays which are latched in an unfa-vourable position.

7. Conclusions

A full seismic PSA was performed for Krs' koaccording to the guidelines specified by US Nu-


clear Regulatory Commission, 1991. Seismic fail-ure probabilities for all safe-shutdown compo-nents were developed. These failure probabilitieswere used in the fault trees and event trees alongwith the HRA and IPE random event failureprobabilities to determine a seismic core meltfrequency. For a majority of components, thehigh seismic capacity was conservatively repre-sented by a lower bound screening capacity. Thescreening level was chosen in order that it wouldnot significantly affect the results which are dic-tated by a limited number of components andevent sequences.

A full uncertainty analysis was not performed.Plant evaluation showed that only a few compo-nents and events are deemed significant in theseismic PSA. The other screened events, althoughgiven conservatively high failure probabilities, donot show up as dominant contributors to theseismic core melt frequency. Moreover, the largestuncertainty in this analysis arises from the hazardcurve.

Before any upgrade decisions are made for theKrs' ko plant based on the Seismic PSA, sensitivitycases will need to be run to rank the possibleupgrade options and their effect on the core meltfrequency. The risk achievement worth, RAW,and risk reduction worth, RRW were calculatedfor all the seismic basic events. These importantmeasures were used to rank the importance of thevarious basic events.

The largest contributors to the seismic coremelt frequency as defined by the RRW are:� Recovery of the DG� Random Failure of the DG

These two categories of events have a muchmore significant contribution to the core meltfrequency than any of the seismically related fail-ures. Hence, given the fact that the Krs' ko seismiccore melt frequency is near that of other welldesigned plants in high seismic areas and that therandom failures bind the seismic fragility basedfailure probabilities, this plant is considered to beseismically very sound.

References

IAEA-TECDOC-724, 1993. Probabilistic safety assessment forseismic events, October 1993.

NUREG/CR-2015, 1981. Lawrence Livermore Laboratory,Seismic Safety Margins Research Program, Phase I FinalReport-SMACS-Seismic Methodology Chain with Statis-tics (Project VIII), vol.9, September 1981.

Bohn, M.P. et al., 1990. NUREG/CR-4550, also SAND86-2084, vol.3, Rev. 1, Part 3, December 1990, Analysis ofCore Damage Frequency: Surry Power Station, Unit 1External Events.

Shah, P.N., Prior, R., Wolvaardt, F.P., Bastien, R., 1996.Krs' ko seismic level II PRA, Proceedings of the 3rd Re-gional Meeting Nuclear Energy in Central Europe, p.164,Portoroz, Slovenia, September 1996.

Swain, A.D., 1987. NUREG/CR 4772, Accident SequenceEvaluation Program Human Reliability Analysis Proce-dure.

US Nuclear Regulatory Commission, 1991. Procedural andSubmittal Guidance for the IPE of External Events forSevere Accident Vulnerabilities, NUREG-1407, June 1991.

.

Documents

Methodology and results of the seismic probabilistic safety assessment of Krško Nuclear Power Plant