SSG-89 Evaluation of Seismic Safety for Nuclear Installations

IAEA Safety Standards Series No. GSR Part 4 (Rev. 1), Safety Assessment for Facilities and Activities [1];

IAEA Safety Standards Series No. SSR-1, Site Evaluation for Nuclear Installations [2];

IAEA Safety Standards Series No. SSR-2/1 (Rev. 1), Safety of Nuclear Power Plants: Design [3];

IAEA Safety Standards Series No. SSR-2/2 (Rev. 1), Safety of Nuclear Power Plants: Commissioning and Operation [4];

IAEA Safety Standards Series No. SSR-3, Safety of Research Reactors [5];

IAEA Safety Standards Series No. SSR-4, Safety of Nuclear Fuel Cycle Facilities [6].

Nuclear power plants;

Research reactors (including subcritical and critical assemblies) and any adjoining radioisotope production facilities;

Storage facilities for spent fuel;

Facilities for the enrichment of uranium;

Nuclear fuel fabrication facilities;

Conversion facilities;

Facilities for the reprocessing of spent fuel;

Facilities for the predisposal management of radioactive waste arising from nuclear fuel cycle facilities;

Nuclear fuel cycle related research and development facilities.

Requirement 10 of GSR Part 4 (Rev. 1) [1] states that “It shall be determined in the safety assessment whether a facility or activity uses, to the extent practicable, structures, systems and components of robust and proven design.”

Requirement 13 of GSR Part 4 (Rev. 1) [1] states that “It shall be determined in the assessment of defence in depth whether adequate provisions have been made at each of the levels of defence in depth.”

Paragraph 4.48A of GSR Part 4 (Rev. 1) [1] states that (footnote omitted) “Where practicable, the safety assessment shall confirm that there are adequate margins to avoid cliff edge effects that would have unacceptable consequences.”

Requirement 15 of GSR Part 4 (Rev. 1) [1] states that “Both deterministic and probabilistic approaches shall be included in the safety analysis.”

Requirement 24 of GSR Part 4 (Rev. 1) [1] states that “The safety assessment shall be periodically reviewed and updated.”

Evidence of a significant increase in the seismic hazard at the site, arising from new or additional data (e.g. newly discovered seismogenic structures, newly installed seismological networks, new palaeoseismological evidence), new methods of seismic hazard assessment and/or the occurrence of actual earthquakes that affect the installation;

Regulatory requirements, such as a requirement for periodic safety reviews, that take into account the state of knowledge and the actual condition of the installation;

Inadequate seismic design, generally due to the very old design of the installation;

New technical findings, such as vulnerability of selected structures, non-structural elements (e.g. masonry walls) and/or systems or components (e.g. relays);

New experience from the occurrence of earthquakes (e.g. better recorded ground motion data, observed performance of SSCs);

A need to address the performance of the installation for beyond design basis earthquake ground motions in order to provide confidence that there is no cliff edge effect — that is, to demonstrate that no significant failures would occur in the installation if an earthquake stronger than the design basis earthquake were to occur;

A programme of long term operation that extends the lifetime of the plant, if applicable.

To demonstrate the seismic safety margin beyond the original design basis earthquake and to confirm that there are no cliff edge effects.

To identify weak links¹¹ in the installation and its operations with respect to seismic events.

To evaluate a group of installations (e.g. all the installations in a region or a State) in order to determine their relative seismic capacity and/or their risk ranking. For this purpose, similar and comparable methodologies should be adopted.

To provide input for integrated risk informed decision making.

To identify and prioritize possible upgrades.

To assess risk metrics (e.g. core and/or fuel damage frequency, large early release frequency) against regulatory requirements, if any.

To assess installation capacity metrics (e.g. system level and installation level fragilities, high confidence of low probability of failure (HCLPF) capacity¹²) against regulatory expectations.

Metrics of the seismic capacity of the nuclear installation in deterministic and/or probabilistic terms;

Quantification of the seismic risk;

Identification of SSCs with low seismic capacity, and the associated consequences for installation safety, for use in decision making on seismic upgrade programmes;

Identification of operational modifications to improve seismic capacity;

Identification of improvements to housekeeping practices (e.g. storage of maintenance equipment);

Identification of interactions with equipment and piping, including fire protection systems, high enthalpy lines and utilities;

Identification of actions to be taken before, during and after the occurrence of an earthquake that affects the installation, including arrangements for operational and management response, analysis of the instrumental seismic records obtained and inspections performed, and the integrity evaluations to be performed as a consequence;

A framework to provide input to risk informed decision making;

A framework for the revision of the seismic categorization of SSCs.

Evaluation of the geological stability of the site [7, 9], with two main objectives pertaining to non-vibratory ground motions:

Characterization of the severity of the seismic ground motion at the site (i.e. assessment of the vibratory ground motion parameters), taking into consideration the full scope of the seismotectonic effects at the four spatial scales of investigation¹⁴ and as recommended in SSG-9 (Rev. 1) [7].

Evaluation of other concomitant phenomena, such as flooding due to seismically induced failure of dams or water retaining structures, coastal flooding due to tsunami, and seismically induced slope instabilities.

To verify the absence of any capable fault that could produce significant differential ground displacement phenomena underneath or in close proximity to buildings and structures important to safety. If there is evidence that indicates the possibility of a capable fault in the site area or site vicinity, the fault displacement hazard should first be assessed in accordance with the guidance provided in SSG-9 (Rev. 1) [7].

To characterize potential permanent ground deformation phenomena (e.g. liquefaction, slope instability, excessive settlement, subsidence, collapse).

Calculation of risk metrics (e.g. core and/or fuel damage frequency, large early release frequency);

Establishment of a risk management tool for risk informed decision making;

Determination of the relative risk between seismic and other internal and external hazards;

Provision of a cost–benefit analysis tool for decision making in relation to plant upgrades.

The methodology should be adequate for achieving the objective of the seismic safety evaluation in the context of the reasons that motivated the seismic safety evaluation (a number of these objectives and reasons are listed in paras 2.16 and 2.15, respectively).

The methodology and its end products should be able to meet the regulatory requirements applicable to the installation.

The methodology should be capable of demonstrating that the installation will meet the safety requirements indicated in paras 2.1–2.6, as applicable to the reasons for the evaluation and the installation type.

The availability and quality of knowledge and data sources needed to support the application of the methodology and its technical elements. For example, for SPSA, site specific probabilistic seismic hazard analyses need to be conducted, which in turn rely on the availability of specific information about seismicity rates and ground motion propagation characteristics from all potential sources within a distance range that can contribute to the seismic hazard of interest at the installation and on the explicit characterization of uncertainty in these parameters. For deterministic seismic hazard analysis, knowledge of this information is needed only for the few rupture sources that dominate the seismic hazard at the installation, and a less explicit uncertainty characterization can be accommodated.

The schedule for applying the selected methodology.

The initial and maintenance cost²⁰ commitments of the selected methodology.

The potential added value achieved, in addition to the primary safety evaluation objective, and how that added value aligns with the longer term strategic objectives of the installation. Value might be added through the ability to use the safety assessment methodology components or end products for other objectives, the ability to reuse or upgrade these components or end products in the future, and the flexibility to accommodate future changes in regulatory requirements over the remaining or anticipated lifetime of the installation.

The fact that the assessment methodology does not need to be the same for all seismically induced hazards and potential SSC failures. For example, an SPSA methodology may be selected to perform the seismic safety evaluation of only vibratory ground motions, while a screening evaluation may be selected to demonstrate that the installation has a sufficiently high seismic margin for the effects of the remaining seismic hazards. This implies that such seismic hazards would make a negligible contribution to seismic risk and need not be considered explicitly in SPSA.

Determination of the seismic safety margin above a specified earthquake (e.g. the design basis earthquake) or a recorded earthquake that affected the installation;

Demonstration of the seismic robustness of the nuclear installation against cliff edge effects, when robustness is characterized by seismic safety margin;

Demonstration of a sufficient safety margin to restart operation following the occurrence of a beyond design basis earthquake that led to the shutdown of the nuclear installation and potentially to other actions defined in Ref. [18];

Comparison of an estimate of installation level HCLPF capacity with regulatory expectations;

Identification of weak links in the credited success paths for the nuclear installation’s response to a beyond design basis earthquake event;

Identification of possible upgrades for SSCs in the success paths to improve the seismic safety margin;

Comparative safety assessment of a group of nuclear installations benchmarked by seismic safety margin against (i) the same earthquake effects, (ii) the effects of a common earthquake scenario or (iii) earthquakes that represent the same level of seismic hazard at each site;

Effective communication about the robustness of the nuclear installation to stakeholders, including the public;

Demonstration that the current seismic regulatory requirements are being met for nuclear installations that were designed without seismic regulatory requirements.

Comparison of an estimate of installation level and accident sequence level HCLPF capacities with regulatory expectations;

Identification of critical accident scenarios that might undermine safety in the nuclear installation’s response to a beyond design basis earthquake event, and identification of the weak link(s) in each accident sequence;

Identification and prioritization of possible upgrades for safety related SSCs to improve the seismic safety margin²³;

Provision of preliminary insights for risk informed design and resource allocation decisions (e.g. safety classification of SSCs); (e) Comparative safety assessment of a group of installations benchmarked by either (i) the installation level seismic safety margin or (ii) sequence level seismic safety margins against specific accident classes and/or potential consequences.

Comparison of the risk metrics for unacceptable performance (e.g. core damage frequency, large early release frequency) with regulatory expectations;

Quantification and ranking of relative risk contributions (e.g. of accident sequences, individual SSCs or human actions) in the installation’s as-operated condition;

Evaluation of the risk reduction worth of possible SSC upgrades, procedural changes or mitigation strategy implementation;

Provision of quantitative input to risk informed design and resource allocation decisions (e.g. impact on risk of the safety classification of SSCs);

Understanding of uncertainty in seismic safety metrics²⁵ and incorporation of uncertainty into the seismic safety evaluation conclusions;

Enabling of risk monitoring models that integrate real time changes in the condition of the installation (e.g. living PSA, digital twin technologies);

Comparative safety assessment of a group of installations benchmarked by either seismic safety margin or risk metrics.

Safety analysis report.

Codes and standards used for the design of the installation:

General arrangement and layout drawings for structures, equipment and distribution systems (e.g. piping, cable trays, ventilation ducts).

PSA of internal and external events, if performed.

For existing installations, data and information on results and reports of seismic qualification tests for SSCs performed during the pre-operational period, including any information available on inspection, maintenance, non-conformance reports and corrective action reports. For new installations, the specifications for seismic qualification tests (e.g. necessary response spectra) might be sufficient.

For existing installations, quality assurance and quality control documentation, with particular emphasis on the as-built conditions for materials, geometry and configuration (for assessing the modifications during construction, fabrication, assembly and commissioning), including non-conformance reports and corrective action reports. The accuracy of the data should be assessed.

Standards adopted and procedures applied to specify the nominal properties of the materials used and their mechanical characteristics;

Standards adopted and procedures applied to define load combinations and to calculate the seismic design parameters;

Standards used for the design of structures, components, piping systems and other items, as appropriate;

Standards and procedures that would have been considered minimum requirements for the design of conventional buildings at the time of the design of the installation.

System design:

Geotechnical design:

Structural design:

Component design:

Distribution system design (e.g. piping, cable trays, cable conduits, ventilation ducts):

Service and handling equipment:²⁷

System description documents;

Safety, quality and seismic classification;

Design reports;

Confirmation of the functionality of systems;

System instrumentation and control, including the general concept, the types of device and how the devices are mounted.

Excavation, structural backfill and foundation control (e.g. for settlement, heaving and dewatering);

Construction of retaining walls, foundations, underground structures, berms or artificial slopes;

Soil–foundation–structure failure modes and design capacities (e.g. estimated settlements, sliding, overturning, uplifting, liquefaction).

Structural analysis reports for all structures of interest;

Structural drawings (e.g. structural steel, reinforced and/or prestressed concrete), preferably as-built documentation for existing installations;

Material properties (specified and test data);

Typical details (e.g. connections).

Seismic analysis and design procedures;

Seismic qualification procedures, including test specifications and test reports;

Typical anchorage specifications and types used;

Stress analysis reports;

Pre-operational test reports, if any.

System description documents;

Piping and instrumentation diagrams;

Layout and design drawings of piping and its supports;

Diagrams of cable trays and cable conduits and their supports;

Diagrams of ventilation ducts and their supports;

Design reports, including stress analysis reports if available.

Main and auxiliary cranes, monorails and hoists;

Fuel handling equipment.

Specification of the design basis earthquake used for the design and qualification of SSCs (see SSG-67 [8]).

Site specific free field ground motion parameters in terms of elastic ground response spectra, acceleration time histories or other descriptors, such as power spectral density.

Seismological parameters representative of the earthquakes that make the largest contribution to the seismic hazard, such as magnitude, distance and duration of strong motion.

If some structures were designed in accordance with design codes whose design spectra have implicit reductions for inelastic behaviour, the corresponding elastic ground response spectra should be derived to provide a basis for comparison with the elastic ground response spectra typically used to define the reference level earthquake for the seismic safety evaluation.

Soil–structure interaction parameters:

Modelling techniques:

Structural analysis and response parameters:

The location selected for applying the seismic input ground motion, for example free field surface on top of finished grade, foundation mat level or base rock level (often referred to as the ‘control point location’);

Soil profile properties applicable to each building or structure on the ground, including soil stiffness and damping properties used in the site specific response analysis, information on the water table variation and consideration of strain dependent properties;

The method(s) used to account for uncertainties in soil properties and techniques of soil–structure interaction analysis, for example envelope of three analyses for best estimate, lower bound and upper bound soil profiles;

Applicability and consideration of seismic wave phenomena in the definition of the input motion, including the definition of seismic input motion typically as a vertically propagating shear wave, coherency and wave passage effect.

Modelling techniques and analytical methods used to calculate the seismic response of structures and the in-structure response spectra (e.g. floor response spectra);

Material and system damping, cut-off of modal damping and frequency dependence of damping;

Allowance for inelastic behaviour, as assumed in the design phase and as implemented during construction.

One or two stage analysis, using coupled or substructure models of soil and structures.

Characterization of the soil foundation system (e.g. by impedance or transfer functions).

Equivalent static analyses of components and structures.

Dynamic analysis of components and structures.

Natural frequencies and modal shapes, if available.

Output of structural response (e.g. structure internal forces and moments, in-structure accelerations, deformations, displacements).

Foundation response, including overall behaviour such as sliding or uplift.

Calculations of in-structure response spectra (e.g. floor response spectra), including the following:

Damping of equipment;

Enveloping and broadening criteria, if used.

Slopes, excavation and backfill;

SSCs not accessible for inspection;

Field routed items (e.g. piping, buried piping, cable trays, conduits, tubing);

Installation of non-safety-related items (e.g. masonry walls, shielding blocks, room heaters, potable water lines, fire extinguishing lines, false ceilings);

Separation distances or clearances between components;

Field tested items;

Anchorages.

Appropriate ranges of the static properties and dynamic properties that account for the site specific geotechnical characteristics and their variability should be available for use in the seismic safety evaluation.

For ground materials, the density and low strain properties (normally, in situ measurements of compressional and shear wave velocities), laboratory measurements of three axis static properties and, if possible, the dynamic properties and the material damping ratio should be available.

The variation of dynamic shear modulus values and damping values with increasing strain levels and as a function of depth should be available. Strain dependent variations in ground material properties may be based on generic data if ground materials are properly correlated with the generic classifications.

For hard rock layers, variation of properties with increasing strain levels may usually be disregarded.

Damping, which depends on the extent of shaking induced cracking in concrete structures and slip or other connection deformations in metallic structures;

Geotechnical material properties and physical integrity, which exhibit degradation as the shaking level increases;

The potential for the occurrence of geotechnical failures whose characterization is necessary to evaluate the geological stability of the site (see para. 2.19(a)), which typically depends on the shaking level.

A scaled spectrum of the original design basis earthquake;

A scaled spectrum or broadened spectrum of an earthquake that affected the installation;

A generic spectrum or suite of spectra (e.g. used in certification of a standard design);

A scaled site specific spectrum for a specified earthquake scenario;

A site specific spectrum for a specified uniform hazard of exceedance;

A generic or site specific spectrum determined by the regulatory body.

The selected reference level earthquake spectrum shape should result in low sensitivity of the computed seismic risk to the selection of the ground motion hazard parameter for SPSA (e.g. peak ground acceleration or spectral acceleration at selected frequencies).

Since the relative contributions of ground motion levels to the seismic risk can only be estimated before SPSA is performed, the appropriateness of the reference level earthquake based on this estimation should be confirmed (e.g. using sensitivity studies) after completion of SPSA and addressed if it is found to be inappropriate.

Credibility: The occurrence of the screened hazard at the site with a severity that will challenge the installation’s safety is practically impossible, or its annual probability of occurrence is too low compared with the reference level earthquake for vibratory ground motions (e.g. the fault displacement hazard is screened out owing to an absence of capable faults in the vicinity of the nuclear installation; liquefaction is screened out because soil deposits are so dense and the groundwater table is so low that liquefaction would occur only at incredibly high vibratory ground motions).

Consequence: The potential occurrence of the screened hazard has no consequence for the safety of the nuclear installation owing to physical features or reliable mitigation measures (e.g. river flooding due to upstream dam failure leads to an upper bound water line elevation at the site that does not challenge the external flood design basis of the installation).

Ground motion parameters developed using deterministic seismic hazard analysis in accordance with paras 5.3 and 5.4. The reference parameters should be scaled by an appropriate margin based on the reference level earthquake spectrum.

Ground motion parameters developed using probabilistic seismic hazard analysis in accordance with para. 5.2 and prediction equations specific to these parameters²⁹. The reference parameters should correspond to annual probabilities of exceedance similar to those of the reference level earthquake spectrum at an appropriately high confidence level to account for uncertainties in the geotechnical evaluation.

Ground motion parameters developed using geotechnical evaluations of the site response to the reference level earthquake for vibratory motion (e.g. slope deformation evaluation using the reference level spectrum as input motion). The reference parameters (e.g. slope displacement) should correspond to an appropriately high confidence level to account for uncertainties in the geotechnical evaluation.

The initial conditions of the nuclear installation to be considered at the time of the earthquake. Establishing these initial conditions includes, for example, (i) defining which modes of operation are to be considered for the installation; (ii) defining what constitutes normal operating conditions for the installation systems and their components; and (iii) determining whether a seismically induced abnormal condition (e.g. loss of off-site power, small loss of coolant accident) might be triggered and should be considered to occur concurrently with or following earthquake induced shaking.

Definition of the safety related functions and corresponding systems that are credited in achieving an acceptable end state. The SMA methodology focuses on defining a subset of functions and systems necessary to achieve a determined number of success paths (typically two) to an acceptable end state. The PSA based SMA and SPSA methodologies have a broader focus that includes functions and systems whose failure might lead to the progression of an accident to an unacceptable end state.

Identification of operator actions that are credited in the seismic safety evaluation. These actions should be established in the emergency procedures.

Availability and account taken of any non-safety-related emergency response and mitigation systems. These systems include mobile alternative resources (e.g. water, compressed air and electrical power supplies) stored on the site that are located and maintained in such a way as to be functional and readily accessible when needed in postulated emergency conditions.

Availability and account taken of outside assistance. The type of assistance, response time and conditions for availability of outside assistance should be established in the safety procedures and agreed upon with the regulatory body.

SSCs necessary for the safety related systems described in para. 5.17(b) to fulfil their safety functions. These SSCs are not limited to front line and support safety systems, but include instrumentation and control equipment, cable trays, passive elements and other distribution systems.

SSCs whose seismically induced response or damage might physically affect one or more other SSCs (e.g. through falling, impact, fire, flood or spray) and interfere with the ability of those other SSCs to fulfil their safety functions.

SSCs whose seismically induced damage might impede the operator actions described in para. 5.17(c) (e.g. by physically injuring operating personnel, blocking their entry or exit, or preventing their use of tools needed to take actions).

SSCs necessary for post-earthquake emergency procedures credited in achieving an acceptable end state, for example the mitigation systems described in para. 5.17(d).

SSCs whose seismically induced damage might impede the arrival or deployment of the outside assistance described in para. 5.17(e).

Structures that house or support the identified SSCs.

SSCs that represent unique features of the installation from a seismic safety perspective (e.g. an SSC related to the credible and consequential concomitant phenomena described in para. 5.14).

SSCs needed during identified design extension conditions, if not already included above.

To confirm the completeness and consistency of the list of selected SSCs compared with the as-built systems configuration;

To familiarize the seismic capability engineers with the as-built configuration, conditions and apparent seismic robustness or vulnerability of the SSCs;

To investigate the surrounding areas to identify potential sources of seismically induced interactions with the selected SSCs;

To ensure that the credited operator travel paths are compatible with plant operating procedures;

To verify potential assumptions used to justify including elements in — or screening them out of — the scope of the seismic safety evaluation on the basis of their credibility and the consequence(s) of their failure (see para. 5.11).

To collect information that can be used in refining the list of selected SSCs;

To observe and record the current as-built condition of selected SSCs included in the list;

To verify the screening of SSCs on the basis of very low or very high seismic capacities;

To identify conditions in these SSCs, or in their anchorage or configuration (e.g. known or suspected seismically vulnerable details), for consideration in their seismic capacity evaluation;

To identify the realistic failure modes of each SSC that might prevent the achievement of an acceptable end state;

To collect key data, such as dimensions, that might be needed in seismic capacity evaluations;

To identify SSCs whose failure might result in previously unidentified seismic spatial interactions (see para. 5.20(b), (c) and (e)) and to collect the necessary information to identify their relevant failure modes, the failure consequences and the affected SSCs;

To identify and report ‘seismic housekeeping’ matters that can be easily addressed by the nuclear installation operating organization to reduce obvious vulnerabilities, such as temporary or ‘left in place’ equipment that might result in seismic interactions (e.g. scaffolding, ladders, carts), missing fasteners, unsecured light fixtures and unrestrained stored items.

To familiarize the walkdown team with the nuclear installation through the review of systems diagrams, layout and other drawings, previous seismic evaluations, and documentation from prior walkdowns;

To create a database of selected SSCs containing the data available prior to the walkdown, which will later be populated with the data collected during the walkdown;

To review the list of selected SSCs for completeness;

To classify the selected SSCs on the list by type and location;

To identify SSCs and areas with special access needs and/or safety and protection measures;

To identify selected SSCs and areas for the preliminary walkthrough (see para. 5.28);

To identify any access and training needs of the walkdown team.

The list of selected SSCs, their locations on layout drawings, their classification by SSC type and general location, and a description of the typical observation activities to be conducted;

The list of similar SSCs, identifying the lead items for detailed walkdowns and other items for confirmatory walkbys³⁵ (see para. 5.31);

The estimated time needed for walkdowns and walkbys of the various SSC classes;

The list of SSCs that need special access and the support requested from the installation personnel (e.g. de-energizing of active equipment to examine internals, opening of equipment enclosures to observe anchorage, authorization for access to areas with high radiation levels or contamination, escorted access to high security areas);

The areas in the installation where walkdowns of distribution systems and operator travel paths will be performed;

The key members of the walkdown team, their access needs and training credentials;

The necessary safety and protection measures for the walkdown team members.

Criteria for capacity screening and ranking³⁶;

Class specific actions for typical SSC classes (e.g. verification that batteries are vertically restrained);

Actions for specific SSCs, typically informed by the preparatory activities and preliminary walkthrough (e.g. measurement of the as-built distances across specific building interfaces);

Actions for walkby review of similar components;

Criteria for assessing spatial interaction concerns (principally falling hazards³⁷ and impact hazards³⁸) and identification of known or suspected concerns to be examined;

Criteria for assessing seismically induced fire and flood interaction concerns and identification of known or suspected concerns to be examined;

Procedures for area based and sampling based walkdowns (e.g. of distribution systems);

Procedure for walkdown of operator travel paths;

Procedure for in-process refinement of the list of selected SSCs in order to add or remove SSCs from the final list;

Procedure for information collection on applicable geotechnical failure modes (e.g. measurements to allow evaluation of the liquefaction settlement capacity of a piping run);

Instructions on documentation.

A summary of the walkdown planning (see para. 5.29(a)–(d)) and execution activities;

The final list of selected SSCs (including justification for SSCs removed or added on the basis of the walkdown);

A summary of the main walkdown findings and recommendations relevant to the seismic capacity evaluation for the selected SSCs;

Seismic evaluation data collected for all SSCs. These data are typically entered in template forms for each SSC class and should be used to populate the SSC database (see para. 5.27(b)).

Selection of the evaluation team (see para. 5.15);

Selection of the reference level earthquake (see para. 5.5);

Plant familiarization and data collection (see Section 4);

Selection of success path(s) (see paras 5.17(b) and 5.39) and identification of the list of selected SSCs (see para. 5.18);

Seismic evaluation walkdown (see para. 5.19);

Determination of the seismic responses of SSCs to use as input for seismic capacity calculations;

Determination of HCLPF capacities for the selected SSCs and the installation;

Specific considerations for nuclear reactors (see paras 5.48 and 5.49);

Peer review (see Section 8);

Preparation of documentation (see Section 8).

Multiple alternate success paths may be selected to ensure diversity and redundancy in the front line and support systems. In some Member States, the selection of at least two success paths for some installations is required by the regulatory body.

The systems engineers should formulate the candidate success path(s) to reach an acceptable end state (see para. 5.16)³⁹, with input from operating personnel. Different paths should include different operational sequences and SSCs to the extent possible.

If multiple success paths are selected, one should be designated as the primary success path. The primary success path should be the path for which it is judged easiest to demonstrate a high seismic safety margin and should be consistent with the plant design manuals, operational procedures and emergency response procedures.

The seismic capability engineers should support the determination and prioritization of success paths by qualitative assessment of the ruggedness and seismic vulnerability of the selected SSCs based on knowledge gained from the systems walkdown and previous seismic safety evaluations.

Non-seismic (e.g. random or maintenance related) failures of SSCs and system outages should be reviewed. The use of success paths that rely on SSCs with high random failure rates should be avoided to the extent possible.

Actions to be taken by operating personnel should be reviewed and assessed in the light of the common cause nature of the earthquake. The use of success paths that rely on operator actions that cannot be executed with high confidence (e.g. owing to the timing or duration of the action, operational and emergency procedures at the installation, or the potential for increased stress levels for personnel or interference with their other responsibilities) should be avoided.

Current mathematical models of the structure should be used for the new seismic response analysis for the reference level earthquake ground motions. The scaling of previous seismic response analysis results (e.g. design basis analyses) on the basis of the ratios of reference level to design basis earthquake ground motions may be justifiable. Scaling is considered appropriate for rock sites where the design basis models of the structures are considered linear and median centred, and where the spectral shapes of the design basis and reference level earthquakes are sufficiently similar.

For vibratory ground motion input, response spectrum analysis methods may be sufficient for structures without significant soil–structure interaction effects. For structures with significant soil–structure interaction effects, response history methods (sometimes referred to as ‘time history methods’) should be used. Equivalent linear or explicitly non-linear methods may be used as appropriate for the expected responses.

For non-vibratory ground motion input (e.g. response to liquefaction settlement or slope deformation), quasi-static analysis methods should typically be sufficient.

The seismic responses may be determined by a new analysis of the response to seismic input motions at the system or component supports resulting from the reference level earthquake ground motions, by the scaling of previous response analysis results on the basis of the ratios of the seismic input motions to the system or component, or by physical testing.

For vibratory ground motion input, the system or component response may be analysed as coupled or uncoupled with the supporting structure model. Coupled response analysis should be used if significant dynamic interaction effects are expected. (c) For non-vibratory ground motion input, quasi-static analysis methods should typically be sufficient.

The selection of success path(s) (step 4) should be replaced by the accident sequence event tree and fault tree analysis;

The identification of the list of selected SSCs (step 4) should be based on the accident sequence analysis;

The HCLPF capacities for the installation (step 7) should be determined differently (see para. 5.54);

Human errors and non-seismic random failures should be included.

Development of conservatively biased seismic fragility estimates for the SSCs. This can be achieved by assigning a generic or estimated value of the variability to be combined with the HCLPF capacity to estimate a fragility function.⁴⁵

Development of detailed seismic fragilities (in a similar way to the SPSA method; see para. 5.62) for SSCs that are identified to govern the installation level HCLPF capacity.

The ‘min-max’ approach: Each HCLPF capacity in the cutset is taken as equal to that of the highest HCLPF capacity in the cutset. The installation level HCLPF capacity is taken as equal to the lowest HCLPF capacity in the cutset.⁴⁶

The explicit quantification approach: An estimated fragility curve for each cutset is derived from the seismic fragilities (and non-seismic failure probabilities) of the cutset components using a Boolean AND gate. An estimated fragility curve for the installation is derived from the cutset fragilities using a Boolean OR gate. The installation level HCLPF capacity is computed by identifying the 1% mean probability of failure point on the latter fragility curve.

The common cause nature of seismic events imposes concurrent demands on the SSCs in the installation and on surrounding infrastructure and might lead to simultaneous failures whose correlation should be considered in the logic model.

The seismic ground motions represented by the seismic hazard curve range from moderate to very large earthquakes. The resulting probabilistic distributions of seismic demands at the plant level lead to distribution of the core and/or fuel damage frequency, of the large or early release frequency, or of other risk metrics of interest, as a function of the hazard parameter.

Earthquakes might cause initiating events that are not applicable to the internal events PSA.

Earthquakes might cause failures of passive SSCs, such as structures and distribution systems, that are not included in the internal events PSA.

Earthquakes might result in seismic interaction failures (e.g. seismically induced fire).

SPSA accident sequence logic should include both potential seismic and potential non-seismic (e.g. random) SSC failures within the time taken to reach an acceptable end state.

Generic fragility curves may be used for SSCs with a negligible contribution to seismic risk. These may include nominally low and nominally high generic fragilities for SSCs screened out in accordance with para. 5.22, and database based (i.e. not component or installation specific) fragilities for other SSCs that meet certain inclusion rules.⁴⁸

HCLPF capacity based fragilities may be developed as described in para. 5.53(a). These fragilities should be sufficiently component and installation specific to be used for significant risk contributors. The use of these fragilities is not recommended for dominant risk contributors.

Detailed fragilities — incorporating expected seismic responses and capacities of SSCs and explicit treatment of variability owing to uncertainty and randomness — may be developed and used for risk significant SSCs. The use of these fragilities is recommended for dominant risk contributors.

The frequencies of unacceptable end states (e.g. core damage, large early release);

A description of the major seismically induced initiating events and of the safety functions and/or mitigation functions included in the system logic model;

Lists of seismic fragilities and non-seismic failure rates developed for all SSCs and of human error probabilities developed for operator actions;

Identification of risk significant accident sequences, seismically induced failures and associated SSCs, non-seismic failures and operator actions, to facilitate understanding of the likely accident scenarios and consideration of potential improvements or other actions (see Section 7);

Identification of the installation level fragility curve, the range of earthquake intensity that contributes most significantly to seismic risk, and any potential cliff edge effects;

If applicable, identification of safety related SSCs whose contribution to seismic risk is negligible for potential consideration in risk informed design decisions (see paras 7.2–7.4);

Assessment of the sensitivity of the results to major modelling assumptions;

Uncertainty ranges of annual frequencies and identification of their major contributors.

For low hazard installations, the seismic capacity evaluation methods for the selected SSCs may be based on simple but conservative static or equivalent static procedures, similar to those used for industrial hazardous facilities, in accordance with national practice and standards. Similarly, the seismic hazard to be used in these evaluations may be taken from national building codes and seismic hazard maps and does not need to be taken from a site specific probabilistic seismic hazard analysis. If a probabilistic seismic hazard analysis exists, however, the seismic hazard from that study may be used.

For selected SSCs of installations in the moderate hazard category, the seismic safety evaluation should typically be performed using the methodologies described in Section 5, but the corresponding performance target is set lower than for installations in the high hazard category (see Annex). Either the SMA, the SPSA or the PSA based SMA approach may be used, depending on the objective and scope of the seismic safety evaluation.

For selected SSCs of installations in the high hazard category, methodologies for seismic safety evaluation as described in Section 5 should be used (i.e. no application of a graded approach).

Showing compliance with a design code that was developed using a reliability based approach⁵². The design basis earthquake should be selected on the basis of an annual frequency of exceedance that is consistent with the performance target for the particular SSC.

Showing adequate seismic margin beyond a site specific reference level earthquake. The reference level earthquake should be selected on the basis of an annual frequency of exceedance that is consistent with the performance target for the particular SSC.

Explicitly computing the annual frequency of failure using SPSA. In this case, it is very important to use the ground motion from a site specific probabilistic seismic hazard analysis and to ensure that the SSCs important to safety have been properly categorized and the appropriate limit states have been defined.

Reducing the inventory of radioactive material at risk to moderate or low levels so that less demanding performance targets can be met;

Strengthening the SSCs that limit a nuclear installation in meeting the minimum seismic margin or are significant risk contributors;

Hardening the primary containment so that the inventory of radioactive material at risk — for which the unmitigated radioactive release amount was calculated — is reduced.

Upgrade of anchorage, both for equipment and for supports in distribution systems;

Provision of additional lateral restraint for distribution systems;

Upgrade of electromechanical relays to models with larger seismic capacity;

Upgrade of critical components to models with larger seismic capacity.

The peer review of systems and operations should be performed first, coinciding with the selection of the success paths for SMA or the tailoring of the internal event system models for SPSA or PSA based SMA.

Seismic capability peer reviews should be performed (i) during and after the walkdown and (ii) after most of the HCLPF values (for SMA or PSA based SMA) or fragility functions (for SPSA) for the SSCs have been calculated. The seismic capability peer review should include a limited plant walkdown, which may coincide with part of the plant walkdown or may be performed separately.

Methodology and assumptions of the assessment;

Selection of the reference level earthquake(s);

Composition and credentials of the evaluation team;

Verification of the geological stability of the site (see para. 2.19(a));

Success path(s) selected, justification or reasoning for the selection, HCLPF and governing components of the success path(s) (for SMA);

Summary of system models and the modifications introduced to the internal event models for SPSA and PSA based SMA;

Table of selected SSC items showing the results of the screening process (if any), failure modes, seismic demand, HCLPF values (for SMA and PSA based SMA) and fragility functions (for SPSA);

For SPSA, results of the quantification of the sequence analysis, including core damage frequency, dominant core damage sequences, large early release frequency or containment failure frequency, and dominant sequences for failures of the confinement function;

Summary of seismic failure functions for prevention and mitigation, including the front line systems and support systems modelled in SPSA, and identification of critical components, if any, for SPSA;

Walkdown report summarizing any findings and observations;

Operator actions needed and the evaluation of their likely success;

Containment structure and system HCLPFs or fragility functions (if needed);

Treatment of non-seismic failures, relay chatter, dependences and seismically induced fire and flood;

Peer review reports.

Detailed system descriptions used in developing the success path(s), system notebooks and other data (for SMA);

Detailed documentation of the development of the SPSA and PSA based SMA models, in particular those aspects pertaining to the modifications of the internal event PSA models to account for seismic events;

Detailed documentation of all walkdowns performed — including SSC identification and characteristics, results of screening process (if appropriate), spatial interaction observations for the seismic system — and of area walkdowns usually performed for systems such as cable trays and small bore piping and for the evaluation of seismically induced fire or flood issues;

HCLPF (for SMA and PSA based SMA) or fragility function (for SPSA) calculation packages for all selected SSCs; (e) New or modified plant operating procedures for the achievement of success paths; (f) List of records and their retention times.

Local failures of structural components that undermine the support of SSCs important to safety;

Major failures of structural components that lead to unacceptable deformations, misalignments and other causes of damage or loss of function for supported SSCs;

Major failures of structural components that lead to severe damage or collapse;

Global structure instability (e.g. sliding, overturning, foundation bearing failure);

Failures of structures that are part of containment or confinement systems, which might lead to a radioactive release.

Major failure of one structure due to impact from a significantly heavier structure;

Local failures in the structure exteriors due to impact (e.g. punching of walls);

Failures of chatter sensitive electrical components due to impact between structures;

Failures of other shock sensitive SSCs or SSC supports in the vicinity of impact;

Failures of distribution systems or their supports due to relative movements between adjacent structures.

Potential signs of degradation or distress, such as corrosion, exposure of reinforcement and concrete spalling;

Records of structure connections that appear to be field modified from standard connections;

Measurements of interface separations between buildings and description of gap filler materials, if present;

Survey of equipment that enables the estimation of temporary loading during maintenance or refuelling conditions;⁵⁴

Survey of as-built versus as-designed bulk storage spaces (mass capacity), roof equipment and roofing materials.

Differential motion between supports or attachment points;

Flexible supports and other details that might allow large seismic displacements;

Weak or brittle connections, supports or anchorage;

Long flexible runs connected to stiff branch lines or supports;

Excessively loaded supports (e.g. multiple or overfilled cable trays or long spans);

Degradation and corrosion.

Settlement of structure foundations due to liquefaction, groundwater drawdown or dry sand compaction, which might result in the failure of buried distribution systems at their interface with the structure;

Relative vertical displacements between adjacent structures due to differential settlement, which might result in the failure of interconnecting distribution systems;

Differential settlements under the foundations of a structure, which might result in the permanent distortion of, or internal damage to, structural components and/or failures of attached lines;

Slope displacements and potential instabilities, which might result in the failure of buried and above ground lines and of SSCs below the slope;

Fault rupture, subsidence and lateral spreading displacements, which might result in the failure of buried and above ground lines and of SSCs spanning the ground displacement zone.

The seismic capacity of an upstream dam whose breach might result in flooding of the nuclear installation site should be explicitly evaluated. This seismic capacity should be mapped to the consequences for the installation in accordance with SSG-18 [13], considering the vulnerability of individual SSCs to the flood level and the lower reliability of emergency response procedures in the combined aftermath of earthquake and flood.

The assessment of the consequences of a tsunami hazard for the safety functions of a nuclear installation located near the coastline should include an evaluation of the potential malfunctioning of equipment located at a low level (e.g. seawater pumps), in accordance with SSG-18 [13] and IAEA Safety Standards Series No. SSG-68, Design of Nuclear Installations Against External Events Excluding Earthquakes [26].

The seismic stability of geographic features close to the nuclear installation site (e.g. slopes that might trigger a landslide, a rockfall event that might affect the installation site) should be explicitly evaluated. The consequences of these geographic features for the installation’s safety related functions should be assessed, considering the discharge along the failure path and the distance to the installation. (d) The potential for seismic failures in adjacent nuclear and industrial installations that might affect the nuclear installation in question should be identified during the walkdown and reported for further assessment.

INTERNATIONAL ATOMIC ENERGY AGENCY, Safety Assessment for Facilities and Activities, IAEA Safety Standards Series No. GSR Part 4 (Rev. 1), IAEA, Vienna (2016).

INTERNATIONAL ATOMIC ENERGY AGENCY, Site Evaluation for Nuclear Installations, IAEA Safety Standards Series No. SSR-1, IAEA, Vienna (2019).

INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Nuclear Power Plants: Design, IAEA Safety Standards Series No. SSR-2/1 (Rev. 1), IAEA, Vienna (2016).

INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Nuclear Power Plants: Commissioning and Operation, IAEA Safety Standards Series No. SSR-2/2 (Rev. 1), IAEA, Vienna (2016).

INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Research Reactors, IAEA Safety Standards Series No. SSR-3, IAEA, Vienna (2016).

INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Nuclear Fuel Cycle Facilities, IAEA Safety Standards Series No. SSR-4, IAEA, Vienna (2017).

INTERNATIONAL ATOMIC ENERGY AGENCY, Seismic Hazards in Site Evaluation for Nuclear Installations, IAEA Safety Standards Series No. SSG-9 (Rev. 1), IAEA, Vienna (2022).

INTERNATIONAL ATOMIC ENERGY AGENCY, Seismic Design for Nuclear Installations, IAEA Safety Standards Series No. SSG-67, IAEA, Vienna (2021).

INTERNATIONAL ATOMIC ENERGY AGENCY, Geotechnical Aspects of Site Evaluation and Foundations for Nuclear Power Plants, IAEA Safety Standards Series No. NS-G-3.6, IAEA, Vienna (2004).

INTERNATIONAL ATOMIC ENERGY AGENCY, Methodologies for Seismic Safety Evaluation of Existing Nuclear Installations, Safety Reports Series No. 103, IAEA, Vienna (2020).

INTERNATIONAL ATOMIC ENERGY AGENCY, IAEA Nuclear Safety and Security Glossary: Terminology Used in Nuclear Safety, Nuclear Security, Radiation Protection and Emergency Preparedness and Response, 2022 (Interim) Edition, IAEA, Vienna (2022).

INTERNATIONAL ATOMIC ENERGY AGENCY, Format and Content of the Safety Analysis Report for Nuclear Power Plants, IAEA Safety Standards Series No. SSG-61, IAEA, Vienna (2021).

INTERNATIONAL ATOMIC ENERGY AGENCY, WORLD METEOROLOGICAL ORGANIZATION, Meteorological and Hydrological Hazards in Site Evaluation for Nuclear Installations, IAEA Safety Standards Series No. SSG-18, IAEA, Vienna (2011).

INTERNATIONAL ATOMIC ENERGY AGENCY, Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power Plants, IAEA Safety Standards Series No. SSG-3 (Rev. 1), IAEA, Vienna (in press).

INTERNATIONAL ATOMIC ENERGY AGENCY, Radiation Protection Aspects of Design for Nuclear Power Plants, IAEA Safety Standards Series No. SSG-90, IAEA, Vienna (in preparation).

INTERNATIONAL ATOMIC ENERGY AGENCY, Technical Approach to Probabilistic Safety Assessment for Multiple Reactor Units, Safety Reports Series No. 96, IAEA, Vienna (2019).

INTERNATIONAL ATOMIC ENERGY AGENCY, Multi-unit Probabilistic Safety Assessment, Safety Reports Series No. 110, IAEA, Vienna (2023).

INTERNATIONAL ATOMIC ENERGY AGENCY, Earthquake Preparedness and Response for Nuclear Power Plants, Safety Reports Series No. 66, IAEA, Vienna (2011).

INTERNATIONAL ATOMIC ENERGY AGENCY, Periodic Safety Review for Nuclear Power Plants, IAEA Safety Standards Series No. SSG-25, IAEA, Vienna (2013).

INTERNATIONAL ATOMIC ENERGY AGENCY, Ageing Management and Development of a Programme for Long Term Operation of Nuclear Power Plants, IAEA Safety Standards Series No. SSG-48, IAEA, Vienna (2018).

INTERNATIONAL ATOMIC ENERGY AGENCY, Development and Application of Level 2 Probabilistic Safety Assessment for Nuclear Power Plants, IAEA Safety Standards Series No. SSG-4, IAEA, Vienna (2010).

INTERNATIONAL ATOMIC ENERGY AGENCY, Human Reliability Analysis for Nuclear Installations, IAEA, Vienna (in preparation).

INTERNATIONAL ATOMIC ENERGY AGENCY, Leadership and Management for Safety, IAEA Safety Standards Series No. GSR Part 2, IAEA, Vienna (2016).

INTERNATIONAL ATOMIC ENERGY AGENCY, Application of the Management System for Facilities and Activities, IAEA Safety Standards Series No. GS-G-3.1, IAEA, Vienna (2006).

INTERNATIONAL ATOMIC ENERGY AGENCY, The Management System for Nuclear Installations, IAEA Safety Standards Series No. GS-G-3.5, IAEA, Vienna (2009).

INTERNATIONAL ATOMIC ENERGY AGENCY, Design of Nuclear Installations Against External Events Excluding Earthquakes, IAEA Safety Standards Series No. SSG-68, IAEA, Vienna (2021).