Evaluation of Seismic Safety for Nuclear Installations

PAGE

SSG-89Evaluation of Seismic Safety for Nuclear Installations

1. Introduction Background

1.1.This Safety Guide provides recommendations on the evaluation of the safety of nuclear installations against the effects generated by earthquakes, in order to meet the applicable safety requirements established in the following publications:

IAEA Safety Standards Series No. GSR Part 4 (Rev. 1), Safety Assessment for Facilities and Activities [1];
IAEA Safety Standards Series No. SSR-1, Site Evaluation for Nuclear Installations [2];
IAEA Safety Standards Series No. SSR-2/1 (Rev. 1), Safety of Nuclear Power Plants: Design [3];
IAEA Safety Standards Series No. SSR-2/2 (Rev. 1), Safety of Nuclear Power Plants: Commissioning and Operation [4];
IAEA Safety Standards Series No. SSR-3, Safety of Research Reactors [5];
IAEA Safety Standards Series No. SSR-4, Safety of Nuclear Fuel Cycle Facilities [6].

1.2.This Safety Guide addresses the requirements for both existing and new nuclear installations. For an existing installation, safety assessments are required to be reviewed periodically and the review may consider potential changes in the characterization of seismic hazards at the site [1, 2, 4–6]. At the design stage of a new nuclear installation, it is required that the design be checked to ensure that it provides for an adequate margin to protect items important to safety against levels of external hazards more severe than those selected for the design basis [3, 5, 6]. In addition, it is required to be checked that the design of nuclear power plants provides for an adequate margin to protect items ultimately necessary to prevent an early radioactive release or a large radioactive release in the event of levels of natural hazards exceeding those considered for the design [3]. Hence, the seismic safety evaluations described in this Safety Guide can be performed either as part of the design development or as a process subsequent to and separate from the design basis cases.

1.3.This Safety Guide is related to a number of other IAEA Safety Guides dealing with seismic hazard and seismic design, including IAEA Safety Standards Series Nos SSG-9 (Rev. 1), Seismic Hazards in Site Evaluation for Nuclear Installations [7]; SSG-67, Seismic Design for Nuclear Installations [8]; and NSG-3.6, Geotechnical Aspects of Site Evaluation and Foundations for Nuclear Power Plants [9]. In addition, Ref. [10] provides detailed information relevant to this Safety Guide.

1.4.Guidelines for the seismic safety evaluation of existing nuclear installations — in particular nuclear power plants — have been developed and used in many Member States since the beginning of the 1990s.¹1 More recently, the criteria and methods used for the seismic safety evaluation of existing nuclear installations have started being used, with some adaptation, to assess beyond design basis earthquake events for new nuclear installation designs prior to construction. This evaluation of new designs is different from the seismic design and qualification of the installation, which may be performed following the recommendations in SSG-67 [8]. The seismic safety evaluation of a new design is intended to explore beyond design basis events for the new design. Some Member States may have other applicable criteria for seismic safety assessment of new designs for beyond design basis earthquakes.

1.5.The main difference between seismic safety evaluation, and seismic design and qualification is in the evaluation criteria used [8]. Design, as traditionally understood,²2 uses conservatively defined loads and capacities for structures, systems and components (SSCs) in order to meet the limits given in the design code. Thus, this design approach is aimed at meeting the limits given by the codes for the design basis earthquake in every SSC in order to demonstrate safety. In contrast, in seismic safety evaluation, the aim is to establish the actual capacities of the SSCs in the as-is condition for use in the evaluation of the seismic capacity of the nuclear installation as a whole. Accordingly, the objective of seismic safety evaluations is to be realistic or slightly conservative. The experience from past seismic events, testing and analytical estimates of capacity are used in the seismic safety evaluation, and expert judgement plays a significant role. The as-is condition of the nuclear installation includes its as-built, as-operated, asmodified and as-maintained conditions, and its condition of ageing at the time of the evaluation.

1.6.The terms used in this Safety Guide are to be understood as defined in the IAEA Nuclear Safety and Security Glossary [11]. Explanations of terms specific to this Safety Guide are provided in footnotes.

1.7.This Safety Guide supersedes IAEA Safety Standards Series No. NS-G-2.13, Evaluation of Seismic Safety for Existing Nuclear Installations³3.

You may also wish to read:

IAEA-TECDOC-2043, Evaluation of Design Robustness of Nuclear Installations Against External Hazards

Objective

1.8.The objective of this Safety Guide is to provide recommendations on the seismic safety evaluation of nuclear installations in order to meet the applicable safety requirements established in GSR Part 4 (Rev. 1) [1], SSR-1 [2], SSR-2/1 (Rev. 1) [3], SSR-2/2 (Rev. 1) [4], SSR-3 [5] and SSR-4 [6]. For existing installations, such an evaluation may be prompted by a seismic hazard perceived to be greater than that originally established in the design basis, by new regulatory requirements, by new findings on the seismic vulnerability of SSCs or by the need to demonstrate performance for beyond design basis earthquake events, consistent with internationally recognized good practices. For new designs of nuclear installations, the seismic safety evaluation is motivated by the need to demonstrate that the safety margins above the design basis earthquake are sufficient to avoid cliff edge effects⁴4 and, in the case of nuclear power plants, sufficient to protect items ultimately necessary to prevent radioactive releases in the event of an earthquake with a severity exceeding that considered for design.

1.9.This Safety Guide is intended for use by regulatory bodies responsible for establishing regulatory requirements; by designers and safety analysts involved in the seismic design of new nuclear installations; and by operating organizations of existing installations directly responsible for conducting seismic safety evaluations and upgrading seismic safety programmes.

Scope

1.10.This Safety Guide addresses all types of new and existing nuclear installation as defined in the IAEA Nuclear Safety and Security Glossary [11], as follows:

Nuclear power plants;
Research reactors (including subcritical and critical assemblies) and any adjoining radioisotope production facilities;
Storage facilities for spent fuel;
Facilities for the enrichment of uranium;
Nuclear fuel fabrication facilities;
Conversion facilities;
Facilities for the reprocessing of spent fuel;
Facilities for the predisposal management of radioactive waste arising from nuclear fuel cycle facilities;
Nuclear fuel cycle related research and development facilities.

Most of the recommendations provided in this Safety Guide apply to all types of nuclear installation and all types of reactor, but aspects such as performance criteria and systems modelling are specific to each installation type. The recommendations for nuclear power plants are also applicable to other nuclear installations through the use of a graded approach.

1.11.For the purposes of this Safety Guide, existing nuclear installations are installations that are either (a) at the operational stage (including long term operation and extended temporary shutdown periods)⁵5 or (b) at a pre-operational stage at which the construction of structures, the manufacture, installation and/or assembly of components and systems, and commissioning activities are significantly advanced or fully completed. In existing nuclear installations at the operational or pre-operational stages, a change of the original design bases (e.g. a new seismic hazard at the site) or a change in the regulatory requirements regarding the consideration of seismic hazard and/or seismic design of the installation might lead to important technical modifications.

1.12.For the purposes of this Safety Guide, new nuclear installations are installations whose design has reached a level of development at which a detailed definition of SSCs is available, including the data listed in paras 4.2–4.5. In this Safety Guide, it is considered that new nuclear installations are not yet constructed or construction is at a very early stage.⁶6

1.13.Three assessment methodologies are addressed in detail in this Safety Guide: (a) the deterministic approach, generally represented by seismic margin assessment (SMA); (b) seismic probabilistic safety assessment (SPSA); and (c) a combination of SMA and SPSA known as ‘probabilistic safety assessment (PSA) based SMA’. Variations of these approaches or alternative approaches may also be demonstrated to be acceptable (see Section 3).

Structure

1.14.Section 2 identifies the safety requirements addressed by this Safety Guide, and describes general concepts and provides general recommendations relating to the seismic safety evaluation of nuclear installations. Section 3 provides recommendations on the selection of the methodology for performing the seismic safety evaluation. Section 4 provides recommendations on the requirements for data collection and investigations for new and existing installations. Section 5 forms the core of this Safety Guide; it focuses on nuclear power plants, providing recommendations on the assessment of seismic hazards, the seismic capability necessary for level 4 of the defence in depth concept, and the implementation of the SMA, SPSA and PSAbased SMA methodologies for seismic safety evaluation. Section 6 provides recommendations on applying a graded approach to the seismic safety evaluation of nuclear installations other than nuclear power plants (with reference to Section 5, where appropriate). Section 7 provides recommendations on the use of seismic safety evaluation results, including for potential seismic upgrading. Section 8 provides recommendations on the management system to be established for the performance of all seismic safety evaluation activities and identifies the need for configuration management in future activities to maintain the seismic capacity as evaluated. Sections 1–4 and 6–8 apply (in full or in part) to all nuclear installations. Section 5 is focused on nuclear power plants but can be applied to other nuclear installations through the use of a graded approach, as described in Section 6.

1.15.The Appendix to this Safety Guide presents seismic failure mode considerations for different types of SSC. The annex provides an example of criteria for defining seismic design classes and performance targets in a nuclear installation.

2. General Considerations for the Evaluation of Seismic Safety for Nuclear Installations Safety Requirements Applicable to Seismic Safety Evaluation Safety assessment

2.1.Various safety requirements established in GSR Part 4 (Rev. 1) [1] apply to seismic design robustness and periodic review of seismic safety.

Requirement 10 of GSR Part 4 (Rev. 1) [1] states that “It shall be determined in the safety assessment whether a facility or activity uses, to the extent practicable, structures, systems and components of robust and proven design.”
Requirement 13 of GSR Part 4 (Rev. 1) [1] states that “It shall be determined in the assessment of defence in depth whether adequate provisions have been made at each of the levels of defence in depth.”
Paragraph 4.48A of GSR Part 4 (Rev. 1) [1] states that (footnote omitted) “Where practicable, the safety assessment shall confirm that there are adequate margins to avoid cliff edge effects that would have unacceptable consequences.”
Requirement 15 of GSR Part 4 (Rev. 1) [1] states that “Both deterministic and probabilistic approaches shall be included in the safety analysis.”
Requirement 24 of GSR Part 4 (Rev. 1) [1] states that “The safety assessment shall be periodically reviewed and updated.”

2.2.Similar provisions are required to be applied to research reactors and to nuclear fuel cycle facilities, as established in Requirement 5 of SSR-3 [5] and Requirement 5 of SSR-4 [6], respectively.

Hazard assessment

2.3.With regard to potential changes in the perceived seismic hazard, Requirement 29 of SSR-1 [2] states:

“All natural and human induced external hazards and site conditions shall be periodically reviewed by the operating organization as part of the periodic safety review and as appropriate throughout the lifetime of the nuclear installation, with due account taken of operating experience and new safety related information.”

Margin provided by the design

2.4.Various safety requirements established in SSR-2/1 (Rev. 1) [3] apply to the seismic margin to be provided by the design of nuclear power plants⁷7. Requirement 17 of SSR-2/1 (Rev. 1) [3] states:

“All foreseeable internal hazards and external hazards, including the potential for human induced events directly or indirectly to affect the safety of the nuclear power plant, shall be identified and their effects shall be evaluated. Hazards shall be considered in designing the layout of the plant and in determining the postulated initiating events and generated loadings for use in the design of relevant items important to safety for the plant.”

Paragraph 5.21 of SSR-2/1 (Rev. 1) [3] states (footnote omitted):

“The design of the plant shall provide for an adequate margin to protect items important to safety against levels of external hazards to be considered for design, derived from the hazard evaluation for the site, and to avoid cliff edge effects.”

Paragraph 5.21A of SSR-2/1 (Rev. 1) [3] states:

“The design of the plant shall also provide for an adequate margin to protect items ultimately necessary to prevent an early radioactive release or a large radioactive release in the event of levels of natural hazards exceeding those considered for design, derived from the hazard evaluation for the site.”

2.5.Similar provisions are required to be applied to research reactors and to nuclear fuel cycle facilities, as established in Requirement 19 of SSR-3 [5] and Requirement 16 of SSR-4 [6], respectively.

Effects of changes during operation

2.6.Various safety requirements established in SSR-2/2 (Rev. 1) [4] apply to assessing the consequences of changes in the perceived seismic hazard during operation of nuclear power plants. Requirement 12 of SSR-2/2 (Rev. 1) [4] states:

“Systematic safety assessments of the plant, in accordance with the regulatory requirements, shall be performed by the operating organization throughout the plant’s operating lifetime, with due account taken of operating experience and significant new safety related information from all relevant sources.”

Paragraph 4.44 of SSR-2/2 (Rev. 1) [4] states:

“Safety reviews such as periodic safety reviews or safety assessments under alternative arrangements shall be carried out throughout the lifetime of the plant, at regular intervals and as frequently as necessary (typically no less frequently than once in ten years). Safety reviews shall address, in an appropriate manner: the consequences of the cumulative effects of plant ageing and plant modification; equipment requalification; operating experience, including national and international operating experience; current national and international standards; technical developments; organizational and management issues; and site related aspects. Safety reviews shall be aimed at ensuring a high level of safety throughout the operating lifetime of the plant.”

General Concepts for Seismic Safety Evaluation of Nuclear Installations

2.7.Well designed and well maintained nuclear installations, especially nuclear power plants, have an inherent capability to resist beyond design basis earthquakes. This inherent capability or robustness — usually described in terms of the seismic margin — is a direct consequence of (a) the conservatism that is present in the seismic design and qualification procedures used according to previous⁸8 or current practices in earthquake engineering and (b) the fact that, in the design of nuclear power plants, the seismic loads may not be the governing loads for some SSCs.⁹9

2.8.The current criteria for seismic design and qualification applicable to nuclear power plants often introduce substantial seismic design margins that are not fully quantified by the traditional design process. The process by which seismic margins develop through the various stages of analysis, design and construction might lead to large variations in the margins throughout the nuclear installation. The seismic margin typically varies from one location in the installation to another, from one SSC to another and from one part of the same structure to another.¹⁰10 Consequently, when evaluating the seismic safety of a nuclear installation, there should be a detailed examination of the actual design methods and, for existing installations, of the as-is condition, in order to understand the sources of conservatism and margins.

2.9.The methodologies presented in this Safety Guide are intended for evaluating and quantifying the seismic margin over the design basis earthquake for a particular nuclear installation. Through understanding the realistic seismic response of the SSCs, in terms of their safety functions, the maximum seismic demand for which there is high confidence that the safety functions will be fulfilled can be determined. The SSC capacities of high confidence derived in this way can be used to assess the seismic safety margin of the installation as a whole.

2.10.The seismic safety evaluation of an existing nuclear installation strongly depends on the actual condition of the installation at the time that the evaluation is performed. This key condition is denoted the ‘as-is condition’, indicating that an earthquake will affect the installation in its current condition, and that the response and capacity of the installation will depend on its current physical and operating configuration. The as-is condition is typically established on the basis of the original design, taking into account design changes during construction and operation, unintended deviations from the design, and ageing. That is why maintaining up-to-date, as-built design documentation and documentation from the ageing management programme is very important. The as-is condition of the installation should provide the baseline for any seismic safety evaluation.

2.11.Seismic safety evaluations performed on the basis of the as-is condition of the nuclear installation should be pragmatic rather than using extensive complex analyses. Non-linear analyses of relatively simple structural models or the use of higher damping values and ductility factors — provided that they are technically justified and are consistent with allowable deformations considering the as-is condition of the installation — may, however, be particularly helpful in understanding post-elastic behaviour. Numerous field observations and research and development programmes have demonstrated high seismic capacity results when the ductile behaviour of SSCs is able to accommodate large strains.

2.12.When a reliable seismic hazard analysis is available for a particular site (see SSG-9 (Rev. 1) [7]), a realistic definition of the earthquake motion (in terms of amplitude, duration, directivity and frequency) for the selected annual frequency of exceedance should be used for the seismic safety evaluation. When there are several seismic sources that lead to very different motion characteristics (e.g. far field, near field), the feasibility of using several motion characterizations and assessing seismic safety (including safety margins) against each of them should be considered.

Reasons to Perform Seismic Safety Evaluation New nuclear installations

2.13.In accordance with the requirements established in GSR Part 4 (Rev. 1) [1], SSR-2/1 (Rev. 1) [3], SSR-3 [5] and SSR-4 [6] (see paras 2.1–2.5 of this Safety Guide), an evaluation of the seismic safety of new nuclear installations is required to be performed as part of the safety assessment, when the design is completed, to verify that the safety margins above the design basis earthquake are sufficient. In addition, in the case of a nuclear power plant, the seismic safety evaluation is required to verify that the margins are sufficient to protect items ultimately necessary to prevent a radioactive release in the event of an earthquake with a severity exceeding that considered for design (see SSR-2/1 (Rev. 1) [3]). This safety evaluation should be reflected in the safety analysis report for the installation (see Safety Standards Series No. SSG-61, Format and Content of the Safety Analysis Report for Nuclear Power Plants [12]). Recommendations on the level of seismic margin to be achieved in a new nuclear installation are provided in SSG-67 [8].

2.14.The design of a new nuclear power plant is required to provide for (a) an adequate seismic margin to protect items important to safety against seismic hazard levels exceeding those considered for design and to avoid cliff edge effects (see para. 5.21 of SSR-2/1 (Rev. 1) [3]) and (b) an adequate seismic margin to protect items ultimately necessary to prevent an early radioactive release or a large radioactive release in the event of levels of natural hazards exceeding those considered for design (see para. 5.21A of SSR-2/1 (Rev. 1) [3]). The seismic margin needed to meet (b) normally applies to a reduced set of SSCs and generally results in larger plant state margins than the seismic margin needed to meet (a).

Existing nuclear installations

2.15.In accordance with the requirements established in GSR Part 4 (Rev. 1) [1], SSR-1 [2], SSR-2/2 (Rev. 1) [4], SSR-3 [5] and SSR-4 [6] (see paras 2.1–2.3 and 2.6 of this Safety Guide), and in line with international practice, an evaluation of the seismic safety of an existing nuclear installation is required to be performed in any of the following cases:

Evidence of a significant increase in the seismic hazard at the site, arising from new or additional data (e.g. newly discovered seismogenic structures, newly installed seismological networks, new palaeoseismological evidence), new methods of seismic hazard assessment and/or the occurrence of actual earthquakes that affect the installation;
Regulatory requirements, such as a requirement for periodic safety reviews, that take into account the state of knowledge and the actual condition of the installation;
Inadequate seismic design, generally due to the very old design of the installation;
New technical findings, such as vulnerability of selected structures, non-structural elements (e.g. masonry walls) and/or systems or components (e.g. relays);
New experience from the occurrence of earthquakes (e.g. better recorded ground motion data, observed performance of SSCs);
A need to address the performance of the installation for beyond design basis earthquake ground motions in order to provide confidence that there is no cliff edge effect — that is, to demonstrate that no significant failures would occur in the installation if an earthquake stronger than the design basis earthquake were to occur;
A programme of long term operation that extends the lifetime of the plant, if applicable.

2.16.If, for the reasons listed in para. 2.15 or for other reasons, a seismic safety evaluation of an existing nuclear installation is required, the purposes of the evaluation should be clearly established before the evaluation process is initiated. This is because there are significant differences among the available evaluation methodologies and acceptance criteria, depending on the purpose of the evaluation (see Section 3). In this regard, the objectives of the seismic safety evaluation may include one or more of the following:

To demonstrate the seismic safety margin beyond the original design basis earthquake and to confirm that there are no cliff edge effects.
To identify weak links¹¹11 in the installation and its operations with respect to seismic events.
To evaluate a group of installations (e.g. all the installations in a region or a State) in order to determine their relative seismic capacity and/or their risk ranking. For this purpose, similar and comparable methodologies should be adopted.
To provide input for integrated risk informed decision making.
To identify and prioritize possible upgrades.
To assess risk metrics (e.g. core and/or fuel damage frequency, large early release frequency) against regulatory requirements, if any.
To assess installation capacity metrics (e.g. system level and installation level fragilities, high confidence of low probability of failure (HCLPF) capacity¹²12) against regulatory expectations.

2.17.The objectives of the seismic safety evaluation of an existing nuclear installation should be established in line with the regulatory requirements and in consultation and agreement with the regulatory body. Consequently, and in accordance with such objectives, the level of seismic input motion, the methodology for capacity assessment and the acceptance criteria to be applied, including the necessary end products, should be defined. In particular, for evaluating seismic safety in the event of an earthquake with a severity exceeding that considered for design, the safety objectives should include the functions to be ensured and the failure modes to be prevented during or after the earthquake’s occurrence.

2.18.The final documentation to be produced at the end of the seismic safety evaluation of an existing nuclear installation should be identified at the outset, in agreement with the regulatory body, and should be consistent with the established purpose of the evaluation programme (see para. 8.6). The end products of the evaluation may be one or more of the following:

Metrics of the seismic capacity of the nuclear installation in deterministic and/or probabilistic terms;
Quantification of the seismic risk;
Identification of SSCs with low seismic capacity, and the associated consequences for installation safety, for use in decision making on seismic upgrade programmes;
Identification of operational modifications to improve seismic capacity;
Identification of improvements to housekeeping practices (e.g. storage of maintenance equipment);
Identification of interactions with equipment and piping, including fire protection systems, high enthalpy lines and utilities;
Identification of actions to be taken before, during and after the occurrence of an earthquake that affects the installation, including arrangements for operational and management response, analysis of the instrumental seismic records obtained and inspections performed, and the integrity evaluations to be performed as a consequence;
A framework to provide input to risk informed decision making;
A framework for the revision of the seismic categorization of SSCs.

Consideration of Relevant Aspects Related to Seismic Hazard

2.19.An initial step of any seismic safety evaluation — in parallel with the collection of relevant data, as indicated in Section 4 — should be to identify the seismic hazards on the basis of which the seismic safety of the installation will be evaluated. In this respect, the seismic hazards specific to the site should be assessed in relation to three main elements¹³13:

Evaluation of the geological stability of the site [7, 9], with two main objectives pertaining to non-vibratory ground motions:
1. To verify the absence of any capable fault that could produce significant differential ground displacement phenomena underneath or in close proximity to buildings and structures important to safety. If there is evidence that indicates the possibility of a capable fault in the site area or site vicinity, the fault displacement hazard should first be assessed in accordance with the guidance provided in SSG-9 (Rev. 1) [7].
2. To characterize potential permanent ground deformation phenomena (e.g. liquefaction, slope instability, excessive settlement, subsidence, collapse).
Characterization of the severity of the seismic ground motion at the site (i.e. assessment of the vibratory ground motion parameters), taking into consideration the full scope of the seismotectonic effects at the four spatial scales of investigation¹⁴14 and as recommended in SSG-9 (Rev. 1) [7].
Evaluation of other concomitant phenomena, such as flooding due to seismically induced failure of dams or water retaining structures, coastal flooding due to tsunami, and seismically induced slope instabilities.

2.20.In general, the seismic hazard assessment may be performed using a deterministic or a probabilistic approach, depending on the objectives and requirements of the seismic safety evaluation. In either case, both the aleatory and the epistemic uncertainties should be taken into consideration.

2.21.The evaluations recommended in para. 2.19(a) and 2.19(c) of this Safety Guide should be performed in all seismic safety evaluations, regardless of the methodology used and in accordance with SSG-9 (Rev. 1) [7], NS-G-3.6 [9] and IAEA Safety Standards Series No. SSG-18, Meteorological and Hydrological Hazards in Site Evaluation for Nuclear Installations [13]. For evaluating the geotechnical hazards (e.g. liquefaction, slope instability, subsidence, collapse), the most recent available seismic hazard parameters should be used.

NS-G-3.6 has been revised and is now superseded by SSG-93 Geotechnical Aspects in the Siting and Design of Nuclear Installations

2.22.With respect to para. 2.19(b), the recommendations on assessing the seismic hazard at the site are dependent on the objectives of the seismic safety evaluation. A site specific ground motion seismic hazard assessment is generally preferred and should be considered a prerequisite, to be implemented as recommended in SSG-9 (Rev. 1) [7], when the objectives of the evaluation include the assessment of the seismic risk posed by the installation or the assessment of risk metrics for the SSCs. On the other hand, a site specific ground motion seismic hazard assessment should not be considered a prerequisite when the objective of the evaluation is to determine the seismic margin above a predefined reference level earthquake and/or to rank the SSCs contributing to the installation level seismic capacity to withstand that reference level earthquake for identification of seismic weak links. However, even with these objectives, a seismic hazard assessment should still be performed when site specific information indicates that the ground motion characteristics (e.g. spectral shape) might differ significantly from those assumed for design.

2.23.A site specific probabilistic seismic hazard assessment should be performed when the objectives of the seismic safety evaluation entail the following:

Calculation of risk metrics (e.g. core and/or fuel damage frequency, large early release frequency);
Establishment of a risk management tool for risk informed decision making;
Determination of the relative risk between seismic and other internal and external hazards;
Provision of a cost–benefit analysis tool for decision making in relation to plant upgrades.

2.24.For the SMA and PSA based SMA methodologies, the reference level earthquake¹⁵15 defines the seismic input that should be used in the seismic safety evaluation. The reference level earthquake (see also para. 5.5) should be interpreted not as a new design basis earthquake, but rather as a tool to determine the seismic margin and seismic weak links of the installation. The reference level earthquake should be larger than the design basis earthquake, to the extent that it challenges the seismic capacity of the SSCs so that an installation level HCLPF can be determined and any weak links can be identified. The reference level earthquake is typically specified by means of a spectral shape, anchored at a peak ground acceleration level, defining the seismic motion at a given control point. The seismic input for a seismic safety evaluation should not be less than a peak ground acceleration of 0.1g at the free field or foundation level.

2.25.For the SPSA methodology, the reference level earthquake¹⁶16 is defined using the site specific probabilistic seismic hazard assessment results. Generally, these results include seismic hazard curves defining the annual frequency of exceedance (often referred to as the ‘annual probability of exceedance’) of ground motion parameters (e.g. spectral accelerations), the associated response spectra (e.g. uniform hazard spectra) and the characteristics of the dominant source parameters (e.g. magnitude, distance from the site). The reference level earthquake should be defined at an annual frequency of exceedance that corresponds to an earthquake severity that significantly contributes to the seismic risk of the nuclear installation. When there are several dominant seismic sources that lead to very different motion characteristics (e.g. far field, near field), the overall seismic hazard curves may be split into multiple, mutually exclusive contributions, and multiple corresponding reference level earthquakes may be defined for the seismic safety evaluation. In this case, the seismic risk computed for each contribution should be combined to obtain the total risk.

Evaluation of Seismic Safety for Sites with Multiple Nuclear Installations

2.26.For sites with multiple nuclear installations (generally multi-unit nuclear power plants), which typically have shared systems and resources, potential interactions between the installations should be considered in the seismic safety evaluation. The evaluation will provide risk insights to help to minimize the risk of simultaneous accidents in several installations (e.g. due to shared systems and resources) and maximize the benefits associated with shared systems and resources among installations. Multi-unit PSA is an appropriate methodology for considering potential interactions in a multi-unit context. Recommendations on this methodology are provided in IAEA Safety Standards Series Nos SSG-3 (Rev. 1), Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power Plants [14], and SSG-90, Radiation Protection Aspects of Design for Nuclear Power Plants [15]; the technical background of the methodology is explained in Refs [16, 17].

Consideration of Seismic Safety Evaluation at the Design Stage

2.27.At the design stage for new nuclear installations, SPSA or PSA based SMA methodologies are typically used to meet the requirements indicated in paras 2.13 and 2.14 of this Safety Guide.¹⁷17 The assessment methodologies are limited by the information available up to the design stage; the as-built and as-operated information cannot be used in the same way that it is used for existing nuclear installations. Instead, as-designed information and operational experience feedback from similar designs should be used in applying these methodologies at the design stage. Moreover, physical seismic evaluation walkdowns cannot be conducted at this stage.

2.28.During development of the design, seismic safety evaluation should be used to address and eliminate seismic vulnerabilities identified in the past, to check the effectiveness of the defence in depth provisions, to provide insights for setting performance targets consistent with the seismic safety goals and to optimize the robustness of the seismic design.

Consideration of Seismic Safety Evaluation at the Licensing Stage

2.29.At the licensing stage, the design is completed and the site specific seismically induced hazards are known. For nuclear power plants, the SPSA methodology is typically used for the final safety analysis (for recommendations on the reporting of PSA in the safety analysis report, see section 3.15 of SSG-61 [12]). The seismic safety evaluation should provide assurance that the seismic design is adequate for the site specific seismic conditions. In particular, SPSA for new nuclear installations provides risk insights, in conjunction with the assumptions made, and contributes to identifying and supporting requirements related to the seismic design of the plant.

2.30.After the plant has been constructed and operation starts, the seismic safety evaluation performed before the operating licence was granted should be updated to reflect the as-built and as-operated conditions.

3. Selection of Methodology for the Evaluation of Seismic Safety

3.1.In accordance with Requirement 15 of GSR Part 4 (Rev. 1) [1], both deterministic and probabilistic approaches are required to be included in the safety analysis. Paragraph 4.53 of GSR Part 4 (Rev. 1) [1] states:

“Deterministic and probabilistic approaches have been shown to complement one another and can be used together to provide input into an integrated decision making process. The extent of the deterministic and probabilistic analyses carried out for a facility or activity shall be consistent with the graded approach.”

3.2.The selection of the seismic safety evaluation methodology is an important decision that should be carefully considered owing to its crucial consequences. This section discusses the capabilities and limitations of the SMA, PSA based SMA and SPSA methodologies¹⁸18 and provides recommendations on the applicability of each assessment methodology to a number of common objectives for existing and new installations. The selected assessment methodology should meet the following objectives:

The methodology should be adequate for achieving the objective of the seismic safety evaluation in the context of the reasons that motivated the seismic safety evaluation (a number of these objectives and reasons are listed in paras 2.16 and 2.15, respectively).
The methodology and its end products should be able to meet the regulatory requirements applicable to the installation.
The methodology should be capable of demonstrating that the installation will meet the safety requirements indicated in paras 2.1–2.6, as applicable to the reasons for the evaluation and the installation type.

3.3.More than one assessment methodology¹⁹19 might satisfy the objectives listed in para. 3.2. In choosing among multiple feasible methodologies, the following should be considered:

The availability and quality of knowledge and data sources needed to support the application of the methodology and its technical elements. For example, for SPSA, site specific probabilistic seismic hazard analyses need to be conducted, which in turn rely on the availability of specific information about seismicity rates and ground motion propagation characteristics from all potential sources within a distance range that can contribute to the seismic hazard of interest at the installation and on the explicit characterization of uncertainty in these parameters. For deterministic seismic hazard analysis, knowledge of this information is needed only for the few rupture sources that dominate the seismic hazard at the installation, and a less explicit uncertainty characterization can be accommodated.
The schedule for applying the selected methodology.
The initial and maintenance cost²⁰20 commitments of the selected methodology.
The potential added value achieved, in addition to the primary safety evaluation objective, and how that added value aligns with the longer term strategic objectives of the installation. Value might be added through the ability to use the safety assessment methodology components or end products for other objectives, the ability to reuse or upgrade these components or end products in the future, and the flexibility to accommodate future changes in regulatory requirements over the remaining or anticipated lifetime of the installation.
The fact that the assessment methodology does not need to be the same for all seismically induced hazards and potential SSC failures. For example, an SPSA methodology may be selected to perform the seismic safety evaluation of only vibratory ground motions, while a screening evaluation may be selected to demonstrate that the installation has a sufficiently high seismic margin for the effects of the remaining seismic hazards. This implies that such seismic hazards would make a negligible contribution to seismic risk and need not be considered explicitly in SPSA.

Seismic Margin Assessment

3.4.The SMA methodology is the least resource intensive of the three methodologies addressed in this Safety Guide; it is used mainly for existing nuclear installations. The SMA methodology can be applied using as input a seismic hazard characterization developed using either probabilistic or deterministic approaches. Detailed recommendations on how to implement this methodology are provided in paras 5.38–5.49.

3.5.The end product of SMA is an installation level HCLPF capacity based on the HCLPF capacity of two (or more) independent success paths.

3.6.The SMA methodology is primarily applicable to the following seismic safety evaluation objectives and should otherwise be considered of limited applicability:

Determination of the seismic safety margin above a specified earthquake (e.g. the design basis earthquake) or a recorded earthquake that affected the installation;
Demonstration of the seismic robustness of the nuclear installation against cliff edge effects, when robustness is characterized by seismic safety margin;
Demonstration of a sufficient safety margin to restart operation following the occurrence of a beyond design basis earthquake that led to the shutdown of the nuclear installation and potentially to other actions defined in Ref. [18];
Comparison of an estimate of installation level HCLPF capacity with regulatory expectations;
Identification of weak links in the credited success paths for the nuclear installation’s response to a beyond design basis earthquake event;
Identification of possible upgrades for SSCs in the success paths to improve the seismic safety margin;
Comparative safety assessment of a group of nuclear installations benchmarked by seismic safety margin against (i) the same earthquake effects, (ii) the effects of a common earthquake scenario or (iii) earthquakes that represent the same level of seismic hazard at each site;
Effective communication about the robustness of the nuclear installation to stakeholders, including the public;
Demonstration that the current seismic regulatory requirements are being met for nuclear installations that were designed without seismic regulatory requirements.

Probabilistic Safety Assessment Based Seismic Margin Assessment

3.7.The PSA based SMA methodology is a hybrid between the SMA and SPSA methodologies. It combines the typically less resource intensive hazard assessment, fragility and Boolean logic solution approaches of SMA with the accident sequence event tree and fault tree analysis from SPSA. The PSA based SMA methodology is used for both new and existing installations. Detailed recommendations on how to implement this methodology are provided in paras 5.50–5.55.

3.8.The end products of the PSA based SMA should be the installation level HCLPF capacity and the HCLPF capacities for all accident sequences of interest (and the corresponding cutsets²¹21) that can lead to an unacceptable safety performance of the installation. An additional end product may be an estimate of the installation level fragility²²22 in addition to the installation’s HCLPF capacity. The cutset level HCLPF capacity is the highest HCLPF capacity in a cutset. The sequence level HCLPF capacity is the lowest HCLPF capacity in the constituent cutsets.

3.9.The PSA based SMA methodology is applicable to the following seismic safety evaluation objectives, in addition to those listed in para. 3.6, and should otherwise be considered of limited applicability:

Comparison of an estimate of installation level and accident sequence level HCLPF capacities with regulatory expectations;
Identification of critical accident scenarios that might undermine safety in the nuclear installation’s response to a beyond design basis earthquake event, and identification of the weak link(s) in each accident sequence;
Identification and prioritization of possible upgrades for safety related SSCs to improve the seismic safety margin²³23;
Provision of preliminary insights for risk informed design and resource allocation decisions (e.g. safety classification of SSCs); (e) Comparative safety assessment of a group of installations benchmarked by either (i) the installation level seismic safety margin or (ii) sequence level seismic safety margins against specific accident classes and/or potential consequences.

Seismic Probabilistic Safety Assessment

3.10.The SPSA methodology can only be applied using as input a site specific seismic hazard characterization developed using probabilistic approaches. The SPSA methodology discretizes the seismic hazard from probabilistic seismic hazard analysis into acceleration levels with corresponding annual occurrence frequencies and explicitly convolves²⁴24 these frequencies with the installation level fragility. The installation level fragility should be determined by explicitly solving the installation accident sequence. Boolean logic equations are solved using failure probabilities obtained by quantifying accident sequences associated with each initiating event. Non-seismic failure rates of SSCs and human error probabilities are also taken into consideration in SPSA. This methodology is used for both new and existing installations. Detailed recommendations on how to implement this methodology are provided in paras 5.56–5.65. More recommendations on PSA methodology in general are provided in SSG-3 (Rev. 1) [14].

3.11.The end products of SPSA should include the products of the two SMA methodologies, the annual frequency of unacceptable performance of the installation due to seismic hazard, the installation level fragility, the risk metrics and the explicit quantification of uncertainties in the computed results.

3.12.The SPSA methodology is applicable to the following seismic safety evaluation objectives, in addition to those listed in paras 3.6 and 3.9:

Comparison of the risk metrics for unacceptable performance (e.g. core damage frequency, large early release frequency) with regulatory expectations;
Quantification and ranking of relative risk contributions (e.g. of accident sequences, individual SSCs or human actions) in the installation’s as-operated condition;
Evaluation of the risk reduction worth of possible SSC upgrades, procedural changes or mitigation strategy implementation;
Provision of quantitative input to risk informed design and resource allocation decisions (e.g. impact on risk of the safety classification of SSCs);
Understanding of uncertainty in seismic safety metrics²⁵25 and incorporation of uncertainty into the seismic safety evaluation conclusions;
Enabling of risk monitoring models that integrate real time changes in the condition of the installation (e.g. living PSA, digital twin technologies);
Comparative safety assessment of a group of installations benchmarked by either seismic safety margin or risk metrics.

Application of Methodology to New or Existing Nuclear Installations

3.13.In selecting the most appropriate assessment methodology, the objectives of the seismic safety evaluation and the information available for each nuclear installation should be taken into account. The objectives of the seismic safety evaluation are different for a new installation (see paras 2.13 and 2.14) and for an existing installation (see paras 2.15–2.17). In addition, there may be substantial differences in the information available for new installations and for existing installations (see para. 4.1). The challenges of data collection for a new installation (e.g. collection of site characterization information) will typically differ from those for an existing installation.

3.14.The selected methodology should enable the applicable regulatory requirements to be met. Regulatory requirements for existing nuclear installations may differ from those for new installations in some Member States.²⁶26

3.15.Priorities regarding the schedule and cost of the seismic safety evaluation should be considered when choosing among multiple feasible methodologies. These schedule and cost priorities and their impact on the final decision are typically different for new nuclear installations and existing installations, owing to the constraints of the applicable regulatory requirements and socioeconomic factors.

3.16.The anticipated operating lifetime of a new nuclear installation will typically be significantly longer than the remaining operating lifetime of a similar existing installation. As a result, the reusability and shelf life of a more rigorous methodology would be longer for a new installation. Accordingly, the return on investment is typically higher for a new nuclear installation and might justify the selection of the more costly SPSA methodology.

4. Data Collection and Investigations for the Evaluation of seismic Safety for Nuclear Installations Data and Documentation on the Design Basis

4.1.The design basis data and documentation should be collected from all available sources. This task does not pose special difficulties for new nuclear installations. For existing installations, emphasis should be placed on the collection and compilation of the specific data and information on the nuclear installation that were used at the design stage. Although there may be limitations on the quantity and quality of the available original design data for old installations, the more complete the information collected from the design stage, the less effort and fewer resources will be needed for the seismic safety evaluation.

General documentation for a nuclear installation

4.2.All available general and specific documentation for new and existing nuclear installations relevant to the seismic safety evaluation should be compiled, including the following:

Safety analysis report.
Codes and standards used for the design of the installation:
1. Standards adopted and procedures applied to specify the nominal properties of the materials used and their mechanical characteristics;
2. Standards adopted and procedures applied to define load combinations and to calculate the seismic design parameters;
3. Standards used for the design of structures, components, piping systems and other items, as appropriate;
4. Standards and procedures that would have been considered minimum requirements for the design of conventional buildings at the time of the design of the installation.
General arrangement and layout drawings for structures, equipment and distribution systems (e.g. piping, cable trays, ventilation ducts).
PSA of internal and external events, if performed.
For existing installations, data and information on results and reports of seismic qualification tests for SSCs performed during the pre-operational period, including any information available on inspection, maintenance, non-conformance reports and corrective action reports. For new installations, the specifications for seismic qualification tests (e.g. necessary response spectra) might be sufficient.
For existing installations, quality assurance and quality control documentation, with particular emphasis on the as-built conditions for materials, geometry and configuration (for assessing the modifications during construction, fabrication, assembly and commissioning), including non-conformance reports and corrective action reports. The accuracy of the data should be assessed.

Specific documentation for the SSCs included in the seismic safety evaluation

4.3.The following specific information on the original design of the installation, in particular on those SSCs included in the seismic safety evaluation, should be collected:

System design:
1. System description documents;
2. Safety, quality and seismic classification;
3. Design reports;
4. Confirmation of the functionality of systems;
5. System instrumentation and control, including the general concept, the types of device and how the devices are mounted.
Geotechnical design:
1. Excavation, structural backfill and foundation control (e.g. for settlement, heaving and dewatering);
2. Construction of retaining walls, foundations, underground structures, berms or artificial slopes;
3. Soil–foundation–structure failure modes and design capacities (e.g. estimated settlements, sliding, overturning, uplifting, liquefaction).
Structural design:
1. Structural analysis reports for all structures of interest;
2. Structural drawings (e.g. structural steel, reinforced and/or prestressed concrete), preferably as-built documentation for existing installations;
3. Material properties (specified and test data);
4. Typical details (e.g. connections).
Component design:
1. Seismic analysis and design procedures;
2. Seismic qualification procedures, including test specifications and test reports;
3. Typical anchorage specifications and types used;
4. Stress analysis reports;
5. Pre-operational test reports, if any.
Distribution system design (e.g. piping, cable trays, cable conduits, ventilation ducts):
1. System description documents;
2. Piping and instrumentation diagrams;
3. Layout and design drawings of piping and its supports;
4. Diagrams of cable trays and cable conduits and their supports;
5. Diagrams of ventilation ducts and their supports;
6. Design reports, including stress analysis reports if available.
Service and handling equipment:²⁷27
1. Main and auxiliary cranes, monorails and hoists;
2. Fuel handling equipment.

Seismic design basis

4.4.To conduct a seismic safety evaluation, the characterization of the seismic input used for design should be well understood. Any discrepancy between the documentation of the seismic hazard assessment performed during the site evaluation studies and the design basis values finally adopted should be identified. This information is essential for determining the reference level earthquake, which will be used in the evaluation of seismic safety. In this regard, the following aspects should be covered:

Specification of the design basis earthquake used for the design and qualification of SSCs (see SSG-67 [8]).
Site specific free field ground motion parameters in terms of elastic ground response spectra, acceleration time histories or other descriptors, such as power spectral density.
Seismological parameters representative of the earthquakes that make the largest contribution to the seismic hazard, such as magnitude, distance and duration of strong motion.
If some structures were designed in accordance with design codes whose design spectra have implicit reductions for inelastic behaviour, the corresponding elastic ground response spectra should be derived to provide a basis for comparison with the elastic ground response spectra typically used to define the reference level earthquake for the seismic safety evaluation.

Soil–structure interaction, structural modelling and in‑structure response details

4.5.Information on soil–structure interaction analysis, modelling techniques and techniques for structural response analysis used in the design should be collected as follows:

Soil–structure interaction parameters:
1. The location selected for applying the seismic input ground motion, for example free field surface on top of finished grade, foundation mat level or base rock level (often referred to as the ‘control point location’);
2. Soil profile properties applicable to each building or structure on the ground, including soil stiffness and damping properties used in the site specific response analysis, information on the water table variation and consideration of strain dependent properties;
3. The method(s) used to account for uncertainties in soil properties and techniques of soil–structure interaction analysis, for example envelope of three analyses for best estimate, lower bound and upper bound soil profiles;
4. Applicability and consideration of seismic wave phenomena in the definition of the input motion, including the definition of seismic input motion typically as a vertically propagating shear wave, coherency and wave passage effect.
Modelling techniques:
1. Modelling techniques and analytical methods used to calculate the seismic response of structures and the in-structure response spectra (e.g. floor response spectra);
2. Material and system damping, cut-off of modal damping and frequency dependence of damping;
3. Allowance for inelastic behaviour, as assumed in the design phase and as implemented during construction.
Structural analysis and response parameters:
1. One or two stage analysis, using coupled or substructure models of soil and structures.
2. Characterization of the soil foundation system (e.g. by impedance or transfer functions).
3. Equivalent static analyses of components and structures.
4. Dynamic analysis of components and structures.
5. Natural frequencies and modal shapes, if available.
6. Output of structural response (e.g. structure internal forces and moments, in-structure accelerations, deformations, displacements).
7. Foundation response, including overall behaviour such as sliding or uplift.
8. Calculations of in-structure response spectra (e.g. floor response spectra), including the following:
  1. Damping of equipment;
  2. Enveloping and broadening criteria, if used.

Additional Data and Investigations for Existing Nuclear Installations Current (as‑is condition) data and information

4.6.For an existing nuclear installation, after collecting as much data as is feasible about the original design basis, as recommended in paras 4.2–4.5, the current state and condition of the installation (i.e. the as-is condition) should be identified. The collection of such data should cover those selected SSCs that will be considered within the scope of the seismic safety evaluation and that have either a direct effect on system performance or an indirect effect, such as by transmitting earthquake motion from one location to another or by affecting safety related SSCs in the case of seismically induced failures. The as-is condition should properly reflect the effects of ageing of the installation throughout its operating lifetime and any pending physical or operational modifications so that these effects and modifications can be taken into account in the seismic safety evaluation. When applicable, a sufficient number of samples should be collected on parameters of interest (e.g. concrete strength) to adequately define the variability (e.g. mean and standard deviation).

4.7.If the nuclear installation has been subjected to periodic safety reviews, as recommended in IAEA Safety Standards Series No. SSG-25, Periodic Safety Review for Nuclear Power Plants [19], the reports of these reviews should be made available for the purposes of the seismic safety evaluation.

4.8.If the operating organization of a nuclear installation has implemented an ageing management programme (see IAEA Safety Standards Series No. SSG-48, Ageing Management and Development of a Programme for Long Term Operation of Nuclear Power Plants [20]), any outputs from the programme (e.g. condition assessment, periodic inspection reports) that identify the as-is condition should be made available for the purposes of the seismic safety evaluation. If some SSCs (e.g. active equipment) are covered not under an ageing management programme but rather by some other programme (e.g. monitoring of the effectiveness of maintenance), the related documentation should also be made available for the purposes of the seismic safety evaluation.

4.9.A critical review of all available as-built and pre-operational documentation (e.g. reports, drawings, photographs, film records, reports of non-destructive examinations) should be performed. For this purpose, a preliminary screening walkdown should be conducted to confirm the documented data and to acquire new, updated information. During this walkdown, data about any significant modifications, upgrades and/or repair measures that were performed over the lifetime of the nuclear installation should be collected and documented, including any reports on ageing effects. The judgement on how significant a modification would need to be in order to have an impact on the seismic response and capacity of the installation should be made by experts in seismic capacity evaluation.

4.10.Special attention should be paid to requirements, procedures and non-conformance reports for construction and/or assembly related to the following:

Slopes, excavation and backfill;
SSCs not accessible for inspection;
Field routed items (e.g. piping, buried piping, cable trays, conduits, tubing);
Installation of non-safety-related items (e.g. masonry walls, shielding blocks, room heaters, potable water lines, fire extinguishing lines, false ceilings);
Separation distances or clearances between components;
Field tested items;
Anchorages.

Investigation of subsoil data and earthquake experience

4.11.To perform reliable and realistic site specific seismic response analysis, data on the static and dynamic material properties of soil and rock profiles should be obtained. For an existing installation, if these data were obtained at an earlier stage (e.g. during the design stage), they should be reviewed for adequacy with regard to current methodologies. In this respect, the following should be taken into account:

Appropriate ranges of the static properties and dynamic properties that account for the site specific geotechnical characteristics and their variability should be available for use in the seismic safety evaluation.
For ground materials, the density and low strain properties (normally, in situ measurements of compressional and shear wave velocities), laboratory measurements of three axis static properties and, if possible, the dynamic properties and the material damping ratio should be available.
The variation of dynamic shear modulus values and damping values with increasing strain levels and as a function of depth should be available. Strain dependent variations in ground material properties may be based on generic data if ground materials are properly correlated with the generic classifications.
For hard rock layers, variation of properties with increasing strain levels may usually be disregarded.

In operating nuclear installations, it might be difficult to perform soil investigation campaigns. In such cases, as many data should be gathered as is practicable, but judgement might need to be employed in the collection of data. However, the use of judgement in the place of physical data should be avoided to the extent possible.

4.12.Information on the location of the local groundwater table and its variation over a typical year should be obtained.

4.13.For the various stages of site investigation, design and construction, other data may be available from non-typical sources, such as photographs, notes and observations recorded by operations staff or others. These data should be evaluated in the light of their source and method of documentation. To the extent possible, the collection of such data should be performed in compliance with the recommendations provided in NS-G-3.6 [9].

NS-G-3.6 has been revised and is now superseded by SSG-93 Geotechnical Aspects in the Siting and Design of Nuclear Installations

4.14.All available information relating to actual earthquake experience at the site or at other industrial installations in the region should be obtained. Special attention should be paid to earthquake induced phenomena such as landslides, liquefaction, river flooding due to dam failure and coastal flooding due to tsunami.

Investigation of data on building structures

4.15.The as-is concrete classes used for the construction of the safety related structures of the nuclear installation should be verified on the basis of existing installation specific tests and industry standards for concrete. Destructive and non-destructive testing methods may be used.²⁸28 The as-is data collected — rather than the nominal design data — should be used for further analyses and capacity evaluations. If there is significant deviation from the design values, the cause of this deviation and its consequences should be investigated.

4.16.The actual material properties of the reinforcing steel should be used in the evaluation. Material properties should be available from existing test data. If not, reliable methods of destructive and non-destructive testing should be used. The information on the reinforcing steel should include both mechanical properties and detailing (e.g. size of reinforcing bars, placement, geometric characteristics, concrete cover, distances between bars). For the evaluation of the overall capacity of a structure, the properties of all significant load bearing members should be evaluated. Other examples of where detailing of the reinforcement may be important include penetrations and anchorage of large components.

4.17.Although ageing effects are usually estimated separately, in the seismic safety evaluation, the survey of a concrete building should, at a minimum, include visual examination for cracks, effects of erosion and corrosion and surface damage, the degree of carbonation, the thickness of concrete cover, the current prestress of tendons and the degree of degradation of below ground foundations due to, for example, chlorides or other corrosive contaminants present in groundwater.

4.18.A sample survey should be performed to verify the geometrical characteristics of selected structural members. The number of samples collected should be statistically significant to allow for the accurate computation of sample statistics (e.g. sample mean, sample standard deviation).

4.19.An important element of the seismic safety evaluation is the verification of realistic non-seismic loads (e.g. live and dead loads) and possibly the new assessment of loads other than seismic loads that will be used in the seismic safety evaluation. Usually, both the live and the dead loads in the as-is condition deviate from those used in the original design. The deviations should be carefully examined and documented.

Investigation of data on piping and equipment

4.20.If design information for piping, equipment and their supporting structural systems is insufficient or not available, analysis and/or testing should be performed to establish their dynamic characteristics and behaviour. A representative sample may be sufficient.

5. Evaluation of Seismic Safety for Nuclear Installations, with a Focus on Nuclear Power Plants Assessment of Seismic Hazards Seismic hazard assessment approach

5.1.Site specific hazard analysis should preferably be used to characterize the seismic hazard and reference level earthquake for the seismic safety evaluation (see para. 2.22). The seismic hazard assessment may be performed using a probabilistic or a deterministic approach or a combination of both. A probabilistic approach should be used for SPSA. A deterministic approach or a combination of deterministic and probabilistic approaches may be used for SMA and PSA based SMA.

5.2.Probabilistic seismic hazard analysis should include a probabilistic characterization of ground motions that can be produced at the installation site by all seismic sources within the regional seismotectonic model (see SSG-9 (Rev. 1) [7]). Ground motion characterization should be performed for the range of annual frequencies needed to meet the regulatory requirements and to achieve the objectives of the seismic safety evaluations. Deaggregation of the probabilistic seismic hazard analysis results should be performed for the reference level earthquake to identify the dominant seismic sources — that is, those that make the largest contribution to the hazard.

5.3.Deterministic seismic hazard analysis should include determination of ground motions that the dominant seismic sources within the regional seismotectonic model are capable of producing at the installation site. The ground motions should be determined considering the potential maximum magnitude of each source, the closest associated distance to the site, and an appropriately high confidence level to account for variability due to epistemic uncertainty and aleatory variability in the source model, ground motion prediction model and site conditions (see SSG-9 (Rev. 1) [7]). The dominant seismic sources in a deterministic seismic hazard analysis should be identified by careful review of the seismotectonic model, as recommended in SSG-9 (Rev. 1) [7], in the absence of deaggregation data from a probabilistic seismic hazard analysis.

5.4.Dominant sources might not be the same for the different ground motion parameters and other seismic hazards (see para. 2.19). For sites located in a region of low to moderate seismicity, low frequency ground motions are often dominated by distant high magnitude sources, while high frequency ground motions are often dominated by diffuse seismicity — that is, by nearby moderate magnitude sources. Geotechnical failures are primarily caused by low frequency ground motions, while the dominant sources for concomitant phenomena hazards are phenomenon specific.

Development of the reference level earthquake

5.5.The reference level earthquake is the seismic hazard realization at which the responses and capacities of the SSCs identified for the seismic safety evaluation should be explicitly assessed. A reference level earthquake is necessary for technical consistency in the seismic safety evaluation, considering that several important dynamic response parameters depend on the seismic excitation level, including the following:

Damping, which depends on the extent of shaking induced cracking in concrete structures and slip or other connection deformations in metallic structures;
Geotechnical material properties and physical integrity, which exhibit degradation as the shaking level increases;
The potential for the occurrence of geotechnical failures whose characterization is necessary to evaluate the geological stability of the site (see para. 2.19(a)), which typically depends on the shaking level.

5.6.The reference level earthquake should be defined for the vibratory ground motion hazard using response spectra that characterize horizontal and vertical ground motion components at the site. For other seismically induced hazards (e.g. fault displacement), reference parameters should be developed on a case specific basis if these hazards cannot be screened out in accordance with para. 5.11.

Characterization of vibratory ground motions

5.7.For SMA and PSA based SMA, the reference level earthquake may be set according to several criteria, and it should be in accordance with the objectives of the seismic safety evaluation (see paras 3.6 and 3.8) and the available hazard assessment information. These criteria include the following:

A scaled spectrum of the original design basis earthquake;
A scaled spectrum or broadened spectrum of an earthquake that affected the installation;
A generic spectrum or suite of spectra (e.g. used in certification of a standard design);
A scaled site specific spectrum for a specified earthquake scenario;
A site specific spectrum for a specified uniform hazard of exceedance;
A generic or site specific spectrum determined by the regulatory body.

5.8.When the reference level earthquake is not based on current site specific hazard assessments, as in para. 5.7(a)–(c), the corresponding spectra should be compared with the site specific deterministic or uniform probabilistic hazard spectra (see para. 5.1) to develop an understanding of the resulting seismic safety margin of the nuclear installation in a site specific context.

5.9.For SPSA, the reference level earthquake spectrum at each frequency should be set to spectral acceleration levels that contribute most significantly to the resulting seismic risk and that have comparable, but not necessarily equal, annual probabilities of exceedance. This determination may involve an iterative process. The following considerations should be observed in the reference level earthquake for SPSA:

The selected reference level earthquake spectrum shape should result in low sensitivity of the computed seismic risk to the selection of the ground motion hazard parameter for SPSA (e.g. peak ground acceleration or spectral acceleration at selected frequencies).
Since the relative contributions of ground motion levels to the seismic risk can only be estimated before SPSA is performed, the appropriateness of the reference level earthquake based on this estimation should be confirmed (e.g. using sensitivity studies) after completion of SPSA and addressed if it is found to be inappropriate.

Characterization of other seismically induced hazards

5.10.The reference level earthquake parameters for other seismically induced hazards need to be characterized only for those hazards that cannot be screened out of explicit assessment in the seismic safety evaluation (see SSG-9 (Rev. 1) [7]). Non-vibratory groundmotion hazards and concomitant phenomena (see para. 2.19) should be individually screened for each hazard and credible phenomenon.

5.11.Hazards may be screened out on the basis of one of the following two criteria:

Credibility: The occurrence of the screened hazard at the site with a severity that will challenge the installation’s safety is practically impossible, or its annual probability of occurrence is too low compared with the reference level earthquake for vibratory ground motions (e.g. the fault displacement hazard is screened out owing to an absence of capable faults in the vicinity of the nuclear installation; liquefaction is screened out because soil deposits are so dense and the groundwater table is so low that liquefaction would occur only at incredibly high vibratory ground motions).
Consequence: The potential occurrence of the screened hazard has no consequence for the safety of the nuclear installation owing to physical features or reliable mitigation measures (e.g. river flooding due to upstream dam failure leads to an upper bound water line elevation at the site that does not challenge the external flood design basis of the installation).

5.12.For non-vibratory seismic hazards that cannot be screened out, the reference parameters for SMA and PSAbased SMA should be determined on a hazard specific basis, considering the criteria adopted for the reference level earthquake spectrum (see para. 5.7) and the hazard assessment approach (see para. 5.1). These reference parameters for explicit evaluation have logical correspondence with the reference level earthquake spectrum but do not necessarily correspond to the same annual probabilities of exceedance at the same confidence level as the vibratory ground motion. Options for determining these parameters include the following:

Ground motion parameters developed using deterministic seismic hazard analysis in accordance with paras 5.3 and 5.4. The reference parameters should be scaled by an appropriate margin based on the reference level earthquake spectrum.
Ground motion parameters developed using probabilistic seismic hazard analysis in accordance with para. 5.2 and prediction equations specific to these parameters²⁹29. The reference parameters should correspond to annual probabilities of exceedance similar to those of the reference level earthquake spectrum at an appropriately high confidence level to account for uncertainties in the geotechnical evaluation.
Ground motion parameters developed using geotechnical evaluations of the site response to the reference level earthquake for vibratory motion (e.g. slope deformation evaluation using the reference level spectrum as input motion). The reference parameters (e.g. slope displacement) should correspond to an appropriately high confidence level to account for uncertainties in the geotechnical evaluation.

5.13.For non-vibratory seismic hazards that cannot be screened out, the reference level earthquake parameters for SPSA should be determined using probabilistic seismic hazard analysis (see para. 5.2). The determination of ground motion parameters in the range of annual exceedance frequencies of interest may be performed by direct prediction (see para 5.12(b)) or indirect prediction (see para. 5.12(c)). In any case, the epistemic uncertainty and aleatory variability should be incorporated in the analysis approach for each hazard. The reference parameters should, at a minimum, correspond to annual probabilities of exceedance similar to those of the reference level earthquake spectrum. However, owing to strong non-linearities associated with geotechnical failure modes and their potential to cause sitewide cliff edge effects, multiple earthquake levels, especially above the reference level, should be explicitly used in developing the fragility functions associated with the corresponding SSC failures.

5.14.For concomitant phenomena that cannot be screened out in accordance with para. 5.11, the reference level earthquake parameters should be determined on a case specific basis. These phenomena may be triggered by earthquake ground motions occurring at sites with significantly different subsurface properties or located far from the nuclear installation, and their correlation with the reference level earthquake ground motions at the site needs specific evaluation.

Implementation Guidelines Common to all Seismic Safety Assessment Methodologies Scope of the seismic safety evaluation

5.15.An expert team comprising systems engineers, operating personnel and seismic capability engineers should collectively determine the scope of the seismic safety evaluation. A typical evaluation team should have three to five members.³⁰30 The four steps involved in determining the scope of the seismic safety evaluation are described in paras 5.16–5.19. These steps are fundamentally the same for SMA, PSA based SMA and SPSA and differ only in their implementation details (see paras 5.38–5.65).

5.16.The first step in determining the scope of the seismic safety evaluation should be to identify the safety functions to be fulfilled in order to control the progression or mitigate the consequences of an accident to achieve an acceptable end state if the nuclear installation experiences an earthquake. These safety functions and acceptable end states should be in accordance with the regulatory framework and the relevant IAEA safety requirements for the nuclear installation.³¹31

5.17.The second step in determining the scope of the seismic safety evaluation should be to establish agreement on the following aspects:

The initial conditions of the nuclear installation to be considered at the time of the earthquake. Establishing these initial conditions includes, for example, (i) defining which modes of operation are to be considered for the installation; (ii) defining what constitutes normal operating conditions for the installation systems and their components; and (iii) determining whether a seismically induced abnormal condition (e.g. loss of off-site power, small loss of coolant accident) might be triggered and should be considered to occur concurrently with or following earthquake induced shaking.
Definition of the safety related functions and corresponding systems that are credited in achieving an acceptable end state. The SMA methodology focuses on defining a subset of functions and systems necessary to achieve a determined number of success paths (typically two) to an acceptable end state. The PSA based SMA and SPSA methodologies have a broader focus that includes functions and systems whose failure might lead to the progression of an accident to an unacceptable end state.
Identification of operator actions that are credited in the seismic safety evaluation. These actions should be established in the emergency procedures.
Availability and account taken of any non-safety-related emergency response and mitigation systems. These systems include mobile alternative resources (e.g. water, compressed air and electrical power supplies) stored on the site that are located and maintained in such a way as to be functional and readily accessible when needed in postulated emergency conditions.
Availability and account taken of outside assistance. The type of assistance, response time and conditions for availability of outside assistance should be established in the safety procedures and agreed upon with the regulatory body.

5.18.The third step in determining the scope of the seismic safety evaluation should be to prepare a list of selected SSCs³²32 for seismic capability evaluation. Paragraphs 5.20–5.22 provide recommendations on this process.

5.19.The fourth and final step in determining the scope of the seismic safety evaluation should be to perform a seismic evaluation walkdown (see paras 5.23–5.33). For a new nuclear installation, the walkdown may be replaced with a virtual review³³33 (to the extent practicable) followed by a confirmatory walkdown after construction of the installation is finished.

Preparation of the list of selected SSCs

5.20.The list of selected SSCs should be prepared jointly by the multidisciplinary expert team and confirmed by a systems walkdown (see para. 5.21). The following SSCs should be included in the list:

SSCs necessary for the safety related systems described in para. 5.17(b) to fulfil their safety functions. These SSCs are not limited to front line and support safety systems, but include instrumentation and control equipment, cable trays, passive elements and other distribution systems.
SSCs whose seismically induced response or damage might physically affect one or more other SSCs (e.g. through falling, impact, fire, flood or spray) and interfere with the ability of those other SSCs to fulfil their safety functions.
SSCs whose seismically induced damage might impede the operator actions described in para. 5.17(c) (e.g. by physically injuring operating personnel, blocking their entry or exit, or preventing their use of tools needed to take actions).
SSCs necessary for post-earthquake emergency procedures credited in achieving an acceptable end state, for example the mitigation systems described in para. 5.17(d).
SSCs whose seismically induced damage might impede the arrival or deployment of the outside assistance described in para. 5.17(e).
Structures that house or support the identified SSCs.
SSCs that represent unique features of the installation from a seismic safety perspective (e.g. an SSC related to the credible and consequential concomitant phenomena described in para. 5.14).
SSCs needed during identified design extension conditions, if not already included above.

5.21.A systems walkdown should be performed for existing nuclear installations (see Ref. [10]). For new installations, a virtual review of the available design should be performed to the extent practicable. The systems walkdown should have the following objectives:

To confirm the completeness and consistency of the list of selected SSCs compared with the as-built systems configuration;
To familiarize the seismic capability engineers with the as-built configuration, conditions and apparent seismic robustness or vulnerability of the SSCs;
To investigate the surrounding areas to identify potential sources of seismically induced interactions with the selected SSCs;
To ensure that the credited operator travel paths are compatible with plant operating procedures;
To verify potential assumptions used to justify including elements in — or screening them out of — the scope of the seismic safety evaluation on the basis of their credibility and the consequence(s) of their failure (see para. 5.11).

5.22.The list of selected SSCs should include all the SSCs that belong in the success path or logic tree model for the acceptable end state(s) of the nuclear installation. Several SSCs on this list may be removed from the explicit seismic capability evaluation if a qualitative review indicates that they have either (a) significantly low seismic capacities and should be assumed to fail in an earthquake or (b) significantly high seismic capacities and can be assumed to be rugged in an earthquake³⁴34. These screening decisions should be confirmed by observation in the seismic evaluation walkdown (see para. 5.23). The list of selected SSCs should be refined during the walkdown and finalized as part of the walkdown documentation (see para. 5.33).

Seismic evaluation walkdown

5.23.Seismic evaluation walkdowns are among the most significant components of the seismic safety evaluation in the SMA and SPSA methodologies. They are often referred to as ‘seismic capability walkdowns’ in the context of SMA and ‘seismic fragility walkdowns’ in the context of SPSA. For new nuclear installation designs that have not been constructed, walkdowns should be performed after construction is completed to verify consistency between the as-built conditions and the as-designed conditions that were used in the seismic safety evaluation on the basis of virtual review (see para. 5.19) and to observe any installation or site specific features. It is important that all design features used for the seismic safety evaluation be verified in the as-built installation — and any deviations addressed — in order for the evaluation to be valid. The final safety analysis report should incorporate any resulting updates to the seismic safety evaluation in accordance with regulatory requirements (see SSG-61 [12]).

5.24.The seismic evaluation walkdown team should include qualified seismic capability engineers, at least one systems engineer, and facility support personnel (e.g. for maintenance, operations, systems or engineering support) as needed. The seismic capability engineers should have sufficient experience in the seismic analysis, design and qualification of SSCs for resisting earthquakes and other loads arising from normal operations, accidents and external events. One team member should be familiar with the design and operation of the SSC being walked down.

5.25.The scope of the walkdown should be defined to meet the needs of the selected safety assessment approach within the conditions defined in para. 5.17. The purposes of the seismic evaluation walkdown typically include the following:

To collect information that can be used in refining the list of selected SSCs;
To observe and record the current as-built condition of selected SSCs included in the list;
To verify the screening of SSCs on the basis of very low or very high seismic capacities;
To identify conditions in these SSCs, or in their anchorage or configuration (e.g. known or suspected seismically vulnerable details), for consideration in their seismic capacity evaluation;
To identify the realistic failure modes of each SSC that might prevent the achievement of an acceptable end state;
To collect key data, such as dimensions, that might be needed in seismic capacity evaluations;
To identify SSCs whose failure might result in previously unidentified seismic spatial interactions (see para. 5.20(b), (c) and (e)) and to collect the necessary information to identify their relevant failure modes, the failure consequences and the affected SSCs;
To identify and report ‘seismic housekeeping’ matters that can be easily addressed by the nuclear installation operating organization to reduce obvious vulnerabilities, such as temporary or ‘left in place’ equipment that might result in seismic interactions (e.g. scaffolding, ladders, carts), missing fasteners, unsecured light fixtures and unrestrained stored items.

5.26.The seismic evaluation walkdown process should include preparatory activities, a preliminary walkthrough, development of a walkdown plan and walkdown guidance, performance of detailed seismic evaluation walkdowns, post-walkdown activities and preparation of documentation.

5.27.The preparatory activities for the seismic evaluation walkdown should be performed for the following purposes:

To familiarize the walkdown team with the nuclear installation through the review of systems diagrams, layout and other drawings, previous seismic evaluations, and documentation from prior walkdowns;
To create a database of selected SSCs containing the data available prior to the walkdown, which will later be populated with the data collected during the walkdown;
To review the list of selected SSCs for completeness;
To classify the selected SSCs on the list by type and location;
To identify SSCs and areas with special access needs and/or safety and protection measures;
To identify selected SSCs and areas for the preliminary walkthrough (see para. 5.28);
To identify any access and training needs of the walkdown team.

5.28.The objective of the preliminary walkthrough is for the walkdown team to gain familiarity with the key areas of the nuclear installation and with the general configuration and construction quality of its SSCs in order to facilitate the development of the walkdown plan. The key members of the walkdown team should participate in the preliminary walkthrough. They should focus on observing SSCs with no special access needed, confirming the consistency of the information obtained during the preparatory activities (see para. 5.27) with the as-built conditions, and identifying any access needs and considerations for similar SSCs that were not previously identified in the preparatory activities.

5.29.A detailed walkdown plan and schedule should be prepared and shared with the nuclear installation operating organization ahead of the walkdown. The walkdown plan should specify the following:

The list of selected SSCs, their locations on layout drawings, their classification by SSC type and general location, and a description of the typical observation activities to be conducted;
The list of similar SSCs, identifying the lead items for detailed walkdowns and other items for confirmatory walkbys³⁵35 (see para. 5.31);
The estimated time needed for walkdowns and walkbys of the various SSC classes;
The list of SSCs that need special access and the support requested from the installation personnel (e.g. de-energizing of active equipment to examine internals, opening of equipment enclosures to observe anchorage, authorization for access to areas with high radiation levels or contamination, escorted access to high security areas);
The areas in the installation where walkdowns of distribution systems and operator travel paths will be performed;
The key members of the walkdown team, their access needs and training credentials;
The necessary safety and protection measures for the walkdown team members.

5.30.Before a seismic evaluation walkdown is performed, specific guidance should be prepared, shared with and reviewed by the seismic capability engineers of the walkdown team. The objective of this guidance should be to maximize consistency among multiple walkdowns and the quality of the data collected for subsequent evaluations. This guidance should include the following:

Criteria for capacity screening and ranking³⁶36;
Class specific actions for typical SSC classes (e.g. verification that batteries are vertically restrained);
Actions for specific SSCs, typically informed by the preparatory activities and preliminary walkthrough (e.g. measurement of the as-built distances across specific building interfaces);
Actions for walkby review of similar components;
Criteria for assessing spatial interaction concerns (principally falling hazards³⁷37 and impact hazards³⁸38) and identification of known or suspected concerns to be examined;
Criteria for assessing seismically induced fire and flood interaction concerns and identification of known or suspected concerns to be examined;
Procedures for area based and sampling based walkdowns (e.g. of distribution systems);
Procedure for walkdown of operator travel paths;
Procedure for in-process refinement of the list of selected SSCs in order to add or remove SSCs from the final list;
Procedure for information collection on applicable geotechnical failure modes (e.g. measurements to allow evaluation of the liquefaction settlement capacity of a piping run);
Instructions on documentation.

The appendix to this Safety Guide provides seismic failure mode considerations specific to different types of SSC, which should be reviewed and used to inform the seismic evaluation walkdown and subsequent seismic capacity evaluations.

5.31.The detailed seismic evaluation walkdown should review all the selected SSCs to the extent feasible. The seismic capability engineers should assess the construction and seismic robustness of the SSC; its support structure and anchorage; the potential consequences of credible sources of spatial and other seismic interactions that might affect it; and the potential for, and consequences of, a seismically induced fire, flood or spray resulting from the failure of the SSC. For the review of SSCs in inaccessible or restricted access locations, available supplemental information may be used (see para. 5.32). For groups of similar SSCs, a detailed review of a lead item may be conducted, followed by less detailed walkbys of the other items to confirm their similarity and record any differences relevant to the seismic capacity evaluation. For SSC classes with a very large number of similar items (e.g. local instruments, passive elements), the walkbys may be performed on a sampling basis. For distribution systems, the walkdown may be performed on a sampling basis in areas of interest. The areas of interest should be identified by a systems engineer and should represent the as-built configurations for seismic capacity evaluations.

5.32.The post-walkdown activities should include any actions that could not be performed in the field, such as the review of photographs, construction records and other documentation for inaccessible SSCs, SSC internals, SSC anchorage or SSC seismic load paths to the structure (e.g. obscured by a raised floor). However, the walkdown findings should be based on field observations to the extent feasible. These post-walkdown activities should be identified in the walkdown documentation.

5.33.The seismic evaluation walkdown should be properly documented as an important product of the seismic safety evaluation. The documentation should include the following:

A summary of the walkdown planning (see para. 5.29(a)–(d)) and execution activities;
The final list of selected SSCs (including justification for SSCs removed or added on the basis of the walkdown);
A summary of the main walkdown findings and recommendations relevant to the seismic capacity evaluation for the selected SSCs;
Seismic evaluation data collected for all SSCs. These data are typically entered in template forms for each SSC class and should be used to populate the SSC database (see para. 5.27(b)).

Considerations on Seismic Capability for Defence in Depth Level 4

5.34.The design and as-is conditions of the installation are required to provide adequate seismic margin to (a) protect items important to safety and avoid cliff edge effects and (b) protect items that are ultimately necessary to prevent an early radioactive release or a large radioactive release, if natural hazards occur at levels that exceed those considered for design (see Requirement 17 of SSR-2/1 (Rev. 1) [3], Requirement 19 of SSR-3 [5] and Requirement 16 of SSR-4 [6]).

5.35.Level 4 of the defence in depth concept corresponds to the mitigation of severe accidents and prevention of large releases. The list of selected SSCs to be evaluated for adequate seismic margins should include items needed to perform mitigation functions associated with design extension conditions. For instance, the list should include items for the protection of the containment system (for nuclear installations with such a system) or the last confinement barrier against large releases (for other nuclear installations).

5.36.For the prevention of an early radioactive release or large radioactive release, the minimum seismic margin should be consistent with the containment or confinement seismic performance target (e.g. a large early release frequency of less than 10⁻⁶ per yearfor a new nuclear power reactor design; see SSG-67 [8]).

5.37.In seismic safety evaluation of adequate margins for items performing mitigation functions associated with design extension conditions, uncertainty in the seismic margin estimates should be properly considered.

Implementation of Seismic Margin Assessment

5.38.The SMA methodology should comprise the following steps:

Selection of the evaluation team (see para. 5.15);
Selection of the reference level earthquake (see para. 5.5);
Plant familiarization and data collection (see Section 4);
Selection of success path(s) (see paras 5.17(b) and 5.39) and identification of the list of selected SSCs (see para. 5.18);
Seismic evaluation walkdown (see para. 5.19);
Determination of the seismic responses of SSCs to use as input for seismic capacity calculations;
Determination of HCLPF capacities for the selected SSCs and the installation;
Specific considerations for nuclear reactors (see paras 5.48 and 5.49);
Peer review (see Section 8);
Preparation of documentation (see Section 8).

5.39.The following recommendations should be taken into account in selecting the success path(s) and SSCs for the SMA methodology:

Multiple alternate success paths may be selected to ensure diversity and redundancy in the front line and support systems. In some Member States, the selection of at least two success paths for some installations is required by the regulatory body.
The systems engineers should formulate the candidate success path(s) to reach an acceptable end state (see para. 5.16)³⁹39, with input from operating personnel. Different paths should include different operational sequences and SSCs to the extent possible.
If multiple success paths are selected, one should be designated as the primary success path. The primary success path should be the path for which it is judged easiest to demonstrate a high seismic safety margin and should be consistent with the plant design manuals, operational procedures and emergency response procedures.
The seismic capability engineers should support the determination and prioritization of success paths by qualitative assessment of the ruggedness and seismic vulnerability of the selected SSCs based on knowledge gained from the systems walkdown and previous seismic safety evaluations.
Non-seismic (e.g. random or maintenance related) failures of SSCs and system outages should be reviewed. The use of success paths that rely on SSCs with high random failure rates should be avoided to the extent possible.
Actions to be taken by operating personnel should be reviewed and assessed in the light of the common cause nature of the earthquake. The use of success paths that rely on operator actions that cannot be executed with high confidence (e.g. owing to the timing or duration of the action, operational and emergency procedures at the installation, or the potential for increased stress levels for personnel or interference with their other responsibilities) should be avoided.

Determination of seismic responses

5.40.The seismic responses of buildings and other structures on the list of selected SSCs should be determined for use in the generation of seismic input motions for the SSCs supported by each structure. These seismic responses may also be needed for the seismic capacity evaluation of the structure if its failure modes of interest (see Appendix) cannot be qualitatively screened out as seismically rugged in accordance with para. 5.22. The seismic responses of systems and components should be determined for their seismic capacity evaluations.

5.41.The seismic responses of SSCs to the reference level earthquake should be determined with a high confidence level (see, for example, section 5.1.2.6 of Ref. [10]). Probabilistic or deterministic methods of structure analysis may be used to determine seismic responses. Probabilistic methods use best estimate centred parameter values and include explicit treatment of uncertainties. Acceptable deterministic methods should include conservative provisions to account for the effect of uncertainties (e.g. owing to analytical procedures and parameter values) and the sources of randomness associated with the reference level earthquake ground motions⁴⁰40 that were not included in the seismic hazard analysis.

5.42.The following recommendations should be taken into account in determining seismic responses for buildings and other structures:

Current mathematical models of the structure should be used for the new seismic response analysis for the reference level earthquake ground motions. The scaling of previous seismic response analysis results (e.g. design basis analyses) on the basis of the ratios of reference level to design basis earthquake ground motions may be justifiable. Scaling is considered appropriate for rock sites where the design basis models of the structures are considered linear and median centred, and where the spectral shapes of the design basis and reference level earthquakes are sufficiently similar.
For vibratory ground motion input, response spectrum analysis methods may be sufficient for structures without significant soil–structure interaction effects. For structures with significant soil–structure interaction effects, response history methods (sometimes referred to as ‘time history methods’) should be used. Equivalent linear or explicitly non-linear methods may be used as appropriate for the expected responses.
For non-vibratory ground motion input (e.g. response to liquefaction settlement or slope deformation), quasi-static analysis methods should typically be sufficient.

5.43.The following recommendations should be taken into account in determining seismic responses for systems and components:

The seismic responses may be determined by a new analysis of the response to seismic input motions at the system or component supports resulting from the reference level earthquake ground motions, by the scaling of previous response analysis results on the basis of the ratios of the seismic input motions to the system or component, or by physical testing.
For vibratory ground motion input, the system or component response may be analysed as coupled or uncoupled with the supporting structure model. Coupled response analysis should be used if significant dynamic interaction effects are expected. (c) For non-vibratory ground motion input, quasi-static analysis methods should typically be sufficient.

Determination of HCLPF capacities for the selected SSCs and the nuclear installation

5.44.The seismic capacities of the selected SSCs should be characterized by determining their HCLPF capacities⁴¹41. The HCLPF capacity of an SSC is expressed as a function of the hazard parameter (e.g. peak ground acceleration, spectral acceleration) corresponding to the scale factor⁴²42 at the reference level earthquake ground motions at which there is at least 95% confidence of 5% (or less) probability of failure. Alternatively, the HCLPF capacity may be represented by an earthquake hazard parameter at which the expected mean probability of failure is 1% or lower.⁴³43

5.45.The HCLPF capacities should be determined by the seismic capability engineers. More detailed seismic capacity evaluations should be performed for the SSCs with a relatively low HCLPF capacity that are needed in each success path. More simplified, conservative, bounding case or screening based capacity evaluations may be performed for other SSCs in each success path without affecting the path’s HCLPF capacity.

5.46.The HCLPF capacity of a success path should be taken as equal to the HCLPF capacity for the SSC with the lowest HCLPF capacity in the path. More than one independent success path should be considered. The installation level HCLPF capacity should be taken as equal to that of the success path with the highest HCLPF capacity.

5.47.The reference level earthquake and the HCLPF capacities for the installation and SSCs should be reported. The weak links in each success path should be identified for consideration of potential improvements or other actions (see Section 7).

Considerations for nuclear power plants

5.48.The seismic margins of the containment and confinement systems for nuclear power plants should be determined. Features such as penetrations and equipment and personnel hatches, and considerations such as the impact between structures and containment performance under elevated temperature and pressure caused by core damage, should be reviewed. Credible potential seismic weak links in the containment and confinement systems should be explicitly included in the success path HCLPF capacity determination. Alternatively, a Level 2 PSA for internal initiating events (see IAEA Safety Standards Series No. SSG-4, Development and Application of Level 2 Probabilistic Safety Assessment for Nuclear Power Plants [21]) may be performed to evaluate the containment response to beyond design basis earthquakes.⁴⁴44

5.49.A detailed walkdown inside the containment to verify that all small lines in a nuclear power plant can withstand the reference level earthquake is resource intensive and possibly impractical owing to (a) the radiation hazard to the walkdown team and (b) the challenges of an exhaustive review of potential seismic spatial interactions affecting small lines in a crowded space. As a practical alternative, SMA may be performed by ensuring that any success path is capable of sustaining concurrently the loss of off-site power and a small loss of coolant accident inside the containment. Alternatively, the integrity of small bore lines could be verified on a sampling basis.

Implementation of Probabilistic Safety Assessment Based Seismic Margin Assessment

5.50.The PSA based SMA methodology should comprise most of the same steps as the SMA methodology (see para. 5.38), with the following modifications:

The selection of success path(s) (step 4) should be replaced by the accident sequence event tree and fault tree analysis;
The identification of the list of selected SSCs (step 4) should be based on the accident sequence analysis;
The HCLPF capacities for the installation (step 7) should be determined differently (see para. 5.54);
Human errors and non-seismic random failures should be included.

5.51.The accident sequence event trees and fault tree logic models should be developed following the SPSA methodology (see paras 5.56 and 5.57).

5.52.The list of selected SSCs should be identified in a similar way to the fragility evaluation in the SPSA methodology (see para. 5.58).

5.53.The HCLPF capacities for the selected SSCs are typically determined in a similar way to the method used for SMA. Depending on the desired end product of the safety assessment, the following refinements should be considered:

Development of conservatively biased seismic fragility estimates for the SSCs. This can be achieved by assigning a generic or estimated value of the variability to be combined with the HCLPF capacity to estimate a fragility function.⁴⁵45
Development of detailed seismic fragilities (in a similar way to the SPSA method; see para. 5.62) for SSCs that are identified to govern the installation level HCLPF capacity.

5.54.The installation level HCLPF capacity should be determined by incorporating all minimal cutsets that can lead to unacceptable end states. The capacity may be computed using one of the following two approaches:

The ‘min-max’ approach: Each HCLPF capacity in the cutset is taken as equal to that of the highest HCLPF capacity in the cutset. The installation level HCLPF capacity is taken as equal to the lowest HCLPF capacity in the cutset.⁴⁶46
The explicit quantification approach: An estimated fragility curve for each cutset is derived from the seismic fragilities (and non-seismic failure probabilities) of the cutset components using a Boolean AND gate. An estimated fragility curve for the installation is derived from the cutset fragilities using a Boolean OR gate. The installation level HCLPF capacity is computed by identifying the 1% mean probability of failure point on the latter fragility curve.

5.55.The reference level earthquake and the installation level and all significant cutset HCLPF capacities should be reported. The weak link cutsets, the corresponding accident sequences, and the failure modes and HCLPF capacities of SSCs leading to these accident sequences should be identified for consideration of potential improvements or other actions (see Section 7). Estimated fragility curves for the installation and the weak link cutsets, if developed, should also be reported.

Implementation of Seismic Probabilistic Safety Assessment

5.56.The SPSA methodology should comprise most of the same steps as the SMA methodology (see para. 5.38), with the following modifications: (a) Step 4 should be replaced by the development of the accident sequence event tree and fault tree logic model and the identification of the list of selected SSCs; (b) Human reliability analysis for operator actions in the context of a seismic event should be added; (c) Step 7 should be replaced by seismic fragility evaluation of the SSCs and seismic risk quantification for the nuclear installation.

5.57.The accident sequence logic model should include the analysis of potential seismically induced initiating events, the installation response considering the impact of the seismic event on SSCs, and operator actions. The most common approach taken in Member States is to use seismic event trees to model accident sequences and fault trees to model basic failure events (see Ref. [10] for a more detailed description). If the nuclear installation has an existing internal events PSA logic model, which is typically a regulatory requirement for nuclear power plants, the seismic accident sequence logic model should be developed by modifying the internal events logic model to account for seismically induced failures and initiating events that are not included in the internal events PSA. The following considerations should be taken into account:

The common cause nature of seismic events imposes concurrent demands on the SSCs in the installation and on surrounding infrastructure and might lead to simultaneous failures whose correlation should be considered in the logic model.
The seismic ground motions represented by the seismic hazard curve range from moderate to very large earthquakes. The resulting probabilistic distributions of seismic demands at the plant level lead to distribution of the core and/or fuel damage frequency, of the large or early release frequency, or of other risk metrics of interest, as a function of the hazard parameter.
Earthquakes might cause initiating events that are not applicable to the internal events PSA.
Earthquakes might cause failures of passive SSCs, such as structures and distribution systems, that are not included in the internal events PSA.
Earthquakes might result in seismic interaction failures (e.g. seismically induced fire).
SPSA accident sequence logic should include both potential seismic and potential non-seismic (e.g. random) SSC failures within the time taken to reach an acceptable end state.

5.58.The system logic model⁴⁷47, either new or modified from an existing internal events PSA logic model, should include all credited systems that are relied on to prevent the progression of accidents due to seismically induced initiating events to an unacceptable end state (see SSG-3 (Rev. 1) [14]). Existing accident sequence models (e.g. event trees) should be modified or supplemented by new ones unique to SPSA (e.g. failure of major structures that lead directly to unacceptable end states). Existing system reliability models (e.g. fault trees) should be modified to include all credible seismically induced and non-seismic failure modes and to include, as applicable, credited recovery actions (e.g. operator intervention, mitigation systems). Common cause failures and fragility correlations between basic events should be modelled.

5.59.The list of selected SSCs for SPSA should include every SSC whose seismically induced failure contributes to the basic events in the accidentsequence logic model. This list typically includes significantly more SSCs than for the SMA methodology, which needs only enough SSCs to achieve a limited number of success paths. For the fragility evaluation, the list of selected SSCs should be shortened by excluding the SSCs screened out as described in para. 5.22, by assigning them nominally high or low fragilities.

5.60.The determination of seismic responses of SSCs should generally apply the recommendations provided for SMA in paras 5.40–5.43. However, for the SPSA methodology, in addition to the generation of high confidence conservative response estimates for HCLPF computations, the probability distributions of the seismic responses should be characterized. This characterization should be performed using median centred values and associated variabilities of the input parameters (e.g. material properties) and analytical models consistent with the reference level earthquake ground motion level.

5.61.Fragility curves should be developed for items on the list of selected SSCs. A fragility curve should characterize the probability of failure of an SSC conditioned on an earthquake loading intensity parameter. The SSC failure modes evaluated for each SSC should be causally related to the basic events in the system logic model. Earthquake intensity is typically characterized by a ground motion parameter (e.g. peak ground acceleration) but may alternatively be characterized by a local parameter (e.g. in-structure acceleration). The variability represented by each fragility curve should include the effects of inherent randomness and epistemic uncertainty on the corresponding SSC conditional probability of failure.

5.62.Seismic fragility evaluations should be performed at a level of rigour appropriate to the risk significance of the SSC. The following three approaches represent an ascending level of rigour:

Generic fragility curves may be used for SSCs with a negligible contribution to seismic risk. These may include nominally low and nominally high generic fragilities for SSCs screened out in accordance with para. 5.22, and database based (i.e. not component or installation specific) fragilities for other SSCs that meet certain inclusion rules.⁴⁸48
HCLPF capacity based fragilities may be developed as described in para. 5.53(a). These fragilities should be sufficiently component and installation specific to be used for significant risk contributors. The use of these fragilities is not recommended for dominant risk contributors.
Detailed fragilities — incorporating expected seismic responses and capacities of SSCs and explicit treatment of variability owing to uncertainty and randomness — may be developed and used for risk significant SSCs. The use of these fragilities is recommended for dominant risk contributors.

5.63.Human failure event probabilities should be assessed taking into consideration that the unique challenges of earthquakes and the level of damage that they cause, increased stress levels, concurrent genuine and spurious failure alarms, and the potential loss of indicator signals might shape human performance. More recommendations on human reliability modelling are provided in SSG-3 (Rev. 1) [14], and further information is provided Ref. [22].

5.64.Risk quantification should be performed by combining the SSC fragilities, minimal cutset Boolean equations and seismic hazard curves over an earthquake intensity parameter range of interest. The installation level fragility curve should be computed explicitly at each intensity level from the SSC fragilities, non-seismic failure rates and human failure probabilities, in accordance with the approach described in para. 5.54(b) and using the full fragility curves instead of estimated curves. This fragility curve should be integrated with the earthquake severity occurrence rates according to the hazard curve to compute the annual frequency of unacceptable performance. Depending on the safety evaluation objectives and regulatory requirements, this annual probability may be determined as a point estimate of the mean value or as a probability distribution.

5.65.The following SPSA outcomes should be reported:

The frequencies of unacceptable end states (e.g. core damage, large early release);
A description of the major seismically induced initiating events and of the safety functions and/or mitigation functions included in the system logic model;
Lists of seismic fragilities and non-seismic failure rates developed for all SSCs and of human error probabilities developed for operator actions;
Identification of risk significant accident sequences, seismically induced failures and associated SSCs, non-seismic failures and operator actions, to facilitate understanding of the likely accident scenarios and consideration of potential improvements or other actions (see Section 7);
Identification of the installation level fragility curve, the range of earthquake intensity that contributes most significantly to seismic risk, and any potential cliff edge effects;
If applicable, identification of safety related SSCs whose contribution to seismic risk is negligible for potential consideration in risk informed design decisions (see paras 7.2–7.4);
Assessment of the sensitivity of the results to major modelling assumptions;
Uncertainty ranges of annual frequencies and identification of their major contributors.

6. Evaluation of Seismic Safety for Nuclear Installations Other than Nuclear Power Plants

6.1.This section provides guidance on the seismic safety evaluation of a broad range of nuclear installations (see para. 1.10) other than nuclear power plants.

6.2.The seismic safety evaluation of nuclear installations other than nuclear power plants should be based on a graded approach. The purpose of the evaluation is to verify that SSCs important to safety are still able to fulfil their safety functions in the event of an earthquake.

6.3.The methodology to be followed for evaluating nuclear installations other than nuclear power plants is essentially identical to that for nuclear power plants; however, the end state will be unique for each installation. In the case of a nuclear power plant, the end state to be achieved is typically to prevent core damage (i.e. to safely shut down the reactor and remove residual heat from irradiated fuel) and no early release. For nuclear installations other than nuclear power plants, an example end state to be achieved may be no leakage of aerosolized contaminants from a fuel processing facility. Once the desired end state is defined, the methodology for assessing the ability to achieve this end state should be selected among SPSA, PSA based SMA or SMA, presented in Sections 3 and 5 of this Safety Guide.

Seismic Hazard Category of a Nuclear Installation

6.4.For the purpose of seismic safety evaluation, each SSC that performs a seismic risk mitigating function should be assigned to a seismic category, which is a hierarchical category that denotes its importance in mitigating seismic hazard (see paras 3.31–3.40 of SSG-67 [8]). The seismic category assigned to the SSC is a function of the severity of adverse radiological and toxicological effects — on workers, the public and the environment — of the hazards that might result from the seismic failure of the SSC.⁴⁹49 A framework such as the one given in the Annex to this Safety Guide or in table 2 of SSG-67 [8] should be used in establishing the seismic design category of the nuclear installation. Additionally, Table A–1 in the Annex to this Safety Guide provides an example of criteria for use in determining the seismic design category.

6.5.A similar approach should be used to assign a nuclear installation to a hazard category as a function of the risk to workers, the public and the environment from a potential unmitigated radioactive release from the installation (see section 9 of SSG-9 (Rev. 1) [7]). Table A–1 in the Annex to this Safety Guide provides an example of possible hazard categories (high, moderate and low).

6.6.A conservative screening process should be undertaken before categorizing a nuclear installation. In this process, it is assumed that the complete radioactive inventory of the installation would be released by a seismically initiated accident. If the screening demonstrates that there would be no unacceptable consequences for workers, the public or the environment, and no other specific requirements are imposed by the regulatory body for the nuclear installation in question, the installation may be screened out from the seismic safety evaluation. For equipment or tanks that need to be operated and/or maintained in controlled conditions (e.g. inert gloveboxes, high level waste storage tanks), the possible consequences (e.g. fire, explosion) of the failure of the controlled conditions should be considered in the screening process. If, even after such screening, some level of seismic safety evaluation is needed, national seismic codes for industrial facilities may be used.

6.7.If the results of the screening process show that the consequences of the unmitigated releases would be unacceptable, a seismic safety evaluation of the nuclear installation should be performed. For this purpose, the seismic hazard at the site should be determined, in accordance with the recommendations provided in paras 2.19–2.25. The seismic input for the safety evaluations should not be less than a peak ground acceleration of 0.1g at the free field or foundation level.

Selection of Performance Targets for Evaluation of Seismic Safety for Nuclear Installations Other than Nuclear Power Plants

6.8.A performance target — expressed as a mean annual frequency of failure due to the earthquake hazard — should be assigned to each of the seismic categories (see para. 6.4). The performance targets represent the acceptable calculated mean annual frequency of seismically induced failure of SSCs within a seismic category (see paras 3.31–3.40 of SSG-67 [8]). The failure of an SSC is associated with a particular failure mode and a limit state⁵⁰50. Table A–2 in the Annex to this Safety Guide provides an example of performance targets selected for different seismic design categories.

6.9.A performance target should also be defined for the nuclear installation as the maximum mean annual frequency of unacceptable performance of the installation due to the earthquake hazard (e.g. occurrence of unacceptable radioactive releases).

6.10.The overall performance of the nuclear installation (i.e. the annual frequency of failure) is the result of convolving the seismic hazard (hazard curves) with the installation level fragility (conditional probability of unacceptable installation behaviour for each level of earthquake severity). The installation level fragility results from the seismic capacities of the SSCs and it can be obtained from the SSCs using simple or more rigorous methods.⁵¹51 Therefore, appropriately defined seismic categories and performance targets for the SSCs within the installation should allow the performance target selected for the nuclear installation as a whole to be met.

6.11.According to para. 7.4 of SSG-67 [8], there is a correlation between the hazard level used for design, the seismic margin achieved by the design and the seismic performance target (referred to as ‘seismic performance goal’ in SSG-67 [8]). In this context, the minimum necessary seismic margin of the nuclear installation is related to the seismic design basis and the seismic performance target of the installation; the margin can be considered as a surrogate for the performance target.

Graded Approach for Achieving Selected Performance Targets in the Seismic Safety Evaluation of Nuclear Installations

6.12.A graded approach should be used for demonstrating that nuclear installations meet the performance targets (see para. 6.9) assigned to them. The level of rigour applied in the seismic safety evaluations should range from simple (for low hazard installations) to complex (for high hazard installations), as follows:

For low hazard installations, the seismic capacity evaluation methods for the selected SSCs may be based on simple but conservative static or equivalent static procedures, similar to those used for industrial hazardous facilities, in accordance with national practice and standards. Similarly, the seismic hazard to be used in these evaluations may be taken from national building codes and seismic hazard maps and does not need to be taken from a site specific probabilistic seismic hazard analysis. If a probabilistic seismic hazard analysis exists, however, the seismic hazard from that study may be used.
For selected SSCs of installations in the moderate hazard category, the seismic safety evaluation should typically be performed using the methodologies described in Section 5, but the corresponding performance target is set lower than for installations in the high hazard category (see Annex). Either the SMA, the SPSA or the PSA based SMA approach may be used, depending on the objective and scope of the seismic safety evaluation.
For selected SSCs of installations in the high hazard category, methodologies for seismic safety evaluation as described in Section 5 should be used (i.e. no application of a graded approach).

6.13. In a particular SSC, the performance target associated with a failure mode should be demonstrated by one of the following methods:

Showing compliance with a design code that was developed using a reliability based approach⁵²52. The design basis earthquake should be selected on the basis of an annual frequency of exceedance that is consistent with the performance target for the particular SSC.
Showing adequate seismic margin beyond a site specific reference level earthquake. The reference level earthquake should be selected on the basis of an annual frequency of exceedance that is consistent with the performance target for the particular SSC.
Explicitly computing the annual frequency of failure using SPSA. In this case, it is very important to use the ground motion from a site specific probabilistic seismic hazard analysis and to ensure that the SSCs important to safety have been properly categorized and the appropriate limit states have been defined.

7. Use of Seismic Safety Evaluation Results for Nuclear Installations Post-Earthquake Actions Based on the Seismic Safety Evaluation of Nuclear Installations

7.1.In the nuclear installation’s post-earthquake procedures, including emergency plans, procedures for post-earthquake inspections and plans for restart, the lessons learned in the seismic safety evaluation should be taken into consideration. As a result of the seismic safety evaluation, the operating organization and the regulatory body will have a better understanding of those SSCs that are important to seismic safety. They will also have a better understanding of any seismic weak links associated with the nuclear installation. All this information should be taken into account in the definition of post-earthquake actions.

Risk Informed Decisions Based on the Seismic Safety Evaluation of Nuclear Installations

7.2.A programme for the seismic safety evaluation of an existing nuclear installation may include identification of a subset of the selected SSCs that do not meet the established acceptance criteria. In this case, consideration should be given to technical upgrades or strengthening programmes. When making a decision about whether to implement upgrades or when strengthening programmes, the potential seismic risk reduction should be weighed against the implementation costs and time, taking into consideration the length of the remaining operating lifetime of the installation.

7.3.In many instances there are alternative solutions for reducing the potential seismic risk to an appropriate level, such as the following:

Reducing the inventory of radioactive material at risk to moderate or low levels so that less demanding performance targets can be met;
Strengthening the SSCs that limit a nuclear installation in meeting the minimum seismic margin or are significant risk contributors;
Hardening the primary containment so that the inventory of radioactive material at risk — for which the unmitigated radioactive release amount was calculated — is reduced.

Regardless of the option taken, the associated risk reduction should be able to be quantitively calculated. This risk reduction will come in the form of an increase in the computed margin if the SMA methodology was used, or in the form of a decrease in the annual frequency of failure of the selected SSCs if the SPSA methodology was used.

7.4.The cost associated with each option should also be quantified. A risk informed decision should take into account both the cost and the potential seismic risk reduction of each option. Options that are easy to implement and have an appropriate cost should be given preference. For options that are very costly and involve very little risk reduction, the operating organization of the nuclear installation should work with the regulatory body to determine whether the benefits are sufficient to outweigh the costs.

Design of Modifications to Existing Nuclear Installations Based on the Seismic Evaluation

7.5.In accordance with SSR-2/1 (Rev. 1) [3], SSR-3 [5] and SSR-4 [6], modifications to nuclear installations are required to be designed in accordance with recognized codes and standards and, at a minimum, with the original design standards. The design of upgrades should meet the design criteria and performance targets appropriate to the hazard category of the nuclear installation. Potential new seismic interactions introduced by new or modified SSCs should be assessed and eliminated to the extent practicable. More considerations relating to upgrades are presented in Ref. [10].

7.6.For the design of modifications, the seismic demand and the acceptance criteria should be established in compliance with the requirements of the regulatory body. When designing seismic upgrades, the available space and the working environment (e.g. radiation exposure) should be taken into consideration. Upgrade concepts should accommodate the existing configuration to the extent possible and should observe seismic interactions identified in the field inspection.

7.7.The type of upgrade selected for existing structures or substructures depends on the additional seismic capacity needed. The effects of the upgrade on interconnected systems and components (e.g. distribution systems) should be evaluated to verify that the upgrade enhances, rather than degrades, the overall seismic safety of the facility. Once the design of the selected upgrade is completed, the need for a dynamic analysis to generate new in-structure response spectra and displacements should be evaluated.

7.8.The type of upgrade selected for existing systems and components also depends on the additional seismic capacity needed. Generally, the following types of system and component upgrade should be considered:

Upgrade of anchorage, both for equipment and for supports in distribution systems;
Provision of additional lateral restraint for distribution systems;
Upgrade of electromechanical relays to models with larger seismic capacity;
Upgrade of critical components to models with larger seismic capacity.

7.9.When selecting an upgrade design, priority should be given to options that contribute more to the risk reduction of the installation and upgrades that cost less to implement.

Changes in Procedures Based on the Seismic Safety Evaluation of Nuclear Installations

7.10.Existing procedures for the inspection and maintenance of SSCs important to safety should be reviewed to ensure that the seismic capacity of the governing failure mode(s) for any SSC is not jeopardized as part of normal operations (e.g. placement of scaffolding or temporary access items that might seismically interact with items important to safety).

8. Management System for Seismic Safety Evaluation of Nuclear Installations Application of the Management System to the Seismic Safety Evaluation of Nuclear Installations

8.1.In accordance with para. 4.8 of IAEA Safety Standards Series No. GSR Part 2, Leadership and Management for Safety [23], a management system for a nuclear installation is required to be developed, applied and continuously improved. The management system should be applied for the establishment of the seismic safety evaluation programme (see also IAEA Safety Standards Series No. GS-G-3.1, Application of the Management System for Facilities and Activities [24]). The management system should cover all processes and activities of the seismic safety evaluation, including those relating to data collection and data processing, field and laboratory investigations, and the analyses and evaluations described in this Safety Guide. The management system should also cover processes and activities corresponding to the upgrading of the seismic safety evaluation programme.

8.2.Owing to the variety of investigations and analyses performed as part of the seismic safety evaluation and the need for engineering judgement by the evaluation team, specific technical procedures should be developed to facilitate the execution and verification of these tasks.

8.3.A peer review of the implementation of the seismic safety evaluation methodology should be performed and documented. In particular, the peer review should assess the elements of the implementation of the SMA, SPSA or PSAbased SMA methodologies against the recommendations of this Safety Guide and current international good practices used for these evaluations.

8.4.The peer review should be conducted by experts in the areas of systems engineering, operations (including fire prevention and protection specialists) and earthquake engineering, and by other specialists, depending on the focus of the seismic safety evaluation. Peer review should be performed at different stages in the evaluation process, as follows:

The peer review of systems and operations should be performed first, coinciding with the selection of the success paths for SMA or the tailoring of the internal event system models for SPSA or PSA based SMA.
Seismic capability peer reviews should be performed (i) during and after the walkdown and (ii) after most of the HCLPF values (for SMA or PSA based SMA) or fragility functions (for SPSA) for the SSCs have been calculated. The seismic capability peer review should include a limited plant walkdown, which may coincide with part of the plant walkdown or may be performed separately.

The findings of the peer reviews should be documented.

8.5.A graded approach should be used for the application of the management system to the seismic safety evaluation of nuclear installations other than nuclear power plants. The graded approach should apply to areas such as processes and activities of the seismic safety evaluation, development of technical procedures for specific tasks, and peer review of the implementation of the seismic safety evaluation. In general, the application of management system requirements should be most stringent for nuclear installations with a high hazard category and least stringent for nuclear installations with a lower hazard category (see also IAEA Safety Standards Series No. GS-G-3.5, The Management System for Nuclear Installations [25]).

Documentation and Records for Seismic Safety Evaluation of Nuclear Installations

8.6.An important component of the management system is the definition of the documentation and records to be developed during seismic safety evaluation and of the final report to be produced as a result of the evaluation. Detailed documentation should be retained for review and future use.

8.7.The results of the seismic safety evaluation should typically be documented in a report containing the following:

Methodology and assumptions of the assessment;
Selection of the reference level earthquake(s);
Composition and credentials of the evaluation team;
Verification of the geological stability of the site (see para. 2.19(a));
Success path(s) selected, justification or reasoning for the selection, HCLPF and governing components of the success path(s) (for SMA);
Summary of system models and the modifications introduced to the internal event models for SPSA and PSA based SMA;
Table of selected SSC items showing the results of the screening process (if any), failure modes, seismic demand, HCLPF values (for SMA and PSA based SMA) and fragility functions (for SPSA);
For SPSA, results of the quantification of the sequence analysis, including core damage frequency, dominant core damage sequences, large early release frequency or containment failure frequency, and dominant sequences for failures of the confinement function;
Summary of seismic failure functions for prevention and mitigation, including the front line systems and support systems modelled in SPSA, and identification of critical components, if any, for SPSA;
Walkdown report summarizing any findings and observations;
Operator actions needed and the evaluation of their likely success;
Containment structure and system HCLPFs or fragility functions (if needed);
Treatment of non-seismic failures, relay chatter, dependences and seismically induced fire and flood;
Peer review reports.

8.8.In addition to the above information, the following detailed information should be retained:

Detailed system descriptions used in developing the success path(s), system notebooks and other data (for SMA);
Detailed documentation of the development of the SPSA and PSA based SMA models, in particular those aspects pertaining to the modifications of the internal event PSA models to account for seismic events;
Detailed documentation of all walkdowns performed — including SSC identification and characteristics, results of screening process (if appropriate), spatial interaction observations for the seismic system — and of area walkdowns usually performed for systems such as cable trays and small bore piping and for the evaluation of seismically induced fire or flood issues;
HCLPF (for SMA and PSA based SMA) or fragility function (for SPSA) calculation packages for all selected SSCs; (e) New or modified plant operating procedures for the achievement of success paths; (f) List of records and their retention times.

Management of Modifications for Seismic Safety of Nuclear Installations

8.9.The operating organization should implement a programme for the management of modifications to ensure that, in the future, the design and construction of modifications to SSCs; the replacement of SSCs; maintenance programmes and procedures; and operating procedures do not invalidate the results of the seismic safety evaluation.

Appendix I - Seismic Failure Mode Considerations for Structures, Systems and Components in Nuclear Installations

A.1.The failure mode considerations identified in this Appendix are typical of common classes of SSCs in nuclear installations, in accordance with experience from previous safety evaluations. These failure modes, if applicable, should be reviewed and used to inform the seismic evaluation walkdown and seismic capacity evaluations.

Seismic Failure Modes for Buildings and Structures in Nuclear Installations

A.2.There are multiple potential structural failures in buildings and complex structures. Only those failure modes that might lead to accident progression to an unacceptable end state should be considered in the seismic safety evaluation. The experience of qualified seismic capability engineers is essential in determining the potential failure modes of interest. This experience should be informed by the seismic evaluation walkdown and the review of structural drawings and previous evaluations. The seismic failure modes for buildings and structures in nuclear installations may be broadly classified as follows:

Local failures of structural components that undermine the support of SSCs important to safety;
Major failures of structural components that lead to unacceptable deformations, misalignments and other causes of damage or loss of function for supported SSCs;
Major failures of structural components that lead to severe damage or collapse;
Global structure instability (e.g. sliding, overturning, foundation bearing failure);
Failures of structures that are part of containment or confinement systems, which might lead to a radioactive release.

A.3.Relative movements between adjacent structures should be considered with respect to the existing separations and to whether the structures are constructed on common or separate foundations. The associated potential failure modes may be classified as follows:

Major failure of one structure due to impact from a significantly heavier structure;
Local failures in the structure exteriors due to impact (e.g. punching of walls);
Failures of chatter sensitive electrical components due to impact between structures;
Failures of other shock sensitive SSCs or SSC supports in the vicinity of impact;
Failures of distribution systems or their supports due to relative movements between adjacent structures.

A.4.The seismic capacity evaluation of structures should be based on available construction information. The review of the structures during the walkdown should focus on supplementing this information with as-built observations, including in relation to the following:

Potential signs of degradation or distress, such as corrosion, exposure of reinforcement and concrete spalling;
Records of structure connections that appear to be field modified from standard connections;
Measurements of interface separations between buildings and description of gap filler materials, if present;
Survey of equipment that enables the estimation of temporary loading during maintenance or refuelling conditions;⁵³53
Survey of as-built versus as-designed bulk storage spaces (mass capacity), roof equipment and roofing materials.

Seismic Failure Modes for Mechanical Equipment in Nuclear Installations

A.5.Mechanical equipment in nuclear installations typically includes process equipment, pumps, tanks and heat exchangers, fans and air handlers, and valves. The review of the seismic capacity of these items should include their anchorage, support structure, mounting configuration, construction and ability to function. Some damage to the equipment is tolerable if it does not compromise the equipment’s ability to perform its credited function (e.g. active function) or its leaktightness or structural integrity. The functional assessment should include time considerations, such as whether a component is needed to operate during or after earthquake shaking and for how long without outside support. The assessment should also include potential seismic interactions and the flexibility of attached distribution system lines.

A.6.For the review of mechanical equipment with considerable oil content, potential failure modes that might result in oil leakage and subsequent fire (e.g. breakage of oil level sight glass monitors on pumps) should be considered.

A.7.Mechanical equipment with substantial piping (e.g. tanks, heat exchangers, pumps) should also be reviewed for potential nozzle loads from the inertia of the attached piping.

A.8.For the review of mechanical equipment supported on vibration isolators, the potential failure of the isolators owing to shaking induced displacement should be considered.

A.9.The mountings of valves and pump shafts supported independently from the attached piping and pumps, respectively, should be reviewed for potential differential motion failures.

Seismic Failure Modes for Electrical Equipment in Nuclear Installations

A.10.Electrical equipment includes instrumentation and control panels, switchgears, transformers, inverters, generators and batteries. The review of the seismic capacity of electrical equipment should include the same considerations as for mechanical equipment, identified in paras A.5 and A.6. Many types of electrical equipment are typically vulnerable to spray (e.g. from overhead fire protection sprinklers).

A.11.The review of electrical cabinets should include checking whether the internal instruments and components are positively and securely attached inside the enclosure and whether their mountings are stiff or flexible. If the internal instruments and components are on a structure that can be pulled out of the cabinet for maintenance, the amplification of seismic motion due to this structure should be given particular attention.

A.12.The review of electrical cabinets that contain chatter sensitive components should include checking whether the cabinets are adequately spaced and whether they are bolted to the adjacent cabinets to prevent pounding.

A.13.The review of diesel generators should include the exhaust and ventilation systems.

A.14.The review of batteries should include checking whether they are adequately spaced and restrained. Inadequately spaced and restrained batteries might become damaged by shaking and might damage other nearby components through the spillage of acid.

Seismic Failure Modes for Individual Instruments and Devices in Nuclear Installations

A.15.Local instruments and passive elements in nuclear installations are usually seismically rugged SSCs. For the review of their seismic capacity, the adequacy of the mounting, the flexibility of the attached lines, and potential spatial interactions should be considered. The consequences of failure for the SSC function of interest (e.g. potential breakage of the glass cover on the reporting dial of a sensor) should also be considered.

A.16.Chatter sensitive devices may include electromagnetic relays, switchgear circuit breakers, motor starters, and indicator switches for temperature, pressure, level or flow. The review of the seismic capacity of chatter sensitive devices should include the seismic qualification of the device model, the height and means of attachment to the equipment component that hosts the device, and any spatial interaction concerns that might affect the host component or the device directly. Chatter sensitive devices are typically very sensitive to transmitted shock waves resulting from impact or pounding. The chatter of these devices may be recoverable through operator actions. If these operator actions are credited, an evaluation of the reliability of the actions after the earthquake, the time available to successfully implement the actions and the associated travel paths should be included in the review.

Seismic Failure Modes for Distribution Systems in Nuclear Installations

A.17.Distribution systems include piping, sampling points, cable trays and conduits, and ducting. These systems typically have high seismic capacities due to their relatively light weight and substantial ductility, since yielding in itself does not prevent the performance of their safety function. The seismic capacity review of distribution systems should be performed on an area basis (e.g. in a room or corridor) and include representative configurations identified to be potentially vulnerable during the seismic evaluation walkdown (see para. 5.31). Seismically vulnerable conditions include the following:

Differential motion between supports or attachment points;
Flexible supports and other details that might allow large seismic displacements;
Weak or brittle connections, supports or anchorage;
Long flexible runs connected to stiff branch lines or supports;
Excessively loaded supports (e.g. multiple or overfilled cable trays or long spans);
Degradation and corrosion.

Seismic Interaction Considerations for Failure of Structures, Systems and Components in Nuclear Installations

A.18.Common sources of spatial interaction include pounding between adjacent SSCs or their support structures, masonry walls, unsecured light fixtures, unanchored objects, overhead cranes, suspended ceilings and temporary structures (e.g. scaffolding) left in place. The seismic capacity review of potential spatial interaction sources should consider both the credibility and the consequences of the interaction. For example, a falling hazard from an unsecured lightweight overhead light fixture will have no consequence for an electrical cabinet that contains no soft targets or chatter sensitive devices, so it does not need to be explicitly evaluated.

A.19.For the review of seismic–fire interactions, the ignition sources previously identified in the internal fire safety assessment should be considered. Only those ignition sources that might be initiated by seismically induced failure modes should be considered. This review should also include (a) potential failure modes of items on the list of selected SSCs that might lead to ignition of a fire that spreads to adjacent SSCs and (b) additional SSCs identified during the area based seismic evaluation walkdowns as potential ignition sources (e.g. non-safety-related high voltage electrical cabinets or transformers) in proximity to any of the selected SSCs. The fire area affected by each potential ignition source should be determined by the systems engineer, taking into consideration the presence of combustibles, fire protection and possible spread owing to the failure of boundaries.

A.20.For the review of seismic–flood interactions, the flood sources previously identified in the internal flood safety assessment should be considered. Only those flood sources that might be initiated by seismically induced failure modes should be considered. This review should also include (a) potential failure modes of items on the list of selected SSCs that might lead to a flood that spreads to adjacent SSCs and (b) additional SSCs identified during the area based seismic evaluation walkdowns as potential flood sources (e.g. unanchored tanks, non-ductile piping, non-safety-related heat exchangers) that might affect any of the selected SSCs. The flood area affected by each potential source should be determined by the systems engineer, taking into consideration the volume of released fluid, flow paths within a floor plan and from higher to lower elevations within a building, potential barriers or path diversions inside the building, and the configurations of the SSCs in the flooded areas.

A.21.For the review of seismic–flood and seismic–spray interactions, the seismic vulnerabilities of the fire protection systems, overhead rainwater drainage lines and other non-ductile piping should be considered. Experience has shown that fire protection systems are susceptible to seismically induced shaking. Known vulnerabilities of fire protection systems include mechanical couplings, threaded pipe connections, easy to damage sprinkler heads (i.e. damage by impact with adjacent objects) in wet systems and inadvertent actuation of dry systems. The seismic capacity review of fire protection systems should be performed on an area basis, as described for distribution systems in para. A.17, in particular taking into consideration the proximity of known seismically deficient system components to spray sensitive SSCs.

Operator Travel Paths

A.22.In order to review seismic capacities, the expected movements necessary to execute operator actions credited in the seismic safety evaluation should be understood, and seismically induced failures that might impede access to, travel along or egress from these paths should be taken into consideration. Common potential impediments to travel include masonry walls that might collapse and block a pathway, normally shut doors that might be distorted owing to seismic damage and rendered unopenable, seismically induced fire and flood along the travel path, and blocked access to tool storage locations.

A.23.If outside help is credited in the safety evaluation, the seismic capacity review should also consider potential failures along additional travel paths that are needed for the arrival and deployment of this help within the necessary time. Examples include critical highway bridges, road junctions, access roads to the nuclear installation and entry points to the buildings.

Specific Considerations for Seismic Failre Modes for Nuclear Power Plants

A.24.An explicit evaluation of the seismic capacity of the primary reactor system and components should be performed. A review of the design documentation and previous evaluations should be performed to identify credible seismically induced failure modes. The candidate failure modes should be evaluated using the seismic demands of the reference level earthquake to identify the governing failure mode or modes. Several governing failure modes may be identified that lead to different consequences for the installation end state.

A.25.The seismic capacity of the primary (and secondary, if applicable) containment should be explicitly evaluated. All credible seismically induced failure modes that might lead to a loss of structural integrity in the containment pressure boundary should be included.

Non-Vibration Ground Motion Induced Failures in Nuclear Installations

A.26.Potential SSC failure modes due to geotechnical failure hazards that could not be screened out (see paras 2.19 and 5.11) should be considered in the seismic evaluation walkdown and seismic capacity review. The corresponding seismic demands are typically permanent displacements rather than accelerations. The seismic capacity review of the affected SSCs should focus on the capacity of the SSCs to perform their credited functions when subjected to the imposed displacements. This capacity will typically depend on the flexibility and ductility of the attached distribution systems, which should, if feasible, be assessed during seismic evaluation walkdowns. Particular attention should be paid to the following conditions that might affect the distribution systems:

Settlement of structure foundations due to liquefaction, groundwater drawdown or dry sand compaction, which might result in the failure of buried distribution systems at their interface with the structure;
Relative vertical displacements between adjacent structures due to differential settlement, which might result in the failure of interconnecting distribution systems;
Differential settlements under the foundations of a structure, which might result in the permanent distortion of, or internal damage to, structural components and/or failures of attached lines;
Slope displacements and potential instabilities, which might result in the failure of buried and above ground lines and of SSCs below the slope;
Fault rupture, subsidence and lateral spreading displacements, which might result in the failure of buried and above ground lines and of SSCs spanning the ground displacement zone.

A.27.Potential SSC failure modes due to concomitant phenomena that could not be screened out (see paras 2.19 and 5.11) should be considered in the seismic evaluation walkdown and seismic capacity review, for example, as follows:

The seismic capacity of an upstream dam whose breach might result in flooding of the nuclear installation site should be explicitly evaluated. This seismic capacity should be mapped to the consequences for the installation in accordance with SSG-18 [13], considering the vulnerability of individual SSCs to the flood level and the lower reliability of emergency response procedures in the combined aftermath of earthquake and flood.
The assessment of the consequences of a tsunami hazard for the safety functions of a nuclear installation located near the coastline should include an evaluation of the potential malfunctioning of equipment located at a low level (e.g. seawater pumps), in accordance with SSG-18 [13] and IAEA Safety Standards Series No. SSG-68, Design of Nuclear Installations Against External Events Excluding Earthquakes [26].
The seismic stability of geographic features close to the nuclear installation site (e.g. slopes that might trigger a landslide, a rockfall event that might affect the installation site) should be explicitly evaluated. The consequences of these geographic features for the installation’s safety related functions should be assessed, considering the discharge along the failure path and the distance to the installation. (d) The potential for seismic failures in adjacent nuclear and industrial installations that might affect the nuclear installation in question should be identified during the walkdown and reported for further assessment.

References

INTERNATIONAL ATOMIC ENERGY AGENCY, Safety Assessment for Facilities and Activities, IAEA Safety Standards Series No. GSR Part 4 (Rev. 1), IAEA, Vienna (2016).
INTERNATIONAL ATOMIC ENERGY AGENCY, Site Evaluation for Nuclear Installations, IAEA Safety Standards Series No. SSR-1, IAEA, Vienna (2019).
INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Nuclear Power Plants: Design, IAEA Safety Standards Series No. SSR-2/1 (Rev. 1), IAEA, Vienna (2016).
INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Nuclear Power Plants: Commissioning and Operation, IAEA Safety Standards Series No. SSR-2/2 (Rev. 1), IAEA, Vienna (2016).
INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Research Reactors, IAEA Safety Standards Series No. SSR-3, IAEA, Vienna (2016).
INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Nuclear Fuel Cycle Facilities, IAEA Safety Standards Series No. SSR-4, IAEA, Vienna (2017).
INTERNATIONAL ATOMIC ENERGY AGENCY, Seismic Hazards in Site Evaluation for Nuclear Installations, IAEA Safety Standards Series No. SSG-9 (Rev. 1), IAEA, Vienna (2022).
INTERNATIONAL ATOMIC ENERGY AGENCY, Seismic Design for Nuclear Installations, IAEA Safety Standards Series No. SSG-67, IAEA, Vienna (2021).
INTERNATIONAL ATOMIC ENERGY AGENCY, Geotechnical Aspects of Site Evaluation and Foundations for Nuclear Power Plants, IAEA Safety Standards Series No. NS-G-3.6, IAEA, Vienna (2004).
INTERNATIONAL ATOMIC ENERGY AGENCY, Methodologies for Seismic Safety Evaluation of Existing Nuclear Installations, Safety Reports Series No. 103, IAEA, Vienna (2020).
INTERNATIONAL ATOMIC ENERGY AGENCY, IAEA Nuclear Safety and Security Glossary: Terminology Used in Nuclear Safety, Nuclear Security, Radiation Protection and Emergency Preparedness and Response, 2022 (Interim) Edition, IAEA, Vienna (2022).
INTERNATIONAL ATOMIC ENERGY AGENCY, Format and Content of the Safety Analysis Report for Nuclear Power Plants, IAEA Safety Standards Series No. SSG-61, IAEA, Vienna (2021).
INTERNATIONAL ATOMIC ENERGY AGENCY, WORLD METEOROLOGICAL ORGANIZATION, Meteorological and Hydrological Hazards in Site Evaluation for Nuclear Installations, IAEA Safety Standards Series No. SSG-18, IAEA, Vienna (2011).
INTERNATIONAL ATOMIC ENERGY AGENCY, Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power Plants, IAEA Safety Standards Series No. SSG-3 (Rev. 1), IAEA, Vienna (in press).
INTERNATIONAL ATOMIC ENERGY AGENCY, Radiation Protection Aspects of Design for Nuclear Power Plants, IAEA Safety Standards Series No. SSG-90, IAEA, Vienna (in preparation).
INTERNATIONAL ATOMIC ENERGY AGENCY, Technical Approach to Probabilistic Safety Assessment for Multiple Reactor Units, Safety Reports Series No. 96, IAEA, Vienna (2019).
INTERNATIONAL ATOMIC ENERGY AGENCY, Multi-unit Probabilistic Safety Assessment, Safety Reports Series No. 110, IAEA, Vienna (2023).
INTERNATIONAL ATOMIC ENERGY AGENCY, Earthquake Preparedness and Response for Nuclear Power Plants, Safety Reports Series No. 66, IAEA, Vienna (2011).
INTERNATIONAL ATOMIC ENERGY AGENCY, Periodic Safety Review for Nuclear Power Plants, IAEA Safety Standards Series No. SSG-25, IAEA, Vienna (2013).
INTERNATIONAL ATOMIC ENERGY AGENCY, Ageing Management and Development of a Programme for Long Term Operation of Nuclear Power Plants, IAEA Safety Standards Series No. SSG-48, IAEA, Vienna (2018).
INTERNATIONAL ATOMIC ENERGY AGENCY, Development and Application of Level 2 Probabilistic Safety Assessment for Nuclear Power Plants, IAEA Safety Standards Series No. SSG-4, IAEA, Vienna (2010).
INTERNATIONAL ATOMIC ENERGY AGENCY, Human Reliability Analysis for Nuclear Installations, IAEA, Vienna (in preparation).
INTERNATIONAL ATOMIC ENERGY AGENCY, Leadership and Management for Safety, IAEA Safety Standards Series No. GSR Part 2, IAEA, Vienna (2016).
INTERNATIONAL ATOMIC ENERGY AGENCY, Application of the Management System for Facilities and Activities, IAEA Safety Standards Series No. GS-G-3.1, IAEA, Vienna (2006).
INTERNATIONAL ATOMIC ENERGY AGENCY, The Management System for Nuclear Installations, IAEA Safety Standards Series No. GS-G-3.5, IAEA, Vienna (2009).
INTERNATIONAL ATOMIC ENERGY AGENCY, Design of Nuclear Installations Against External Events Excluding Earthquakes, IAEA Safety Standards Series No. SSG-68, IAEA, Vienna (2021).

[9] NS-G-3.6 has been revised and is now superseded by SSG-93 Geotechnical Aspects in the Siting and Design of Nuclear Installations

[14] SSG-3 (Rev. 1) Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power Plants has been published.

[21] SSG-4 has been revised and is now superseded by SSG-4 (Rev. 1) Development and Application of Level 2 Probabilistic Safety Assessment for Nuclear Power Plants

Annex I - Example of Criteria for Defining Seismic Design Classes and Performance Targets in Nuclear Installations
Seismic Design Classes for Structures, Systems and Components in Nuclear Installations
A–1.Table A–1 provides an example of criteria for defining seismic design classes⁵⁴54 of structures, systems and components (SSCs) in a nuclear installation, taken from the practice of one Member State (United States of America) [A–1]. SSCs with a safety function are assigned to one of the five seismic design classes given in the table on the basis of the unmitigated consequences that might result from the failure of the SSC by itself or in combination with other SSCs.
A–2.A similar approach has been used to categorize nuclear installations into high (seismic design classes 4 and 5), moderate (seismic design class 3) and low (seismic design classes 1 and 2) hazard categories, in accordance with the risk to the public, workers or the environment from a potential unmitigated radioactive release [A–1]. These hazard categories are also shown in Table A–1.
Table. I-1. SEISMIC DESIGN CLASS BASED ON THE UNMITIGATED CONSEQUENCES OF FAILURE [A–1] (courtesy of the American Nuclear Society)
Seismic design class
Hazard category
Unmitigated consequences of failure
Worker
Public
Environment
1^a
Low
No radiological or toxicological release consequences, but failure of SSCs may place facility workers at risk of physical injury
No radiological or toxicological release consequences
No radiological or toxicological release consequences
2^a
Radiological/ toxicological exposures of workers will have no permanent health effects, may place more facility workers at risk of physical injury or may place emergency operations at risk
Radiological/ toxicological exposures of public areas are small enough to require no public warnings concerning health effects
No radiological or chemical environmental consequences
3
Moderate
Radiological/ toxicological exposures that may place facility workers’ long term health^b in question
Radiological/ toxicological exposures of public areas would not be expected to cause health consequences but may require emergency plans to assure protections
No long term environmental consequences are expected, but environmental monitoring may be required for a period of time
4
High
Radiological/ toxicological exposures that may cause long term health problems and possible loss of life for a worker in proximity to the source of hazardous material or place workers in nearby on-site facilities at risk
Radiological/ toxicological exposures that may cause long term health problems to an individual at the exclusion area boundary for two hours
Environmental monitoring required and potential temporary exclusion from selected areas for contamination removal
5
Radiological/ toxicological exposures that may cause loss of life of workers in the facility
Radiological/ toxicological exposures that may possibly cause loss of life to an individual at the exclusion area boundary for an exposure of two hours
Environmental monitoring required and potentially permanent exclusion from selected areas of contamination
^a ‘No radiological or toxicological releases’ and ‘no radiological or toxicological consequences’ mean that material releases that cause health or environment concerns are not expected to occur from failures of SSCs assigned to seismic design classes 1 or 2.
^b The term ‘long term health problems’ in the context of radiation exposure corresponds to the term ‘stochastic effects’ (see Ref. [A–2]).

A–3.A performance target is a selected annual frequency of failure due to the earthquake hazard. Performance targets are linked to seismic design classes for SSCs. Table A–2 shows an example of selected performance targets taken from the practice of one Member State (United States of America) [A–2].
A–4.In Table A–2, the performance targets range from the annual frequency of failure (P_{f_{) assumed for normal building structures in some Member States (i.e. about P_{f_{= 10⁻³ per year) to a frequency approaching the mean core damage frequency for seismically induced core melt that is considered acceptable in some Member States (i.e. about P_{f_{= 10⁻⁵ per year). The performance targets for the intermediate seismic categories are between these two values.}}}}}}
Table. I-2. EXAMPLE OF PERFORMANCE TARGETS [A–2] (courtesy of the American Society of Civil Engineers)
Seismic design class
Hazard category
Performance target^a (a⁻¹)
1
Low
<1 × 10⁻³
2
<4 × 10⁻⁴
3
Moderate
~1 × 10⁻⁴
4
High
~4 × 10⁻⁵
5
~1 × 10⁻⁵
^a Annual probability.
REFERENCES TO ANNEX
[A–1] AMERICAN NUCLEAR SOCIETY, Categorization of Nuclear Facility Structures, Systems, and Components for Seismic Design, ANSI/ANS 2.26-2004 (R2010, R2017), ANS, La Grange Park, IL (2017).
[A–2] AMERICAN SOCIETY OF CIVIL ENGINEERS, Seismic Design Criteria for Structures, Systems, and Components in Nuclear Facilities, ASCE/SEI 43-19, ASCE, Reston, VA (2019).
Table Of Contents
Table Of Contents
Table Of Contents1. Introduction
1. Introduction  #
TOC \z \h1. IntroductionPAGE#Background
Background  #
BackgroundPAGE#Objective
Objective  #
ObjectivePAGE#Scope
Scope  #
ScopePAGE#Structure
Structure  #
StructurePAGE#2. General Considerations for the Evaluation of Seismic Safety for Nuclear Installations
2. General Considerations for the Evaluation of Seismic Safety for Nuclear Installations  #
2. General Considerations for the Evaluation of Seismic Safety for Nuclear InstallationsPAGE#Safety Requirements Applicable to Seismic Safety Evaluation
Safety Requirements Applicable to Seismic Safety Evaluation  #
Safety Requirements Applicable to Seismic Safety EvaluationPAGE#Safety assessment
Safety assessment  #
Safety assessmentPAGE#Hazard assessment
Hazard assessment  #
Hazard assessmentPAGE#Margin provided by the design
Margin provided by the design  #
Margin provided by the designPAGE#Effects of changes during operation
Effects of changes during operation  #
Effects of changes during operationPAGE#General Concepts for Seismic Safety Evaluation of Nuclear Installations
General Concepts for Seismic Safety Evaluation of Nuclear Installations  #
General Concepts for Seismic Safety Evaluation of Nuclear InstallationsPAGE#Reasons to Perform Seismic Safety Evaluation
Reasons to Perform Seismic Safety Evaluation  #
Reasons to Perform Seismic Safety EvaluationPAGE#New nuclear installations
New nuclear installations  #
New nuclear installationsPAGE#Existing nuclear installations
Existing nuclear installations  #
Existing nuclear installationsPAGE#Consideration of Relevant Aspects Related to Seismic Hazard
Consideration of Relevant Aspects Related to Seismic Hazard  #
Consideration of Relevant Aspects Related to Seismic HazardPAGE#Evaluation of Seismic Safety for Sites with Multiple Nuclear Installations
Evaluation of Seismic Safety for Sites with Multiple Nuclear Installations  #
Evaluation of Seismic Safety for Sites with Multiple Nuclear InstallationsPAGE#Consideration of Seismic Safety Evaluation at the Design Stage
Consideration of Seismic Safety Evaluation at the Design Stage  #
Consideration of Seismic Safety Evaluation at the Design StagePAGE#Consideration of Seismic Safety Evaluation at the Licensing Stage
Consideration of Seismic Safety Evaluation at the Licensing Stage  #
Consideration of Seismic Safety Evaluation at the Licensing StagePAGE#3. Selection of Methodology for the Evaluation of Seismic Safety
3. Selection of Methodology for the Evaluation of Seismic Safety  #
3. Selection of Methodology for the Evaluation of Seismic SafetyPAGE#Seismic Margin Assessment
Seismic Margin Assessment  #
Seismic Margin AssessmentPAGE#Probabilistic Safety Assessment Based Seismic Margin Assessment
Probabilistic Safety Assessment Based Seismic Margin Assessment  #
Probabilistic Safety Assessment Based Seismic Margin AssessmentPAGE#Seismic Probabilistic Safety Assessment
Seismic Probabilistic Safety Assessment  #
Seismic Probabilistic Safety AssessmentPAGE#Application of Methodology to New or Existing Nuclear Installations
Application of Methodology to New or Existing Nuclear Installations  #
Application of Methodology to New or Existing Nuclear InstallationsPAGE#4. Data Collection and Investigations for the Evaluation of seismic Safety for Nuclear Installations
4. Data Collection and Investigations for the Evaluation of seismic Safety for Nuclear Installations  #
4. Data Collection and Investigations for the Evaluation of seismic Safety for Nuclear InstallationsPAGE#Data and Documentation on the Design Basis
Data and Documentation on the Design Basis  #
Data and Documentation on the Design BasisPAGE#General documentation for a nuclear installation
General documentation for a nuclear installation  #
General documentation for a nuclear installationPAGE#Specific documentation for the SSCs included in the seismic safety evaluation
Specific documentation for the SSCs included in the seismic safety evaluation  #
Specific documentation for the SSCs included in the seismic safety evaluation
PAGE#Seismic design basis
Seismic design basis  #
Seismic design basisPAGE#Soil–structure interaction, structural modelling and in‑structure response details
Soil–structure interaction, structural modelling and in‑structure response details  #
Soil–structure interaction, structural modelling and in‑structure response details
PAGE#Additional Data and Investigations for Existing Nuclear Installations
Additional Data and Investigations for Existing Nuclear Installations  #
Additional Data and Investigations for Existing Nuclear InstallationsPAGE#Current (as‑is condition) data and information
Current (as‑is condition) data and information  #
Current (as‑is condition) data and informationPAGE#Investigation of subsoil data and earthquake experience
Investigation of subsoil data and earthquake experience  #
Investigation of subsoil data and earthquake experiencePAGE#Investigation of data on building structures
Investigation of data on building structures  #
Investigation of data on building structuresPAGE#Investigation of data on piping and equipment
Investigation of data on piping and equipment  #
Investigation of data on piping and equipmentPAGE#5. Evaluation of Seismic Safety for Nuclear Installations, with a Focus on Nuclear Power Plants
5. Evaluation of Seismic Safety for Nuclear Installations, with a Focus on Nuclear Power Plants  #
5. Evaluation of Seismic Safety for Nuclear Installations, with a Focus on Nuclear Power PlantsPAGE#Assessment of Seismic Hazards
Assessment of Seismic Hazards  #
Assessment of Seismic HazardsPAGE#Seismic hazard assessment approach
Seismic hazard assessment approach  #
Seismic hazard assessment approachPAGE#Development of the reference level earthquake
Development of the reference level earthquake  #
Development of the reference level earthquakePAGE#Characterization of vibratory ground motions
Characterization of vibratory ground motions  #
Characterization of vibratory ground motionsPAGE#Characterization of other seismically induced hazards
Characterization of other seismically induced hazards  #
Characterization of other seismically induced hazardsPAGE#Implementation Guidelines Common to all Seismic Safety Assessment Methodologies
Implementation Guidelines Common to all Seismic Safety Assessment Methodologies  #
Implementation Guidelines Common to all Seismic Safety Assessment Methodologies
PAGE#Scope of the seismic safety evaluation
Scope of the seismic safety evaluation  #
Scope of the seismic safety evaluationPAGE#Preparation of the list of selected SSCs
Preparation of the list of selected SSCs  #
Preparation of the list of selected SSCsPAGE#Seismic evaluation walkdown
Seismic evaluation walkdown  #
Seismic evaluation walkdownPAGE#Considerations on Seismic Capability for Defence in Depth Level 4
Considerations on Seismic Capability for Defence in Depth Level 4  #
Considerations on Seismic Capability for Defence in Depth Level 4PAGE#Implementation of Seismic Margin Assessment
Implementation of Seismic Margin Assessment  #
Implementation of Seismic Margin AssessmentPAGE#Determination of seismic responses
Determination of seismic responses  #
Determination of seismic responsesPAGE#Determination of HCLPF capacities for the selected SSCs and the nuclear installation
Determination of HCLPF capacities for the selected SSCs and the nuclear installation  #
Determination of HCLPF capacities for the selected SSCs and the nuclear installation
PAGE#Considerations for nuclear power plants
Considerations for nuclear power plants  #
Considerations for nuclear power plantsPAGE#Implementation of Probabilistic Safety Assessment Based Seismic Margin Assessment
Implementation of Probabilistic Safety Assessment Based Seismic Margin Assessment  #
Implementation of Probabilistic Safety Assessment Based Seismic Margin Assessment
PAGE#Implementation of Seismic Probabilistic Safety Assessment
Implementation of Seismic Probabilistic Safety Assessment  #
Implementation of Seismic Probabilistic Safety AssessmentPAGE#6. Evaluation of Seismic Safety for Nuclear Installations Other than Nuclear Power Plants
6. Evaluation of Seismic Safety for Nuclear Installations Other than Nuclear Power Plants  #
6. Evaluation of Seismic Safety for Nuclear Installations Other than Nuclear Power PlantsPAGE#Seismic Hazard Category of a Nuclear Installation
Seismic Hazard Category of a Nuclear Installation  #
Seismic Hazard Category of a Nuclear InstallationPAGE#Selection of Performance Targets for Evaluation of Seismic Safety for Nuclear Installations Other than Nuclear Power Plants
Selection of Performance Targets for Evaluation of Seismic Safety for Nuclear Installations Other than Nuclear Power Plants  #
Selection of Performance Targets for Evaluation of Seismic Safety for Nuclear Installations Other than Nuclear Power PlantsPAGE#Graded Approach for Achieving Selected Performance Targets in the Seismic Safety Evaluation of Nuclear Installations
Graded Approach for Achieving Selected Performance Targets in the Seismic Safety Evaluation of Nuclear Installations  #
Graded Approach for Achieving Selected Performance Targets in the Seismic Safety Evaluation of Nuclear InstallationsPAGE#7. Use of Seismic Safety Evaluation Results for Nuclear Installations
7. Use of Seismic Safety Evaluation Results for Nuclear Installations  #
7. Use of Seismic Safety Evaluation Results for Nuclear InstallationsPAGE#Post-Earthquake Actions Based on the Seismic Safety Evaluation of Nuclear Installations
Post-Earthquake Actions Based on the Seismic Safety Evaluation of Nuclear Installations  #
Post-Earthquake Actions Based on the Seismic Safety Evaluation of Nuclear Installations
PAGE#Risk Informed Decisions Based on the Seismic Safety Evaluation of Nuclear Installations
Risk Informed Decisions Based on the Seismic Safety Evaluation of Nuclear Installations  #
Risk Informed Decisions Based on the Seismic Safety Evaluation of Nuclear Installations
PAGE#Design of Modifications to Existing Nuclear Installations Based on the Seismic Evaluation
Design of Modifications to Existing Nuclear Installations Based on the Seismic Evaluation  #
Design of Modifications to Existing Nuclear Installations Based on the Seismic Evaluation
PAGE#Changes in Procedures Based on the Seismic Safety Evaluation of Nuclear Installations
Changes in Procedures Based on the Seismic Safety Evaluation of Nuclear Installations  #
Changes in Procedures Based on the Seismic Safety Evaluation of Nuclear Installations
PAGE#8. Management System for Seismic Safety Evaluation of Nuclear Installations
8. Management System for Seismic Safety Evaluation of Nuclear Installations  #
8. Management System for Seismic Safety Evaluation of Nuclear InstallationsPAGE#Application of the Management System to the Seismic Safety Evaluation of Nuclear Installations
Application of the Management System to the Seismic Safety Evaluation of Nuclear Installations  #
Application of the Management System to the Seismic Safety Evaluation of Nuclear InstallationsPAGE#Documentation and Records for Seismic Safety Evaluation of Nuclear Installations
Documentation and Records for Seismic Safety Evaluation of Nuclear Installations  #
Documentation and Records for Seismic Safety Evaluation of Nuclear InstallationsPAGE#Management of Modifications for Seismic Safety of Nuclear Installations
Management of Modifications for Seismic Safety of Nuclear Installations  #
Management of Modifications for Seismic Safety of Nuclear InstallationsPAGE#Appendix I ‐ Seismic Failure Mode Considerations for Structures, Systems and Components in Nuclear Installations
Appendix I ‐ Seismic Failure Mode Considerations for Structures, Systems and Components in Nuclear Installations  #
Appendix I ‐ Seismic Failure Mode Considerations for Structures, Systems and Components in Nuclear InstallationsPAGE#Seismic Failure Modes for Buildings and Structures in Nuclear Installations
Seismic Failure Modes for Buildings and Structures in Nuclear Installations  #
Seismic Failure Modes for Buildings and Structures in Nuclear InstallationsPAGE#Seismic Failure Modes for Mechanical Equipment in Nuclear Installations
Seismic Failure Modes for Mechanical Equipment in Nuclear Installations  #
Seismic Failure Modes for Mechanical Equipment in Nuclear InstallationsPAGE#Seismic Failure Modes for Electrical Equipment in Nuclear Installations
Seismic Failure Modes for Electrical Equipment in Nuclear Installations  #
Seismic Failure Modes for Electrical Equipment in Nuclear InstallationsPAGE#Seismic Failure Modes for Individual Instruments and Devices in Nuclear Installations
Seismic Failure Modes for Individual Instruments and Devices in Nuclear Installations  #
Seismic Failure Modes for Individual Instruments and Devices in Nuclear Installations
PAGE#Seismic Failure Modes for Distribution Systems in Nuclear Installations
Seismic Failure Modes for Distribution Systems in Nuclear Installations  #
Seismic Failure Modes for Distribution Systems in Nuclear InstallationsPAGE#Seismic Interaction Considerations for Failure of Structures, Systems and Components in Nuclear Installations
Seismic Interaction Considerations for Failure of Structures, Systems and Components in Nuclear Installations  #
Seismic Interaction Considerations for Failure of Structures, Systems and Components in Nuclear InstallationsPAGE#Operator Travel Paths
Operator Travel Paths  #
Operator Travel PathsPAGE#Specific Considerations for Seismic Failre Modes for Nuclear Power Plants
Specific Considerations for Seismic Failre Modes for Nuclear Power Plants  #
Specific Considerations for Seismic Failre Modes for Nuclear Power PlantsPAGE#Non-Vibration Ground Motion Induced Failures in Nuclear Installations
Non-Vibration Ground Motion Induced Failures in Nuclear Installations  #
Non-Vibration Ground Motion Induced Failures in Nuclear InstallationsPAGE#References
References  #
ReferencesPAGE#Annex I ‐ Example of Criteria for Defining Seismic Design Classes and Performance Targets in Nuclear Installations
Annex I ‐ Example of Criteria for Defining Seismic Design Classes and Performance Targets in Nuclear Installations  #
Annex I ‐ Example of Criteria for Defining Seismic Design Classes and Performance Targets in Nuclear InstallationsPAGE#Seismic Design Classes for Structures, Systems and Components in Nuclear Installations
Seismic Design Classes for Structures, Systems and Components in Nuclear Installations  #
Seismic Design Classes for Structures, Systems and Components in Nuclear Installations
PAGE#
1 ¹The development and use of guidelines on the seismic safety evaluation of existing nuclear installations started in the United States of America, where the application of such guidelines to all existing nuclear power plants was required by national regulations.
2 ²The final seismic safety evaluation to check that the design provides for an adequate margin to protect items important to safety against levels of external hazards more severe than those selected for the design basis, as required by Refs [3, 5, 6], can now be considered as part of the design process.
3 ³ INTERNATIONAL ATOMIC ENERGY AGENCY, Evaluation of Seismic Safety for Existing Nuclear Installations, IAEA Safety Standards Series No. NS-G-2.13, IAEA, Vienna (2009).
4 ⁴A cliff edge effect, in a nuclear power plant, is an instance of severely abnormal plant behaviour caused by an abrupt transition from one plant status to another following a small deviation in a plant parameter, and thus a sudden large variation in plant conditions in response to a small variation in an input [3]. In the context of seismic safety, the term ‘plant parameter’ in this definition refers to seismic ground motion at the plant site.
5 ⁵The operational stage ends with the permanent removal of all radioactive material.
6 ⁶A new nuclear installation may also be a standard design based on generic site parameters for which the site has not yet been specified.
7 ⁷Paragraph 1.3 of SSR-2/1 (Rev. 1) [3] states that “It might not be practicable to apply all the requirements of this Safety Requirements publication to nuclear power plants that are already in operation or under construction.” Hence, for the purposes of the present Safety Guide, the requirements quoted here are considered applicable only to new nuclear power plants.
8 ⁸Previous codes and practices, especially older ones, might not always demonstrate a margin.
9 ⁹The existence of seismic margins has been demonstrated not only through the implementation of SMA and SPSA methodologies for existing nuclear power plants in several Member States, but also by the performance of plants that have experienced large beyond design basis earthquakes and proved their integrity with little or no damage.
10 ¹⁰One of the main reasons for this variation is that nuclear installations are designed for a wide range of internal and external extreme loads, for example pressure and other environmental loads due to accident conditions, an aircraft crash, a tornado or a pipe break. Therefore, as mentioned in para. 2.7, seismic loads might not be the governing loads for some SSCs. Another reason is the method of equipment qualification, in which envelope type response spectra are generally used.
11 ¹¹In this context, ‘seismic weak links’ are non-redundant SSCs or identical redundant SSCs (i.e. affected by common cause failure) that have a smaller capacity than the majority of the other SSCs and, as such, could govern the installation level seismic capacity.
12 ¹²The HCLPF capacity is the earthquake motion level at which there is a high confidence of a low probability of failure of SSCs. The HCLPF capacity is a measure of seismic margin (see paras 5.44–5.47).
13 ¹³In most cases, it is foreseen that a seismic hazard assessment will be available as part of the site investigation or a periodic re-evaluation of the hazards. The available hazard assessments will need to be reviewed to determine if they are adequate for the purposes of the seismic safety evaluation being performed.
14 ¹⁴In SSG-9 (Rev. 1) [7], four spatial geographical scales of geological, geophysical and geotechnical investigations are defined: (1) regional (radius typically about 300 km); (2) near regional (radius typically not less than 25 km); (3) site vicinity (radius typically not less than 5 km); and (4) site area (radius typically about 1 km).
15 ¹⁵In the literature on the SMA methodology, a reference level earthquake is sometimes referred to as a ‘review level earthquake’ or ‘seismic margin earthquake’.
16 ¹⁶In this context, the reference level earthquake is not to be confused with the seismic level threshold, which is sometimes used in SPSA for the explicit calculation of fragilities (when the level is below the threshold) and for the assignment of generic fragilities (when the level is above the threshold).
17 ¹⁷Some Member States use these methodologies as complementary technical support; they are not intended to be used alone to meet the relevant requirements of SSR-2/1 (Rev. 1) [3], SSR-3 [5] or SSR-4 [6].
18 ¹⁸The methodologies presented in this publication are internationally recognized approaches that reflect the current state of practice. Other methodologies may be used in individual Member States in the context of their national regulatory environment, but these methodologies are not covered in this Safety Guide.
19 ¹⁹This Safety Guide primarily focuses on seismic safety evaluation that uses the concepts of HCLPF and/or seismic fragility to define the seismic margin of a nuclear installation. Alternative methods for seismic safety evaluation that are not based on the use of HCLPF and/or seismic fragility are not precluded if they are justifiable. In determining the appropriate evaluation methodology to be used, consideration should be given to the history and characteristics of the site, the level of risk posed by the site specific seismic hazard, the basis of the key safety case claims and objectives, and national regulatory practice.
20 ²⁰The maintenance cost is the cost of periodically updating the SPSA or SMA to keep its results valid over time, for example to incorporate updates to seismic hazard; modified or replaced SSCs, facility configuration or operational changes; availability of new data; or improvements in seismic capacity evaluation methods.
21 ²¹A cutset is a combination of events (e.g. failures) that, if they all occur, are sufficient to result in an accident.
22 ²²Installation level fragility is the conditional probability of unacceptable performance of the installation for a given value of the hazard parameter (e.g. peak ground acceleration). It is normally presented as a function of the hazard parameter in the form of a curve. It is commonly referred to as ‘plant level fragility’ for nuclear power plants. See Section 5 for more details.
23 ²³For the benefit of comparing the risk significance of individual SSCs, potential conservatism in the safety assessment should aim to be sufficiently consistent.
24 ²⁴Convolution is a type of mathematical integration. Reference [10] provides an example of the convolution integral.
25 ²⁵Uncertainty in the seismic safety metrics is due to the aggregate uncertainty in several factors, such as seismic hazard, SSC responses to seismic input, and seismic capacities and failure rates.
26 ²⁶For example, in the United States of America, new nuclear power plant licence applications are required to demonstrate a plant level HCLPF of at least 1.67 times the ground motion response spectrum that defines the design basis earthquake. This requirement is not applicable to operating nuclear plants, however.
27 ²⁷Although some service and handling equipment is non-safety-related, its evaluation may be needed for analysis and study of interaction effects in operational and storage configurations.
28 ²⁸Non-destructive methods alone are usually not sufficient for reliably establishing concrete strength.
29 ²⁹Ground motion prediction equations for most non-vibratory ground motion parameters are typically at an earlier stage of technical evolution than those for vibratory ground motion parameters and are typically not as widely available or as reliable.
30 ³⁰The evaluation team selection process is reviewed in Ref. [10]. The team is expected to consist of both staff from the nuclear installation and consultants.
31 ³¹For nuclear power plants, Requirement 4 of SSR-2/1 (Rev. 1) [3] lists the fundamental safety functions as (i) control of reactivity; (ii) removal of heat from the reactor and from the fuel store; and (iii) confinement of radioactive material, shielding against radiation and control of planned radioactive releases, as well as limitation of accidental radioactive releases.
32 ³²The term ‘selected SSCs’ is used in this Safety Guide to mean those SSCs that are of interest in SMA or SPSA. In other literature, the terms ‘safe shutdown equipment list’ and ‘seismic equipment list’ are commonly used, but ‘selected SSCs’ implies a broader meaning than just equipment.
33 ³³A virtual review is a review of a three dimensional model of the nuclear installation.
34 ³⁴SSCs that can be assumed to be seismically rugged demonstrate seismic capacities that significantly exceed the threshold at which they might contribute to the risk of the nuclear installation. This capacity is sometimes referred to as the ‘screening level capacity’. These SSCs need not be explicitly evaluated. However, seismically rugged SSCs need to be retained in the plant response logic model and assigned nominally high capacities, rather than be removed from the logic model altogether.
35 ³⁵A walkby is a brief, non-detailed walkdown with less extensive documentation, performed for example, to confirm that an SSC is similar to another SSC that has already been covered by a walkdown and that it is free from potential spatial interaction concerns.
36 ³⁶Capacity ranking involves assigning a qualitative rank to each SSC on the basis of the seismic evaluation walkdown to prioritize the allocation of technical effort in subsequent seismic evaluations. A typical ranking system includes five grades: low (seismically deficient), medium (may be governed by failures external to the SSC design, for example related to anchorage or interaction), high (likely governed by failure of the SSC design), rugged (very high seismic capacity) and unknown (needs additional review).
37 ³⁷A common example of a falling hazard is the collapse of masonry walls located next to selected SSCs.
38 ³⁸A common example of an impact hazard is the impact on electrical cabinets containing chatter sensitive devices by adjacent SSCs or debris.
39 ³⁹For water cooled nuclear reactors, the fundamental safety function of heat removal from the reactor (see Requirement 4 of SSR-2/1 (Rev. 1) [3]) to achieve an acceptable end state, as described in para. 5.16 of this Safety Guide, involves control of the reactor coolant pressure, control of the reactor coolant inventory, and decay heat removal.
40 ⁴⁰Modern probabilistic seismic hazard analyses incorporate most sources of ground motion randomness. One common exception is randomness due to earthquake component to component variability.
41 ⁴¹HCLPF capacities for SMAs are often determined using deterministic analysis methods similar to following design code procedures (e.g. the conservative deterministic failure margin method) in lieu of explicit propagation of uncertainties in the seismic capacity evaluation. Alternatively, HCLPF capacities may be determined explicitly using probabilistic fragility analysis methods such as the separation of variables. The latter methods are used infrequently for SMAs compared with SPSAs.
42 ⁴²The scale factor is multiplied by the peak ground acceleration or spectral acceleration of the reference level earthquake to obtain the HCLPF capacity.
43 ⁴³The HCLPF capacity is exactly equal to the value of this parameter when the standard deviation terms for randomness and uncertainty are equal.
44 ⁴⁴The reference level earthquake for a Level 2 PSA may be different from that used for a Level 1 PSA of the same nuclear power plant.
45 ⁴⁵In this case, a low bias estimate of the variability is conservative, since the fragility curve is anchored to a low probability of failure value, that is the HCLPF capacity point.
46 ⁴⁶The min-max approach produces estimates that are more approximate than those produced by the explicit quantification approach.
47 ⁴⁷For nuclear power plants, this system logic model is commonly referred to as a ‘seismic plant response model’.
48 ⁴⁸The SSCs assigned generic fragilities need to be confirmed in the final risk quantification to have no significant risk contributions, which might necessitate refinement iterations.
49 ⁴⁹For example, in the United States of America, SSCs that perform a safety function are placed in a seismic category, referred to as a ‘seismic design class’, on the basis of the unmitigated consequences that might result from the failure of the SSC by itself or in combination with other SSCs (see Annex). Consideration is given to consequences to workers, the public and the environment.
50 ⁵⁰A ‘limit state’ is the limiting acceptable condition of the SSC for which its intended safety function is kept. For example, for a column supporting a safety class pressure vessel, the limit state is the state at which the column loses its load carrying capacity through either buckling or collapse. For a mechanical pump with a safety function that necessitates operability, the limit state is the state at which the pump loses its operability.
51 ⁵¹The various methods of obtaining installation level fragility are described in Section 5. In deterministic SMA (the simplest method), it is usually assumed that the installation level fragility can be derived just from the seismic capacity of the weakest SSC needed to bring the installation to a safe state and keep it in a safe state during a specified period of time.
52 ⁵²In a reliability based approach, the design code requirements are intended to achieve a predefined maximum probability of failure for a given set of loadings or external actions.
53 ⁵³While equipment masses may be estimated from the structure design drawings for individual floors, some areas may be designed for heavy loads that are experienced only infrequently, typically when the installation is not in operation. A typical example of this is a laydown area where a nuclear reactor head is temporarily stored during a refuelling outage.
54 ⁵⁴The term ‘seismic design classes’ is used in Tables A–1 and A–2, and refers to seismic design categories for SSCs and for nuclear installations.

Seismic design class	Hazard category	Unmitigated consequences of failure
Seismic design class	Hazard category	Worker	Public	Environment
1^a	Low	No radiological or toxicological release consequences, but failure of SSCs may place facility workers at risk of physical injury	No radiological or toxicological release consequences	No radiological or toxicological release consequences
2^a	Low	Radiological/ toxicological exposures of workers will have no permanent health effects, may place more facility workers at risk of physical injury or may place emergency operations at risk	Radiological/ toxicological exposures of public areas are small enough to require no public warnings concerning health effects	No radiological or chemical environmental consequences
3	Moderate	Radiological/ toxicological exposures that may place facility workers’ long term health^b in question	Radiological/ toxicological exposures of public areas would not be expected to cause health consequences but may require emergency plans to assure protections	No long term environmental consequences are expected, but environmental monitoring may be required for a period of time
4	High	Radiological/ toxicological exposures that may cause long term health problems and possible loss of life for a worker in proximity to the source of hazardous material or place workers in nearby on-site facilities at risk	Radiological/ toxicological exposures that may cause long term health problems to an individual at the exclusion area boundary for two hours	Environmental monitoring required and potential temporary exclusion from selected areas for contamination removal
5	High	Radiological/ toxicological exposures that may cause loss of life of workers in the facility	Radiological/ toxicological exposures that may possibly cause loss of life to an individual at the exclusion area boundary for an exposure of two hours	Environmental monitoring required and potentially permanent exclusion from selected areas of contamination

Seismic design class	Hazard category	Performance target^a (a⁻¹)
1	Low	<1 × 10⁻³
2	Low	<4 × 10⁻⁴
3	Moderate	~1 × 10⁻⁴
4	High	~4 × 10⁻⁵
5	High	~1 × 10⁻⁵