American Nuclear Society



American Nuclear Society

Categorization of Nuclear Facility

Structures, Systems and Components

For Seismic Design

an American National Standard

published by the

American Nuclear Society

555 North Kensington Avenue

La Grange Park, Illinois 60525 USA

Foreword

(This foreword is not part of American National Standard Categorization of Nuclear Facility Structures, Systems and Components for Seismic Design, ANSI/ANS 2.26-2004.)

This standard has been developed based on methods used by the U.S. Department of Energy (DOE) for performance categorizing and designing structures, systems and components (SSCs) in nuclear facilities to withstand the effects of natural phenomena (DOE-STD 1021-93, Natural Phenomena Hazards Performance Categorization Guidelines for Structures, System, and Components, July 1993, Reaffirmed 2002; DOE-STD-1020-2002, Natural Phenomena Hazards Design and Evaluation Criteria for Department of Energy Facilities, January 2002; DOE-STD-1022-94, Natural Phenomena Hazards Site Characterization Criteria, March 1994, Reaffirmed 2002; DOE-STD-1023-95, Natural Phenomena Assessment Criteria, May 1995, Reaffirmed 2002).

The standard provides criteria and guidance for selecting a seismic design category (SDC) and Limit State for the SSCs with a safety function in a nuclear facility, other than commercial power reactors whose seismic design requirements are established by other standards and regulations. The SDC and Limit State are to be used in conjunction with standards ANS 2.27, “Guidelines for Investigations of Nuclear Facility Sites for Seismic Hazard Analysis”, ANS 2.29 “Probabilistic Seismic Hazards Analysis”, and ASCE xxx, “Seismic Design Criteria for Structures, Systems and Components in Nuclear Facilities”. These standards together establish the design response spectra and the design and construction practices to be applied to the SSCs in the facility, dependent on which SDC and Limit State the is assigned to the SSC. The objective is to achieve a risk-informed design that protects the public, the environment and workers from potential consequences of earthquakes. Application of this group of standards will produce: (i) the design response spectra; (ii) SSC Limit State necessary to achieve adequate safety performance during and following earthquakes; and (iii) SSC designs that achieve the desired Limit State. The referenced standards and their procedural relationship to this standard are discussed in Appendix A of this standard.

Working Group ANS 2.26 of the Standards Committee of the American Nuclear Society had the following membership at the time of approval of this standard and indeed was stable throughout the development of the standard:

Neil W. Brown, Chair, Lawrence Livermore National Laboratory

Steve Additon, Rocky Flats Environmental Technology Site

Harish Chander, U.S. Department of Energy

Dan Guzy, U.S. Department of Energy Asa Hadjian, Defense Nuclear Facilities Safety Board

Quazi Hossain, Lawrence Livermore National Laboratory

George B. Inch, Niagara Mohawk

Calvin Morrell, Stone a& Webster

Andrew Persinko, U.S. Nuclear Regulatory Commission

Howard C. Shaffer, Consultant

John Stevenson, Consultant

Charles M. Vaughan, Global Nuclear Fuel

The standard was processed and approved for submittal to ANSI by the Nuclear Facilities Standards Committee (NSFC) of the American Nuclear Society on ANSI/ANS 2.26 Categorization of Nuclear Facilities Structures, Systems and Components for Seismic Design. Committee approval of the standard does not necessarily imply that all members voted for approval. At the time it approved this standard the NFSC had the following membership:

Donald Spellman, Chair, Oak Ridge National Laboratory

J. Thomas Luke, Vice-chair, Exelon Nuclear

C. K. Brown, Southern Nuclear Operating Company

R. H. Bryan,Jr., Tennessee Valley Authority

Harish Chander, Department of Energy

Joseph Cohen, Consultant

Michael T. Cross, Westinghouse Electric Corporation

Donald R. Eggett, AES Engineering

Rick A. Hill, GE Nuclear Energy

N. Prasad Kadambi, Nuclear Regulatory Commission

Jesse E. Love, Bechtel Power Corporation

James F. Mallay, Framatome ANP

Robert McFetridge, Westinghouse Electric Corporation

Charles H. Moseley, Jr., BWXT Y-12

W. N. Pillman, Framatome ANP

William B. Reuland, Electric Power Research Institute

Michael Ruby, Rochester Gas & Elecric Company

James Saldarini, Foster Wheeler Environmental Corporation

Robert E. Scott, Scott Enterprises

Steve L. Stamm, Stone & Webster, Inc.

John D, Stevenson, J. D. Stevenson Consultants

C. D. Thomas, Jr., Consultant

J. Andy Wehrenberg, Southern Company Services

George P. Wagner, Consultant

Michael J. Wright, Grand Gulf Nuclear Station

Contents

Foreword 2

List of Acronyms 6

1. Scope 8

2. Definitions 8

3. Applicability 9

4. Determination of SSC Seismic Categories 10

4.1 Introduction 10

4.2 Categorization Process 10

4.2 Rules of Application 11

5. Determination of Limit States 13

6. Analyses to Support Selection of SDC and Limit States 15

6.1 General Requirements 15

6.2 Unmitigated Consequence Analysis 15

6.3 Data Compilation 18

Appendix A Risk-informed Basis for Seismic Design Categorization and Associated Target Performance Goals 22

Appendix B Examples of Application of Limit States to SSCs 30

Appendix C: Guidance on a Structured Approach to Support Making the Judgments Required in Section 6.2 of this Standard 35

References 43

List of Acronyms

AEGL Acute Exposure Guideline Level

ANS American Nuclear Society

ANSI American National Standards Institute

ASCE American Society of Civil Engineers

ASME American Society of Mechanical Engineers

DBE Design Basis Earthquake

DOE Department of Energy

DRS Design Response Spectra

ERPG Emergency Response Planning Guide

HEPA High Efficiency Particulate

HVAC Heating Ventilating and Air Conditioning

IBC International Building Code

NRC Nuclear Regulatory Commission

PSHA Probabilistic Seismic Hazard Analysis

SDB Seismic Design Basis

SDC Seismic Design Category

SSC Structures, Systems and Components

TEDE Total Effective Dose Equivalent

USGS United States Geological Survey

UHRS Uniform Hazard Response Spectra

1. Scope

This standard provides: (i) criteria for selecting the Seismic Design Category[1] (SDC) for nuclear facility structures, systems, and components (SSCs) to achieve earthquake safety and (ii) criteria and guidelines for selecting Limit States for these SSCs to govern their seismic design. The Limit States are selected to ensure the desired safety performance in an earthquake

2. Definitions

Common Cause failure: Multiple failures of SSCs as the result of a single phenomenon.

Engineered Mitigating Feature: An SSC that is relied upon during and following an accident to mitigate the consequences of releases of energy, radioactive or toxic material.

Failure Consequence: A measure of the radiological and toxicological consequences of exposure to the public, the environment and workers that may result from failure of a SSC by itself or in combination with other SSCs.

Graded Approach: The process of assuring that the level of analysis, documentation and actions used to comply with requirements in this standard are commensurate with: (1) The relative importance to safety, safeguards and security; (2) The magnitude of any hazard involved: (3) The life cycle stage of the facility; (4) The programmatic mission of a facility; (5) The particular characteristics of the facility; (6) The relative importance of the radiological and non-radiological hazards; and (7) any other relevant factor.

Limit State: The limiting acceptable deformation, displacement or stress that an SSC may experience during or following an earthquake and still perform its safety function. Four Limits States are identified and used by this standard and ASCE xxx.

Seismic Design Category: One of five categories used in this standard and the accompanying three standards identified in Appendix A that are used to establish seismic hazards evaluations and SSC seismic design requirements.

Total Effective Dose Equivalent (TEDE): The sum of the deep-dose equivalent (for external exposure) and the committed effective dose equivalent (for the internal exposure).

Target Performance Goal: Target annual frequency of an SSC exceeding its specified Limit State. Target Performance Goals of 1x10-4, 4x10-5 and 1x10-5 per annum are used in ASCE xxx. The importance of Target Performance Goals in this standard is discussed in Appendix A.

Unmitigated Consequences: The product of a specific type of consequence analysis used for the selection of the Seismic Design Category for a SSC. Unmitigated Consequence Analysis is described in Section 6.1.

3. Applicability

This standard is applicable to the design of SSCs of nuclear facilities. For purpose of this standard a nuclear facility is a facility that stores, processes, tests, or fabricates radioactive materials in such form and quantity that a nuclear risk to the workers, to the offsite public, or to the environment may exist. These include but are not limited to nuclear fuel manufacturing facilities; nuclear material waste processing, storage, fabrication, and reprocessing facilities; enrichment facilities; tritium facilities; radioactive materials laboratories; and nuclear reactors other than commercial power reactors. (Commercial power reactors are excluded because their seismic design requirements are specified by other American Nuclear Society standards.)

The SSC seismic design categories that this standard establishes shall be used by the facility owner and the facility designer, in conjunction with ANS 2.27, “Guidelines for Investigations of Nuclear Facility Sites for Seismic Hazard Analysis”, ANS 2.29 “Probabilistic Seismic Hazards Analysis”, and American Society of Civil Engineers standard ASCE xxx, “Seismic Design Criteria for Structures, Systems and Components in Nuclear Facilities”.

Determination of SSC Seismic Categories

4.1 Introduction

SSCs that have been determined to have a safety function shall be assigned one of five SDCs. An SSC shall be considered to perform a safety function if its failure, by itself or in combination with other SSCs, could result in any of the consequence levels identified in Table 1 being exceeded. Also, an SSC, the failure of which may impair or adversely effect an operator action that is required for restoring another SSC safety function or for preventing or mitigating the consequences of a design basis earthquake (DBE) during and following the event shall be considered to have a safety function. The identification of SSCs with safety functions is the product of the safety analyses required to support application of this standard. Section 6.outlines the scope of the safety analysis required. The scope and comprehensiveness of the safety analysis will vary with the complexity of the facility, operations and the contained hazard.

The assignment of a Seismic Design Category (SDC) to an SSC determined to have a safety function is based on the objective of achieving acceptable risk to the public, the environment and workers resulting from the consequences of failure of the SSC (See Appendix A for additional discussion). Each SDC has a defined consequence severity level that shall not be exceeded. Proper assignment of SDCs to the SSCs and constructing[2] the SSCs in accordance with the IBC or ASCE xxx as required will provide an acceptably low risk to the public, the environment and workers from seismic induced SSC failures.

4.2 Categorization Process

a) An SDC shall be assigned one of the SSCs listed in Table 1 based on the unmitigated consequences that may result from the failure of the SSC by itself or in combination with other SSCs. If the SSC failure consequences are equal to or less than the guidance listed in Table 1 for a given SDC, the SSC shall be placed in that SDC. The consequences shall be equal to or less for all three types of consequences listed in the table, i.e., consequences to the public, the environment and workers, and the SSC shall be placed highest SDC determined under by the consequence type. Section 6 provides guidance on performing unmitigated consequence evaluations.

b) SDC 1 and 2 in conjunction with the IBC and SDC 3 through 5 in conjunction with ANS 2.27, ANS 2.29 and ASCE xxx establish the Design Response Spectra (DRS) and SSC design and analysis requirements. For SDC-3, 4 and 5 the DRS are specified as the product of the of the Uniform Hazard Response Spectra (UHRS) obtained using ANS 2.27 and ANS 2.29, and a design factor specified in ASCE xxx. The DRS for SDC-1 and SDC-2 are specified in the IBC.

c) Based on the information or data obtained from the safety analyses outlined in Section 6 and the guidance provided here, SSCs assigned SDC-3, SDC-4 or SDC-5 shall also be assigned one of four Limit States identified in Section 5. Appendix B provides examples of how this determination may be made. The set of requirements identified by the SDC and Limit State are called Seismic Design Basis (SDB) used by ASCE xxx. No Limit State identification is required for SDC-1 and SDC-2 whose design requirements are identified in the IBC.

4.2 Rules of Application

a) SSCs assigned SDC-1 with Limit States A, B, and C shall be designed to the IBC Seismic Use Group (SG I, SGII and SG III, respectively) as recommended in ASCE xxx.

b) SSCs assigned SDC 2 with Limit States A and B shall be designed to the IBC Seismic Use Group (SG II, and SG III, respectively) as recommended in ASCE xxx.

c) SSCs assigned SDC-3, SDC-4, and SDC-5 shall be designed to the requirements of ASCE xxx and ANS 2.29.

d) SSCs in a facility with a human occupancy rate of more than 72 person hours per 24 -hour period shall be placed, as a minimum, in SDC-1. SSC failures that result in no consequence to the public or environment and present only a physical threat to the workers and therefore placed in SDC-1, shall be designed to the IBC using Group I.

Table 1

Seismic Design Categories Based on the Unmitigated Consequences of SSC Failure

| |Unmitigated Consequence of SSC Failure |

| | Worker | Public | Environment |

|Category | | | |

|SDC-1 |No Radiological/toxicological release consequences|No Radiological/toxicological release |No radiological or chemical release |

| |but failure of SSCs may place facility workers at |consequences. |consequences. |

| |risk of physical injury. | | |

|SDC-2 |Radiological/toxicological exposures to workers |Radiological/toxicological exposures of |No radiological or chemical release |

| |will have no permanent health effects, will place |public areas are small enough to require |consequences. |

| |more facility workers at risk of physical injury, |no public warnings concerning health | |

| |or place emergency facility operations at risk. |effects. | |

|SDC-3 |Radiological/toxicological releases that may place|Radiological/toxicological exposures may |No long term environmental consequences are|

| |facility workers long- term health in question. |require off-site emergency preparedness |expected but environmental monitoring may |

| | |plans to be established to protect the |be required for a period of time. |

| | |public. | |

|SDC-4 |Radiological/toxicological effects that may cause |Radiological /toxicological effects that |Environmental monitoring required and |

| |long-term health problems and possible loss of |may cause long- term health problems to |potential temporary exclusion from selected|

| |life for a worker in proximity of the source of |an individual at the exclusion area |areas for contamination removal. |

| |hazardous material, or place workers in nearby |boundary for 2 hours or more. | |

| |on-site facilities at risk. | | |

|SDC-5 |Radiological/toxicological effects that may cause |Radiological/toxicological effects that |Environmental monitoring required and |

| |loss of life of workers in the facility. |may possibly cause loss of life to an |potentially permanent exclusion from |

| | |individual at the exclusion area boundary|selected areas of contamination. |

| | |for an exposure of 2 hours or more. | |

5. Determination of Limit States

Limit State A: An SSC designed to this Limit State may sustain large permanent distortion short of collapse and instability (i.e., uncontrolled deformation under minimal incremental load), but shall still perform its safety function and not impact the safety performance of other SSCs.

Examples of SSCs that may be designed to this Limit State are:

• Building structure that must function to permit occupants escape to safety following and earthquake.

• Systems and components designed to be pressure retaining but may perform their safety function even after developing some significant leaks following an earthquake.

Limit State B: An SSC designed to this Limit State may sustain moderate permanent distortion but shall still perform its safety function. The safety function may include both structural and leak tight integrity of an SSC designed to retain fluids under pressure.

Examples of SSC that may be designed to this Limit State are:

• Building structures that that are required to perform a passive system or component support functions.

• Systems and components designed to be pressure retaining but may perform their safety function even after developing some minor leaks following an earthquake (i.e. they either do not contain hazardous material or the leakage rates associated with minor leaks do not exceed consequence level of assigned SDC).

Limit State C: An SSC designed to this Limit State may sustain minor permanent distortion but shall still perform its safety function. An SSC, that is expected to undergo minimal damage during and following an earthquake such that no post-earthquake repair is necessary, may be assigned this Limit State. An SSC in this Limit State may perform its confinement function for liquids during and following an earthquake.

Examples of SSCs that may be designed to this Limit State are:

1. glove boxes containing hazardous material;

2. other confinement barriers for radioactive or toxic materials;

3. HVAC systems that service equipment or building space containing hazardous material.

4. Active components that may have to move or change state following the earthquake.

Limit State D: An SSC designed to this Limit State shall maintain its elastic behavior. An SSC in this Limit State shall perform its safety function during and following an earthquake. Gaseous, particulate and liquid confinement by SSCs is maintained. The component sustains essentially no damage.

Examples of SSCs that may be designed to this Limit State are:

5. containments for large inventories of radioactive or toxic materials;

6. components that are designed to prevent accidental nuclear criticality;

7. safety functions that may be impaired due to permanent deformation (e.g., valve operators, control rod drives, HEPA filter housings, turbine or pump shafts, etc.).

• safety functions that require the SSC to remain elastic or rigid so that it retains its original strength and stiffness during and following a design basis earthquake to satisfy its safety, mission, or operational requirements (e.g., relays, switches, valve operators, control rod drives, HEPA filter housings, turbine or pump, etc.).

The combination of Seismic Design Category ( 3, 4, or 5 only) and Limit State (A, B, C, or D) that determines the Design Basis Earthquake and acceptance criteria for designing the SSCs in accordance with ASCE xxx. For example, Seismic Design Basis 3C uses criteria given in this Standard for Seismic Design Category 3 and Limit State C.

6. Analyses to Support Selection of SDC and Limit States

6.1 General Requirements

(a) Following determination of the regulatory requirements applicable to the project or to the facility a safety analysis or integrated safety assessment shall be performed using the requirements and guidelines provided in this standard and other applicable standards such as [9]. In the context of this standard, the safety analyses shall provide the basis for assigning an SSC to one of the SDCs and selecting its Limit State. The scope and comprehensiveness of the safety analysis will vary with the complexity of the facility, operations and the contained hazard. Facilities containing SSCs assigned SDC-1 or SDC-2 only should have less extensive safety analyses requirements. The safety analysis shall include the unmitigated consequences associated with failure of the SSC being categorized and described in Section 6.2. Qualitative and quantitative values of the critical design parameter(s) at which the SSC safety function fails shall be identified, along with the unmitigated radiological, toxicological and environmental consequences of the failure. The unmitigated consequence analysis is essential to this standard.

(b) The analyses necessary to support identification of SSC that will be assigned SDCs 3, 4, and 5 should be more substantive than that needed for SSCs assigned SDC-1 and SDC-2. The level of peer and regulatory review of the analysis, judgments and decisions concerning categorization may also be more substantive for SSCs assigned SDC-3, SDC-4 and SDC-5.

(c) To achieve the objectives of this standard, the safety analyses shall quantify and consider the uncertainties with determining failure and the consequences of failure. The depth and documentation of the uncertainty analyses should be sufficient to support the judgment that categorization based on Table 1 and the design requirements in ASCE xxx produces a facility that is safe from earthquakes.

6.2 Unmitigated Consequence Analysis

(a) An unmitigated consequences analysis of the hazards in a facility and the function of the items relied on for safety shall be completed to support SSC seismic categorization. The basic data and analysis identified in section 6.3 shall be used to support the unmitigated consequence analysis. The unmitigated consequence analysis shall be performed considering only the inherent physical or chemical characteristics of the hazardous material and the energy sources for dispersing the material [8, 9].

(b) The SSC being evaluated shall have one or more safety functions identified by the facility safety analysis required in Section 6.1 and related to preventing accidents, such as nuclear criticality, or mitigating the consequences from accidental release of a specified inventory of hazardous material.

(c) The SSC and all other relevant engineered mitigating features shall be assumed not to function unless the robustness of each mitigating feature can be clearly demonstrated to service the postulated event. Redundancy may also be used as a mitigating feature providing the independence of redundant features shall be clearly demonstrated, such that there is a very low probability of an earthquake caused common cause failure.

(d) ANS 5.10, “Airborne Release Fractions at Nonreactor Nuclear Facilities” [10] provides guidance concerning mechanisms for release of the hazardous material into the air or water and shall be used to support similar calculations required by this standard.

(e) Consistent with risk-informed process for selecting the earthquake level, the unmitigated consequence analysis should strive to use mean values for the parameters related to material release, dispersal, and health consequences. In many instances the data available to support these analyses are not prototypic of the situation being analyzed, or there is large and poorly characterized uncertainty. Hence, judgment must be used to select a mean value for the parameter of concern. The desire to use mean values is not intended to demand many data points and statistical computation of the mean. It is intended that the parameters used in the evaluation be judged to be the most likely to occur given the physical and chemical conditions involved with the failure. These judgments should be made on the basis that they may be reviewed and found acceptable by a regulator or the public. One should be especially aware of this when applying the guidance in Table A-3. Supplementary regulatory guidance may need to be considered.

(f) The computed dose consequences shall be the total effective dose equivalent (TEDE), and the dose to the public shall be based on the maximally exposed individual off-site. The air and water transport mechanisms should be modeled using mean values for model parameters and associated uncertainties estimated.

(g) The unmitigated consequence of an SSC’s failure by itself may not lead to an unacceptable release of hazardous material (i.e. requiring the SSC to be assigned to SDC 3, 4, or 5). If the SSC’s failure in conjunction with other failures results in an unacceptable release of hazardous material then it shall be placed in SDC 3, 4 or 5. For example, failure of a relay required to start an emergency air cleaning system may not lead to an unmitigated release unless there is a coincident failure of other SSCs that results in release of hazardous material to the space serviced by the air cleaning system. In this case it may be necessary to place the relay in SDC-3, 4 or 5 depending on the unmitigated consequences.

(h) When assigning SDCs in cases of common cause failure of redundant SSCs, it will be necessary to exercise judgment about the relative contribution that each SSC’s postulated to failure makes to the unmitigated release.

(i) In some instances it may be possible to justify an SSC as having not failed when evaluating another SSC. In general, this is discouraged as a complicating factor that may be difficult to support. In these cases the SSC being assumed to have not failed should be at least one SDC higher than the SSC being evaluated. Section 6.4 and 6.7 respectively discuss the bases for using the characteristic of redundancy and “robustness” to support such a judgment.

(j) The information database and unmitigated consequence analysis must be comprehensive enough to support discrimination between the qualitative criteria in Table 1. Both the analysis and the assignment of SSCs to SDCs are likely to be simpler and more obvious for the low consequence categories. Supporting decisions between SDC-3 and SDC-4, and between SDC-4 and SDC-5 may be expected to be more difficult. The quantitative guidelines discussed in Appendix A may be used to guide the decision process related to the more difficult decisions on assigning an SDC to an SSC.

6.3 Data Compilation

(a) Facility Review

A systematic review of the facility’s mission, usage, process, operation, and its inventory of radioactive and chemically hazardous materials shall be performed to obtain the following minimum data/information necessary for determining the SDC and Limit States:

• Quantity, type (e.g., radioactive, chemical, biological, etc,), and nature (gaseous, liquid, powder, solid, etc.) of the hazardous material inventory.

• Normal and emergency (if any) functions of the SSC during a seismic and other design basis events.

• Number of workers in the facility and at the site who may be adversely affected during or following an earthquake and its consequences.

• Proximity of the site boundary from the facility and proximity of population centers from the site.

• Regulatory and Project requirements and commitments regarding safety.

• Design specifications for the SSCs, including applicable industry codes and standards. These may vary in level of detail depending on the status of design (conceptual, preliminary or final), but the seismic classification should be included at each stage of design commensurate with the level of detail available at each stage..

b) Facilities with SSCs assigned SDC-3, SDC-4 and SDC-5

The safety analyses required in Section 6.1 shall be performed based on the following principles, concepts, and considerations:

• The principle of defense-in-depth

• Redundancy considerations

• Common-Cause Failure considerations

• System Interaction considerations

• Robustness considerations

These are described as follows:

(1) Defense-in-depth

Defense-in-depth is a safety philosophy in which a system or a facility is designed with layers of defense against adverse SSC failure consequences such that no one layer by itself, no matter how robustly designed, is solely relied upon either to prevent the failure or to mitigate the consequences. For nuclear facilities, compliance with defense-in-depth philosophy typically requires: (i) safety consideration in site selection; (ii) minimization of material at risk; (iii) conservative design margins and a formal quality assurance program; (iv) successive physical barriers and/or administrative controls for protection against radioactivity releases to the environment and significant public exposure to radioactivity; (v) provision of multiple means to ensure the safety functions needed to control the processes and to maintain them in a safe state; (vi)equipment and administrative controls restricting deviations from normal operations and providing for recovery from accidents; (vii) means to monitor accidental releases; and (viii) emergency plans for minimizing the effects of an accident.

(2) Redundancy

In the context of safety analysis, redundancy refers either to the redundancy of an SSC or to the redundancy of a particular SSC safety function. An SSC is said to be redundant when it is one of two or more SSCs in the facility that have similar configuration and perform identical functions and only one SSC must function. An SSC function is redundant if another SSC is available to perform the same function or an administrative measure or control may be put in place that may substitute for the SSC function with the same or higher degree of assurance. Redundancy may be introduced either as an element of “defense-in-depth” philosophy (see Section 6.4) to provide multi-layered protection against adverse effects of the DBE or as a design feature to support meeting the desired failure probability. The treatment of redundant SSCs provided from Defense-in-depth considerations has been addressed above in Section 6.4. For the later case, when redundancy is introduced as a design feature to achieve the desired failure probability the additive effect of the mitigating functions of all redundant SSCs may be considered. However, the possibility and effects of common-cause failure (see Section 6.6, below) of redundant SSCs shall also be considered in seismic safety analysis.

(3) Common-Cause Failure

The failure of multiple SSCs as a result of a given postulated event is called common-cause failure. This phenomenon of exceeding a given criterion due to a common-cause failure shall be considered in performing the facility seismic safety analysis. However, the SSC seismic categorization described in Sections 4 above shall be performed assuming common-cause failure has occurred unless an SSC(s) qualifies as robust or incorporates redundancy with low probability of common cause failure during the earthquake under the guidance provided in Sections 6.2, 6.3(b)(3) and 6.3(b)(5)

(4) System Interaction

In some instances an SSC may not perform a safety function by itself, but its failure may adversely affect the safety function of another SSC. This phenomenon, commonly referred to as system interaction or “two-over-one phenomenon”, shall be considered in the facility safety analyses and SSC seismic categorization. Earthquake caused fire, flooding and impact from movement or collapse of nearby objects are recognized sources for producing these potential failure sequences. System interaction considerations shall also include the adverse effects of failure of a lower category (SDC or Limit State) SSC (i.e., the Source SSC) on the safety function of a higher category SSC (i.e., the Target SSC). The Target SSC is to withstand the imposed loading.

System interaction effects may be addressed in one of the following four ways:

• By upgrading the non-safety or lower SDC or Limit State SSC ( i.e., the Source SSC) to the extent necessary to preclude its adverse interaction with the affected or Target SSC.

• By placing the source SSC in the same SDC or higher, and by modifying its Limit State, if necessary, so that no interaction with the Target SSC occurs.

• By configuring the facility layout or SSC design to preclude adverse interaction between the Source and the Target. Examples of such modifications are: creating sufficient physical separation, installing barriers, adding automatic control systems, etc.

• By designing the Target SSC to withstand the imposed interaction load.

(5) Robustness

As discussed in Section 6.2(i), for an SSC’s mitigating effects to be considered in the unmitigated accident consequence analysis the SSC must be identified as robust and be given special attention in its construction. Assured margins shall be provided, typically at limit state C or D levels, in its seismic capability. When evaluating SSCs for placement in SDC-3 or SDC-4 it may be permissible to take credit for the consequence mitigation benefit of another SSC in SDC-5. For this application to be acceptable, it must be shown that the SSC has substantial seismic margin to failure modes that may cause interaction with the SSC being evaluated. In this special case, substantial seismic margin is a judgment that must be supported by design and by the attention given to the SSC throughout its entire life cycle (design, procurement, construction, operation and maintenance). An example of this situation is a building that is designed with a containment function at SDC-5 that contains glove boxes whose unmitigated failure may cause them to be placed in SDC-5. If it is demonstrated that the building has substantial seismic margin against collapse that may cause glove box failures, then it may be acceptable to take credit for the building mitigation of releases from glove boxes to support placement of the glove boxes into a lower level SDC (i.e. SDC-3 or SDC-4).

Appendix A Risk-informed Basis for Seismic Design Categorization and Associated Target Performance Goals

The objective of ANS 2.26, in conjunction with its three accompanying standards, ANS2.27, ANS 2.29 and ASCE xxx, [5, 6, 7] is to produce a consistent risk-informed design of a nuclear facility that protects the public, the environment and workers from the effects of earthquakes. This Appendix discusses the rational for the requirements in this standard and the interface between this standard and the accompanying standards. Key parameters in the procedure are the unmitigated consequence levels used to assign SSCs to SDCs and the Target Performance Goals used in ASCE xxx to establish design criteria. This appendix discusses first the basis for the Target Performance Goals and then the basis for the consequence levels in Table 1 of this standard. Although the standard has a risk-informed basis and some applications may benefit from completing a seismic risk assessment, there is generally no need to apply ANS 58.21, “External-Events PRA Methodology”.

Figure A-1 shows the interfaces between this standard and the three accompanying standards and their procedural relationship. All four standards are needed to design facilities that contain SSCs in SDC 3, 4,and 5. Iterative interactions during application of the standards that are not illustrated in Figure A-1 should be anticipated.

Information flow when applying the standards

Figure A-1

Schematic Showing the Relationships of the Seismic Standards

Considerable progress has been made over the past 20 years towards the development of probabilistic based seismic design criteria and methods that achieve approximately a risk-informed seismic design. Experience gained from seismic design and probabilistic seismic risk assessments of nuclear power plants and other high hazard nuclear facilities has been a major contributor to this progress. That experience was used to develop a probabilistic performance goal based design method to protect against natural phenomena hazards (NPH) described in four DOE technical standards [1, 2, 3, 4]. The DOE standards are intended to achieve approximately a consistent risk-informed design [11]. The introduction of Seismic Use Groups in the IBC also indicates industry’s direction towards risk-informed and graded methods of seismic design. These DOE standards and the IBC provide much of the basis for the risk-informed and graded method of seismic design that this standard and its accompanying standards intend to achieve.

A risk-informed design method has an objective of achieving an acceptable and balanced risk to the workers and public over a wide range of hazardous facilities and operations. This is achieved by applying increasingly stringent seismic design requirements commensurate with the severity of consequences from SSC failure. A key part of the method is the use of quantitative Target Performance Goals that correspond to an estimate of the mean probability of failure of the SSC to perform its safety function. These probabilistic goals are used to support selecting the return period for the DBE or the probability of exceeding the DBE and to develop a rational gradation in the design criteria and methods in ASCE xxx. They are based on extensive experience in seismic design and results from seismic risk assessments of commercial nuclear power plants. However, there is no requirement to perform a probabilistic risk assessment in order to apply these standards.

The SSC Target Performance Goals are given in Table A-1. These goals and the SSC failure consequence criteria in Table 1 of this standard have been selected to support development of seismic design loads and SSC design criteria that will protect the public, environment and the worker from hazards resulting from damages that might occur in nuclear facilities during earthquakes. The Target Performance Goals are used in ASCE xxx to establish the design criteria as a function of the SDC level for SDC-3, 4 and 5. The mean seismic failure probability of building structures designed to the IBC is estimated to be less than 1x10-3 per year. The design requirements in ASCE xxx for SDC-3 through SDC-5 have been selected to be more demanding than the building codes. The objective is for SSCs designed to SDC-3 criteria to have the probability of failing to perform their safety function be less than 1x10-4 per year. It has been judged that avoiding SDC-3 unmitigated consequences, at this probability, achieves approximately a balanced risk relative to the other SDC levels. Seismic probabilistic risk assessments of a large number of commercial nuclear power plants in the United States indicate that the mean seismic core damage frequency in nuclear power plants is about 1x10-5 per year [12]. Although unmitigated consequences of SSC failures in the facilities addressed by this standard are expected to be much less than those in nuclear power plants, the unmitigated consequences in category SDC-5 are severe enough that it is reasonable for SSCs placed in this category to have a Target Performance Goal of 1x10-5 per year. The log-linear uniform mid-point between 1x10-4 per year and 1x10-5 per year is 3.16 x10-5 per year and could have been selected as the Target Performance Goal for SDC-4. However, a value of 4 x10-5 per year was selected in recognition of the approximate nature of the Target Performance Goals and to achieve some simplification in the ASCE-xxx design methods.

Table A-1

Target Performance Goals used in ASCE-xxx

|Seismic Design Category |Target Performance Goals |

|SDC-3 |10-4/year |

|SDC-4 |4x10-5/year |

|SDC-5 |10-5/year |

Seismic risk assessments of facilities with SSCs designed using the methods in Reference 2 (similar to those specified in ASCE xxx) for earthquake levels associated with earthquakes having a 10,000 year mean return period (mean frequency of 1x10-4 per year) support that SSCs designed to the most stringent level are expected to perform their safety functions at the SDC-5 Target Performance Goal. The design methods in ASCE xxx have been graded so that at an earthquake frequency of 4x10-4 per year (mean) SSCs designed for SDC 3 and SDC 4 are expected to achieve the Target Performance Goals identified in Table A-1.

For nuclear facilities that contain small or no hazardous inventory the risks are dominated by damage to the facility and occupants and it is appropriate to apply the IBC design methods. Table A-2 summarizes the design basis earthquake frequencies and referenced methods for developing the design response spectra.

The other key factor in the procedure is the assignment of an SDC to an SSC based on the consequences of the unmitigated failure of the SSC. Unmitigated consequence analysis is a procedure that has been used by the Department of Energy for the purpose of incorporating safety in design and operation of their nuclear facilities [8, 9]. The concept is also used in 10CFR70, the U.S Nuclear Regulatory Commission’s regulation that applies to fuel cycle facilities [13] and the associated Standard Review Plan (NUREG 1520[14]). In the latter case the SSCs or procedural practices are addressed individually and their importance to reducing the likelihood of unmitigated consequences evaluated. The qualitative criteria in Table 1 for

Table A-2

Design Basis Earthquake Used with Design Methods in ASCE xxx

| | |

|Category |Frequency of Design Basis Earthquake |

|SDC-1 |U.S. Geological Service (USGS) 2500 year return period map and the IBC |

|SDC-2 |USGS 2500 year return period map and the IBC |

|SDC-3 |Use ANS 2.29 and select Uniform Hazard Response Spectrum(UHRS) at |

| |4x10-4 per year (mean), per ASCE xxx |

|SDC-4 |Use ANS 2.29 and select UHRS at 4x10-4 per year (mean), per ASCE xxx |

|SDC-5 |Use ANS 2.29 and select UHRS at 10-4 per year (mean), per ASCE xxx |

unmitigated consequence analysis were selected based on experience in accident analysis and criteria developed for NRC regulation of nuclear facilities. The criteria in 10CFR70 for guiding license applications for Special Nuclear Material were also used to develop Table 1. Quantitative consequence values very similar to the NRC guidance and consistent with the qualitative criteria in Table 1 are provided in Table A-3 for SDC –3, SDC-4 and SDC-5.[3] These values combined with the Target Performance Goals were used to judge the balance in risk over the range of design categories and may also be used to support making judgments concerning SSC categorization.

These consequence values should not be considered as mandatory requirements but may be used judiciously as guidelines for assigning SDC to an SSC. Many analytical steps and assumptions must be completed to obtain the numerical dose consequence values and the analyses frequently have a high degree of uncertainty. Selecting quantitative consequence thresholds for the SDC categories implies a precision in the accident consequence analysis that is not warranted. The qualitative criteria in this standard are intended to encourage the use of experienced judgment in making assignment of the SDCs to SSCs, with quantitative accident consequence analysis providing guidance.

Table A-3

Guidance for Seismic Design Categories

Based on Unmitigated Consequences of SSC Failures

| |Unmitigated Consequence of SSC Failure |

| | Worker | Public |

|Category | | |

|SDC-1 |No radiological or chemical release consequences but | |

| |failure of SSCs may place facility workers at risk of|No consequences |

| |physical injury. | |

|SDC-2 |Lesser radiological or chemical exposures to workers |Lesser radiological and chemical exposures to |

| |than those in SDC-3 below in this column as well as |the public than those in SDC-3 below in this |

| |placing more workers at risk. This corresponds to the|column, supporting that there are essentially |

| |criterion in Table 1 that workers will experience no |no off-site consequences as stated in Table 1.|

| |permanent health effects. | |

|SDC-3 |.25 Sv (25rem) < dose ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download