ML13206A004

Methodology for Evaluating the Potential for Multiple Dam Failures Due to Seismic Events

ML13206A004
Person / Time
Site:	Watts Bar, Sequoyah
Issue date:	06/24/2013
From:	Jack R. Benjamin and Associates
To:	Office of Nuclear Reactor Regulation, Tennessee Valley Authority
Shared Package
ML13206A001	List: ML13206A003 ML13206A004
References
Download: ML13206A004 (29)

Text

ENCLOSURE 2 METHODOLOGY FOR EVALUATING THE POTENTIAL FOR MULTIPLE DAM FAILURES DUE TO SEISMIC EVENTS

Methodology for Evaluating the Potential for Multiple Dam Failures Due to Seismic Events Prepared for Tennessee Valley Authority Knoxville, TN Prepared by Jack R. Benjamin & Associates, Inc.

530 Oak Grove Avenue Suite 202 Menlo Park, CA 94025 June 24, 2013

Table of Contents Pagqe

1. Introduction ....................................................................................................................... 10 1.1 Project Objective and Scope ..................................................................................... 10 1.2 Analysis Context ........................................................................................................ 10 1.4 USNRC ISG - Guidance for Assessment of Flooding Hazards Due To Dam Failure.. 11 1.5 Report Content .............................................................................................................. 11

2. Seism ic Risk Analysis for D am s .................................................................................... 12 2.1 Elem ents of a Seism ic Risk Analysis ........................................................................ 12 2.2 Types of U ncertainty ................................................................................................. 14 2.3 Risk Analysis for Spatial D istributed System s ........................................................ 15

3. Seism ic Evaluation Process ........................................................................................... 17 3.1 General Context ......................................................................................................... 17 3.2 Approach ....................................................................................................................... 18 3.3 Seism ic Evaluation Process ...................................................................................... 19 3.3.1 PSHA M odel ...................................................................................................... 20 3.3.2 Seism ic Fragility A ssessm ent ........................................................................... 20 3.3.3 System s Analysis ............................................................................................... 20 3.3.4 Seism ic Risk Quantification ............................................................................. 23 3.3.5 A ssessm ent ........................................................................................................ 23

4. Ground M otion Correlation M odeling .......................................................................... 25

• 5. Seism ic Fragility Representation ................................................................................. 28 5.1 Overview ....................................................................................................................... 28 5.2 Methodology ................................................................................................................. 28 5.3 Steps in the Fragility Evaluation ............................................................................... 31

6. Summ ary ........................................................................................................................... 33

7. References ......................................................................................................................... 34

1. Introduction This document describes a methodology for evaluating the likelihood that multiple dams upstream of a nuclear power plant could fail as a result of a seismic event. The approach described presumes that an initial screening evaluation has been performed in which the following questions were evaluated and answered in the affirmative:

• If a combination of multiple upstream dams were to fail' during a seismic event, would the resulting flood pose a hazard to a plant located downstream?

• Are multiple dams in proximity to one another such that a seismic event could produce strong ground motion at each site simultaneously?

Given these circumstances the methodology described in this document, takes the notion of screening one step further by evaluating whether the likelihood (as measured by the frequency of occurrence per year) of multiple dam failures is low enough that this potential source of external flooding can be screened out.

A direct approach to this problem would be to perform a full-scope seismic risk analysis (discussed in Section 2) for the system of upstream dams to determine the likelihood that flooding at a plant could occur. Such an evaluation is a significant undertaking, particularly as the number of dams increases. As an alternative this report describes an interim, conservative, risk-based approach that can be used to assess whether the likelihood of multiple seismically initiated dam failures in fact requires more detailed evaluation or whether they can be screened out.

1.1 Project Objective and Scope The purpose of the methodology described is to present a risk-based approach for evaluating the potential that multiple dams could experience strong ground shaking from the same earthquake, thus creating the potential that multiple dam failures might occur, effectively simultaneously and lead to flooding at a downstream nuclear plant site. In the general case, if such an event could occur, it is of interest to know if this is a likely event; has a relatively high frequency of occurrence, or conversely has a very-low frequency of occurrence and therefore does not need to be explicitly considered as a potential external flood hazard to a nuclear power plant or as part of a seismic safety assessment.

The scope of this document is to describe a methodology to address this problem and submit it to U.S. Nuclear Regulatory Commission (USNRC).

1.2 Analysis Context The following lists features or aspects of the methodology that is presented.

" The analysis considers only earthquake ground motion hazards that may occur at multiple dam sites. Other seismic hazards that may be initiated by a seismic event such as seiche in reservoirs, landslides or rock slides, fault displacement, etc. are not addressed.

• The following aspects of a seismic risk analysis of dam failure and downstream flooding are not addressed probabilistically in the methodology described here 2:

- dam breach and inundation, Dam failure as used in this document refers to the breaching and uncontrolled release of a reservoir.

2 Each of the items listed would be considered probabilistically in a full-scope seismic risk analysis (see Section 2).

- operational features of dams such as opening of gates or other hydraulic systems,

- unsatisfactory performance of spillways (e.g., due to high flow rates), and

- possible combination of events such as inflow floods and earthquakes.

1.4 USNRC ISG - Guidance for Assessment of Flooding Hazards Due To Dam Failure The USNRC staff has prepared a draft Interim Staff Guidance (ISG) on the subject of flood hazards at nuclear power plant sites due to upstream dam failures (USNRC, 2013). With respect to seismically-initiated dam failures, the draft ISG provides guidance on a number of subjects. It describes a screening methodology to assess whether multiple upstream dams should be considered in a seismic evaluation. In addition, the ISG also outlines a risk-based screening approach for evaluating dams.

With regard to the first of these topics, this report assumes an initial screening has been performed and concluded that multiple dams are located in such proximity as to be considered a potential flood hazard. (This also assumes of course that it has been determined that upstream dam failures also produce flood levels that would present a hazard to a plant.)

On the second topic the ISG does provide guidance with regard to a probabilistic screening criterion. This guidance is used as part of the evaluation process described in this document.

1.5 Report Content Section 2 provides an overview of the elements of a full-scope seismic risk analysis for dams.

This overview provides a general and a point of departure for defining a conservative, risk-based screening evaluation process.

Section 3 describes the seismic evaluation process.

Section 4 describes the modeling of the correlations associated with earthquake ground motions for problems involving spatially distributed systems.

Section 5 discusses the assessment of seismic fragilities for dams and outlines the conservative approach that will be used.

Summary remarks are given in Section 6 and references cited in the report are provided in Section 7.

2. Seismic Risk Analysis for Dams This section provides an overview of the elements of a 'full-scope' seismic risk analysis for dams. The purpose of this section is to provide a context for the evaluation process presented here. The elements of a seismic risk analysis are described for the typical case of a single dam.

Factors associated with the evaluation of a spatially-distributed system of dams are discussed at the end of this section.

2.1 Elements of a Seismic Risk Analysis Figure 2-1 shows a schematic of the elements of a seismic risk analysis for a dam system. For purposes of this report, the probabilistic assessment of consequences of flooding such as economic damage, public health consequences are not considered. The focus of this overview will be on the other aspects of a risk analysis.

Seismic Hazard Analysis - The purpose of the seismic hazard analysis is to estimate the frequency of occurrence of earthquake ground motions that may occur at a site. The analysis includes an evaluation of the aleatory and epistemic uncertainty in the analysis, including model and parametric uncertainties (SSHAC, 1997; USNRC, 2012).

Fragility Analysis - Given the occurrence of ground motions at a dam site, the fragility analysis estimates the conditional probability of failure of structures, systems and components (SSC) as a function of the ground hazard (e.g., peak ground acceleration). As part of the fragility analysis of major water retaining structures, the fragility analysis may also need to evaluate the potential for damage (non-failure or uncontrolled release of the reservoir) and post-seismic in-stability. If significant, non-breach damage occurs, the potential for failure may exist since the dam must still withstand the hydrostatic forces of the reservoir until it can be lowered (e.g., Lower San Fernando Dam following the 1971 earthquake). As part of the fragility analysis the seismic (and as applicable other) failure modes are identified and evaluated. The fragility analysis includes the assessment of sources of aleatory and epistemic uncertainty in estimating the seismic capacity of SSCs.

Elements of a Seismic Risk Analysis Figure 2- 1 Elements of a seismic risk analysis for dams.

Systems Modeling - The systems part of the risk analysis models the response of a dam system to earthquake ground motions. Using event and fault tree models the sequences of events that may lead to uncontrolled release of the reservoir are evaluated. The systems analysis is specific to a dam system and may include the immediate failure of water retaining structures, the failure of hydraulic control systems (e.g., gates, outlets, operating systems, etc.)

and the random occurrence of events (e.g., failure of emergency diesel generators to start).

Dam Breach and Inundation Assessment - Given a breach of a dam, which might occur at different locations and in different modes (e.g., overtopping due to excessive vertical deformation of the dam crest, piping following deformation and cracking of an embankment), the character of the breach opening (size and timing) and the downstream inundation are evaluated. There is considerable aleatory and epistemic uncertainty in the assessment of breach characteristics. The extent to which sources of uncertainty have an important effect on downstream flooding depends on the distance to other downstream dams or nuclear power plant. In addition, the reservoir levels and the inflows at the time of the earthquake may be important.

Risk Quantification and Uncertainty Analysis - The final part of the risk analysis is the probabilistic combination of the elements of the analysis to estimate the:

• Frequency of occurrence of uncontrolled release of the reservoir, and the

" Frequency of exceedance distribution on downstream flood levels.

As part of the quantification, the epistemic uncertainties in the hazard, fragility and dam breach and inundation parts of the analysis are propagated through the calculation process to estimate the uncertainty in the estimated frequency of uncontrolled release and the frequency of downstream flooding. An illustration of these results is shown in Figures 2-2 and 2-3.

In Figure 2-2 the probability distribution on the estimate of the frequency of dam failure is a product of the propagating the epistemic uncertainty in the seismic hazard and the fragility analysis through the systems model.

The distribution quantifies the epistemic uncertainty in C

the estimate of the fre- Mean Frequency quency of failure pf Failure Frequency of Occurrence of Dam Failure per Year Figure 2- 2 Illustration of the probability distribution on the frequency of dam failure.

Figure 2-3 shows the uncertainty in the estimate of flood hazard curves at a site where the uncertainty in the frequency of failure and in the dam break and inundation analyses are propagated through the risk calculation.

1 E-01

& 1.E-02 0.0 LL ----

1E-03 0 5 10 15 20 25 30 Elevation (ft)

Figure 2- 3 Illustration of flood hazard curves, including the uncertainty in the estimate of the flood hazard at a site.

In addition to these results, the risk analysis will also provide information that disaggregates the contributors to dam failure (e.g., earthquake magnitudes) and the sequences of events that result in dam breaching and uncontrolled release of the reservoir.

2.2 Types of Uncertainty There are two general types of uncertainty that affect and contribute to the estimate of the frequency of dam failure and flooding. These are referred to as: aleatory and epistemic uncertainty. The first, aleatory uncertainty is attributed to the inherent randomness of events or properties. These events are predicted in terms of their frequency of occurrence or the fraction of the time an event or property (i.e., material strength, spatial variability of soils, etc.) is realized. An example of a source of aleatory variability is the frequency or rate of future earthquake occurrences on a fault.

Epistemic or knowledge-based uncertainty is attributed to lack-of-knowledge about events, or physical processes that limit the ability to model events of interest. A second type of knowledge uncertainty is attributed to limitations in available data (amount and quality) that impact the estimate of model parameters (parametric epistemic uncertainty). When data are limited,

parameter estimates may be quite uncertain (i.e., statistical confidence intervals on parameter estimates are large).

To systematically identify and assess uncertainties it is useful to construct a framework or taxonomy to partition the types of uncertainty in terms of their effect on models and estimates of model parameters (Abrahamson, et al., 1990; URS/JBA, 2008; IPET, 2009). Table 2-1 shows the taxonomy for characterizing the sources of uncertainty and their type in the context of models and model parameters. The framework in Table 2-1 has a number of benefits in developing and quantifying a risk model. First, it offers a guide to ensure that all sources of uncertainty are identified. Second, it supports the characterization of uncertainties as aleatory or epistemic, which for many problems can be difficult to assess. Lastly, a clear framework and accounting of sources of uncertainty avoids double counting or failing to identify and account for uncertainties.

The evaluation of epistemic uncertainties is a key component in the evaluation of extreme events (hazards, failure of critical facilities) and a required element of probabilistic risk analyses for nuclear power plants (ASME, 2009).

The standard of practice in the dam engineering community does not evaluate epistemic uncertainties.

Table 2- 1 Taxonomy / Partitioning of Uncertainties I Types of Uncertainty Element Epistemic Aleatory Modeling Uncertainty about a model and the degree to Aleatory modeling variability is the which it can predict events. Model, epistemic variation not explained by a model. For uncertainty addresses the possibility that a instance, it is variability that is attributed to model may systematically (but not necessarily elements of the physical process that are not predictably), over- or under-predict modeled and, therefore, represents events/results of interest (i.e., deformations). variability (random differences) between model predictions and observations.

Parametric Parametric epistemic uncertainty is associated This uncertainty is similar to aleatory with the estimate of model parameters given modeling uncertainty. However, this is available data, indirect measurements, etc. variability that may be due to factors that are random, but have a systematic effect on model results.

The current standard of practice in conducting PSHA's is to explicitly model the sources of model and parameter uncertainty in the seismic source characterization and the ground motion modeling parts of the analysis (SSHAC, 1997; USNRC, 2012). The result of modeling these uncertainties is a quantification of the uncertainty in the frequency of exceedance of earthquake ground motions. In the same manner there is epistemic uncertainties that are evaluated as part of the seismic fragility of SSCs (EPRI, 1994).

2.3 Risk Analysis for Spatial Distributed Systems For the special class of seismic risk analysis problems that involve spatially-distributed systems (such as electrical, gas or water distribution systems) or portfolios of individual structures (such as a portfolio of insured properties) there are a number of factors that are not (do not need to be) considered in a risk analysis for a single facility (Park, et al, 2007; URS/JBA, 2008; McCann,

2011). For such systems, the potential for system failure or the occurrence of simultaneous failures must take into account sources of correlation associated with earthquake occurrences and ground motions, and as applicable the dependencies in system performance.

In the particular case involving multiple dams upstream of a nuclear power plant, the potential for multiple dam failures may be a function of the ground motions that cause dam failure, or the flood caused by the failure of an upstream dam.

3. Seismic Evaluation Process This section describes a process for evaluating the potential that multiple dam failures could occur as a result of a seismic event. The analysis is intended as a conservative screening evaluation that takes into account many (though not all) of the elements that would be explicitly evaluated in full-scope seismic PRA for a spatially distributed system of dams that may simultaneously experience ground motions for an earthquake.

3.1 General Context The general problem addressed by the methodology in this document is the circumstance where multiple dams are located upstream of a nuclear power plant as conceptually illustrated in Figure 3-1. It has been determined (in a separate analysis) that failure of combinations of dams could produce flood levels that would pose a flood hazard to the plant. In addition, a prior assessment has determined the dams are co-located such that a single seismic event may produce ground motions that could challenge the integrity of multiple dams.

A series of dams on a river system Earthquake Source

• U U

U U

U U

AA1,16 I-W -11111v"tr Figure 3- 1 Conceptual illustration of a series of dams co-located upstream of a nuclear power plant.

As part of this analysis, the potential impact that an earthquake may have on both upstream dams and the plant is not addressed.

For purposes of the methodology presented here, the details of the flood hazard (travel time to the plant site, level of flooding at the plant, etc.) are not considered. The context of this analysis is simply to assess (conservatively, as described later) whether the potential (frequency of occurrence) for flooding occurring at all (as a result of any combination of dam failures) is low enough that it can be screened out as a source of external flooding.

A key input to this evaluation are the results of an evaluation that has determined which combinations of dam failures would result in downstream flooding at a plant.

Dams may be exposed to a number of different hazards; earthquakes, inflow flood events, intrinsic forces and factors, and possibly the combination of hazards. The focus of this analysis is the evaluation of the potential for flooding due to dam failures resulting from earthquake ground motions only. Other seismic hazards and the possible combination of events such as an earthquake and a 100-year flood event on a river system are not evaluated.

3.2 Approach This section provides an overview of the risk analysis that is the basis for the evaluation process. Given the occurrence of an earthquake in the regional vicinity of a group of dams (see Figure 3-1), earthquake ground motions may occur that challenge the seismic integrity of multiple dams simultaneously. The ground motions that occur at each dam site will be a function of:

• Earthquake magnitude,

• Inter-earthquake ground motion variability,

• Distance of each dam from the earthquake source,

• Site conditions at each dam site, and the

" Separation distance between the dams in the region.

These factors, which are described in Section 4 have different effects on the ground motions that will occur at each dam site; some have a systematic effect of leading to higher or lower ground motions at all dam sites (earthquake magnitude, inter-earthquake variability), whereas others are site-specific. In addition, ground motions are highly random and for a given earthquake event correlated. Depending on the number of upstream dams that may pose a hazard to a plant, these factors may have an important effect on the frequency of occurrence of ground motions and the potential for dam failure.

For the general case where flooding can occur as a consequence of multiple dam failures, the potential for such an occurrence is a function of the ground motions at each site and the seismic fragility of each dam. For a simple case of two dams, where both must fail for flooding to occur at the plant, the chance this occurs given an earthquake at a particular location in the regional vicinity of the dams can be denoted, P(DamA & DamB FailingIm,xE) = fP(DamA Im,xE) P(DamB Im,xE)f(a(m,XE,XA,XB,AAB)) da (3-1)

where, m = earthquake magnitude, xE = earthquake epicenter location XA = location of DamA xB = location of DamB AAB = separation distance between DamA and DamB f(a(m,xE,xA,,xB,AAB) = joint probability density function of correlated ground motions at DamA and DamB due to an earthquake of magnitude m at a location XE

Equation 3-1 reflects a number of key aspects of the risk analysis to be performed. The first is the fact that flooding is a function of both dams failing (a parallel system), and therefore the fragility of the two dams are multiplied, having the same effect as redundant components in a system. The second aspect represented in the equation is the fact the ground motions that occur at the dam sites are correlated. These sources of correlation are described in Section 4.

Since earthquakes can occur with different magnitudes and at different locations throughout a region, and thus produce different ground motions at each dam site, the distribution of these possibilities must be considered to estimate the frequency of occurrence of multiple dam failures. In the two dam example, the frequency of DamA and DamB failing for earthquakes of any magnitude, occurring at any location for a single seismic source is, v(DamA & DamB)i=J v(m,xE)iP(DamA & DamBlm,BxE)dXEdm (3-2) mXE

where, v(m,xE)i = annual frequency of occurrence of earthquakes of magnitude m occurring at a location XE, in seismic source i (as modeled in the PSHA)

In the more general case, there may be multiple sequences (combinations of upstream dams that could fail during a seismic event) that result in flooding at a plant. In this case, equation 3-2 can be expanded as follows:

v(Dam Failure & Plant Flooding),= Xv(Dam Failure & Plant Flooding)ij (3-3)

All Sequences where the sum is carried out over all sequences of dam failures that result in flooding at a downstream plant for a seismic source i.

The total frequency of failure, considering all seismic sources in the region is:

v(Dam Failure & Plant Flooding)= jv(Dam Failure & Plant Flooding), (3-4)

All Seismic Sources where the sum is carried out over all seismic sources in the PSHA model.

3.3 Seismic Evaluation Process In the draft ISG for evaluating dam failure, the USNRC (2013) indicates that an annual frequency of occurrence of external flooding of 10.6 per year can be used as a level for screening events, such as external floods associated with dam failures. As noted in the ISG, such an analysis must be 'combined with reasonable qualitative arguments, the realistic probability can be shown to be lower' (USNRC, 2013).

This section describes the elements of an evaluation process to assess whether the potential for flooding at a nuclear power plant site due to seismically initiated upstream dam failures can be screened out. The analysis, as recommended here, is based on the following:

• PSHA consistent with that used for a plant seismic evaluation,

• Conservative estimate of the seismic fragility of upstream dams, including the potential there may be multiple seismic failure modes (i.e., multiple structures that comprise a dam system) that result in uncontrolled release of the reservoir,

• Identification and explicit evaluation of the multiple sequences (combinations of dam failures) that could lead to downstream flooding at a nuclear power plant site, and

• An assumption that all modeled dam failure sequences result in flooding at the plant site with certainty.

The key element in this process is the assessment of the seismic fragility for upstream dams. In general, pre-existing seismic fragility results will not be available. Since such an assessment can be a time-intense effort and given the purpose of this analysis to assess whether seismically initiated upstream dam failure events can be screened out, a conservative assessment of the seismic fragility of dams will be made. If on this basis it can be shown that, v(Dam Failure & Plant Flooding) < 10-6 per year (3-5) the requirements of 10 CFR Part 100 will be met as described in the USNRC's draft ISG.

Figure 3-2 provides a flow diagram of the elements of the evaluation process.

In the following paragraphs the elements of the evaluation are described.

3.3.1 PSIHIA Model It is recommended the PSHA input to the seismic evaluation be the same PSHA model that is required by the USNRC for plant seismic probabilistic risk assessments (USNRC, 2012) which is a SSHAC Level 3 or 4 analysis. For sites in the CEUS, this would entail the use of the recently complete CEUS seismic source characterization (SSC) model (EPRI/USGS/USNRC, 2012) and the EPRI 2004/2006 ground motion model (EPRI, 2004; EPRI, 2006). For sites in the western U.S. a site-specific analysis may need to be supplemented to incorporate seismic sources not included in the plant PSHA.

These elements of the PSHA must be combined with a ground motion correlation model to estimate the frequency of occurrence of spatially distributed, correlated ground motions at the dam sites (discussed in the next section).

3.3.2 Seismic Fragility Assessment A critical component of the seismic evaluation is the assessment of the seismic fragility of upstream dams. Given there are likely no available seismic risk studies and accompanying fragility estimates for upstream dams, a conservative approachis taken that is built in part on seismic fragility concepts/tools used in the nuclear industry. As noted in Section 2, the methodology described is designed to address the case where multiple dam failures could occur and result in flooding at a plant.3 Section 5 presents further discussion of the recommended approach for the fragility analysis.

3.3.3 Systems Analysis The purpose of the systems part of the analysis is to model the combination of dam failures that could lead to flooding at a plant. The identification and modeling of dam failure combinations must consider:

3 This is not to say that sequences involving single dam failures are not or cannot be considered. Rather, it is to point out that given that multiple seismically initiated failures must occur for flooding at a plant to occur, the implication of a conservative fragility analysis may be reasonable basis for a screening analysis. If only a single dam failure is required to produce flooding at a plant, it is less likely that a conservative approach will be adequate to demonstrate that dam failures can be screened out.

• Dam failures that are initiated by earthquake ground motions, and

• Dam failures whose downstream releases could lead to failure of other downstream dams due to overtopping, hydrodynamic loading, etc.

PSHA Model Seismic Fragility (i.e., For the CEUS, new SSC Analysis for Dams Model & EPRI (2004/2006)) (Conservative Assessment Based on Existing Seismic Evaluations)

L Ground Motion Systems Model Correlation Model (Defines the combinations of dam failures that may lead to flooding)

I F M0~

(A -

Seismic Risk Quantification (Estimate the mean frequency of occurrence of all combinations of dam failures that may lead to flooding) k 4

Is/the frequency of>~

No possible combinations of dam Opportunity damto re-

!ý<foevaluated failure <10 per ragili ity to stim t s.?

S year? ragility estimates?

Y Yes Yes No End Figure 3- 2 Flow diagram of the seismic evaluation process.

To identify the possible combinations of dams that may present a flood hazard at a plant, a series of dam break and flood routing calculations must be performed to identify which dams and combinations could lead to flooding at a plant.4 Each of the possible combinations is identified and modeled (an event tree model will be developed). Figure 3-3 shows an example of a seismic event tree model.

3.3.4 Seismic Risk Quantification The quantification of the seismic risk model involves the combination of the PSHA model (including a ground motion correlation), the seismic fragility estimates for the upstream dams, and the systems model to estimate the frequency of occurrence of each dam failure sequence as well as the total frequency of occurrence of all sequences. Because of the complexity associated with modeling the correlation of earthquake ground motions and the performance (potential for failure) of multiple upstream dams, a coupled, numerical integration and Monte Carlo simulation approach is used to conduct the seismic risk quantification (URS/JBA, 2008).

The quantification process will estimate:

• Frequency of occurrence of each sequence of multiple dam failures that could result in flooding at the plant,

• The total frequency of multiple dam failure sequences that could lead to flooding at the plant, and

" Relative contribution of each sequence to the possibility of plant flooding.

3.3.5 Assessment If the results of the analysis indicate the frequency of dam failures is less than 108 per year, the case can be made that upstream dam failures can be screened out as a potential source of external flooding, and the actual frequency of such events is lower than what has been estimated in the risk calculation.

Alternatively, if the frequency of dam failures is greater than 108 per year, the analyst may examine the risk quantification results to identify opportunities where further evaluation of one or a number of dams may be re-considered, given the initial conservative assessment that was performed. If such opportunities are available, further evaluation of the seismic fragility estimates can be made and the risk quantification updated with the new fragility estimates.

Before deciding if this step should be taken, sensitivity studies can be carried out to assess whether reasonable changes in the seismic fragility of one or more dams would meet the 106 screening criterion. If the sensitivities conclude an improved outcome might be achieved, a decision to do detailed fragility analysis could be considered. If this is not the case, then a full-scope seismic risk analysis for the dams can be considered to more accurately and completely evaluate the dam failure flood hazard at the plant site.

4 Note, the results of dam break and inundation assessments are not required to perform the seismic risk calculations described here. A systems model could be constructed that considers all possible combinations of dam failures. The risk analysis will calculate the frequency of occurrence of each combination. Once the combination of dam failures that actually lead to flooding at a plant is determined, the frequency of occurrence of these sequence can be taken from the analysis results to estimate the frequency of flooding at the plant (by simply summing the frequency of occurrence of each combination of dam failures that is determined to lead to flooding; see equations 3-3 and 3-4).

Earthquake DWUA Dame Damc Sequence Outcome I OK, no plant flooding 2 OK, no plant flooding 3 OK, no plant flooding 4 Plant Flooding 6 OK, no plant flooding 6 Plant Flooding Figure 3- 3 Example of an event tree showing the combination of upstream dam failures that result in plant flooding.

4. Ground Motion Correlation Modeling A key component in evaluating the seismic risk for spatially-distributed systems is the estimate of earthquake ground motions. For these systems (in this case a series of dams that are co-located with respect to one another and the location of future earthquakes) the spatial field of ground motions must be estimated that takes into account:

" Source-to-site distance of each dam from the earthquake (see Figure 4-1),

" The separation distance between the dams (see Figure 4-1), and the

" The inter-event variability of between earthquakes of the same magnitude (see Figure 4-2).

Each of these factors has important implications with regard to the level of ground motion that occurs at each dam site and the relationship of ground motions between sites.

The first term, the source-to-site distance determines the first-order level of ground shaking at each dam site (for an earthquake of a given magnitude and faulting style). The source-to-site distance is the basis for defining the median ground motion amplitude that may occur at each site.

A series of dams on a river system 4- -

• Site-to-site separation distances Earthquake Sour i

, 1, Source-to-site distance m

- 111111" 1 1-

--- jjjq""t' , -

Figure 4- 1 Illustration of the earthquake source-to-site distance and the site-to-site separation distance between dam sites.

Empirical studies show there is significant aleatory uncertainty in earthquake ground motions.

Logarithmic standard deviations are typically about 0.60 (Chou and Youngs, 2008) which produces a +/- two standard deviation range of approximately a factor of 11. Analysis of the residuals of earthquake ground motions suggest they can be represented by, Cu= ;+q - 4, (4-1)

where,

e. = residual of the jth strong motion recording (at an individual recording station) recorded during the ith earthquake, relative to the overall mean ground motion (the mean over all earthquakes and ground motion recordings) r, = event term for the ith earthquake; this is the average, systematic deviation of the residuals of ground motions associated with an individual earthquake relative to the overall mean ground motion estimated for all earthquakes;

ý'Y = intra-event variability for the jth strong motion recoding (at an individual recording station) due to the ith earthquake; this is the variability associated with the ground motions for an individual earthquake relative to the mean for that event.

The logarithmic standard deviation of the event terms (the r 1's ) is approximately 0.31 and the intra-event variability is approximately 0.51.

The inter-event variability is associated with the random, but systematic difference between earthquakes of the same magnitude. It is a source of parametric aleatory uncertainty (see Table 2-1). The inter-event term is attributable to random differences between earthquakes (i.e., stress drop) of the same magnitude, where the ground motions from individual earthquakes are on average, systematically different from the average trend over all earthquakes. These event-to-event terms (so-called tau effect) are shown graphically in Figure 4-2. In terms of evaluating the seismic risk for a portfolio of dams, the tau effect says that ground motions at all sites may be systematically higher or lower for a given earthquake.

ffM!, FS, d)

C C- Data from 2

(.9 IrKividual" Ear'thouakes

• Ti = inter-event term for earthquake i Distance (km)

Figure 4- 2 Illustration of the inter- and intra-event variability of earthquake ground motions.

The last source of correlation is the random field of model, aleatory uncertainty. Within the spatial field of ground motions that is produced by an earthquake, studies have evaluated the correlation between locations of strong-motion recordings as a function of their separation distance.

Figure 4-3 shows an estimate of the correlation coefficient for ground motions estimated by Boore, et al. (2004). For spatially co-located systems with relatively small separation distances

(<5km, the correlation coefficient is greater than 0.5 indicating that if the ground motions at one site are high, there is a high likelihood that motions at nearby sites are also high. Similarly, if motions are low, they are likely low at nearby sites. As separation distances increase, the correlation decreases, but does not go to zero.

1.1

• 0.9 -------------- -- ---- ... . .

0.8 -------- - -

._ 0.5 0.4 0.2 0 20 40 60 80 100 Distance (km)

Figure 4- 3 Example of the correlation coefficient for earthquake ground motion as a function the separation distance between locations.

5. Seismic Fragility Representation 5.1 Overview The seismic fragility assessment of nuclear power plant structures, systems and components has been carried out for over thirty years. While such experience does not exist for dams, the principles and methods used in the nuclear industry and in earthquake engineering in general can be applied to dams.

The standard seismic fragility model represents the seismic capacity (fragility) in terms of the double-Lognormal model (see Figure 5-1) which models the aleatory and epistemic uncertainty in seismic capacity (EPRI, 1994). The seismic fragility of structures based on the double-Lognormal model can be generally depicted as shown in Figure 5-1. The figure shows both the aleatory and epistemic uncertainty in the fragility. Three parameters define the double-Lognormal model:

• Median seismic capacity of the structure (A),

• Logarithmic standard deviation for aleatory variability (aA),

• Logarithmic standard deviation for the epistemic uncertain in the estimate of the median

( 7E ).

The median capacity corresponds to the ground motion at which there is a 0.50 chance of failure. The logarithmic standard deviation for aleatory variability quantifies the randomness in structure performance due to inherent variability in material properties and ground motion spectral and time history characteristics.

The logarithmic standard deviation for the epistemic uncertainty quantifies the uncertainty in the estimate of the median capacity due to sources of modeling and parametric uncertainty. It corresponds to the uncertainty in knowing where the fragility distribution should be centered. A 2 2 composite or total uncertainty °-c is equal to tto-A + o-E . The median and the composite standard deviation can be used to define the mean fragility curve (see Figure 5-1).

In this analysis the properties of the Lognormal model and seismic margin concepts will be used to make a conservative estimate of the seismic fragility of dams.

5.2 Methodology For purposes of this analysis, a conservative estimate of the seismic fragility of dams will be made. The assessment will be based on the results of available seismic evaluations. The results of these evaluations which for older projects will involve estimates of a factor of safety, will be used to determine the ground motion level that can be associated with the High-Confidence-of-a-Low-Probability-of-Failure (HCLPF) for the dam (see Figure 5-1). This concept is also illustrated in Figure 5-2 which shows the mean fragility curve and the HCLPF level.

The HCLPF is the ground motion at which there is a 0.95 confidence that the conditional probability of failure is 0.05 (see Figure 5-1). Ifthe mean fragility curve is used, the HCLPF corresponds to the 0.01 conditional probability level (see Figure 5-2).

For purposes of the screening analysis, it is only necessary to show the chance of multiple dam failures is low enough (as described above). It is not necessary to make a best estimate of the seismic fragility of dams and thus of the frequency of dam failures, since the frequency of dam failures must be shown to be low enough. In terms of the fragility assessment of the dams, this

approach translates into needing to show conservatively that dams have some minimum seismic capacity such that the combination of 1

I..

S0.9 LL 0.8 0 0.7

. 0.6

.U

.0 0.5

o. 0.4 0

= 0.3

= 0.2 0

o 0.1 0

4.51 PGA (g)

Figure 5 - 1 Illustration of the parameters of the double-Lognormal seismic fragility model.

1~

0.9 HCLPF =ground motion U. 0.8 corresponding to a mean 0 0.7 conditional probability of failure of 0.01 0.6 S 0.5

c. 0.4 0.3 0

0.2 0 0.1 0

0 0.5 1 1.5 2 2.5 3 PGA (g)

Figure 5 - 2 Illustration of the approach for estimating the seismic fragility for dams based on existing evaluations.

failures during an earthquake is low enough that the overall frequency of occurrence is low (i.e.,

< 10.6 per year).

Based on the results of existing seismic analyses (or new analyses where existing information does not exist), a ground motion is identified where there is,

• A low chance of failure, and

• Margin beyond this ground motion such that at slightly higher ground motions, the dam does not have a high probability of failing (there is no cliff or brittle behaviour expected).

This ground motion level will be defined as the HCLPF for the dam.

The objective of the seismic fragility analysis is to relate the results of existing seismic analyses for dams to a conservative estimate of the fragility parameters. Typically, a seismic evaluation will be carried out for an earthquake of a given magnitude (an estimate of the maximum credible earthquake at the time) and a ground motion (peak ground acceleration and response spectrum). Using a standards-based approach, a factor of safety would be calculated for the critical failure mode(s). The evaluation methods that are carried out, generally do not evaluate the expected performance of the dam at failure (or incipient failure). Therefore a factor of safety of 1.0 does not correspond to dam failure or even incipient dam failure and uncontrolled release of the reservoir. It should be noted however, that modern evaluations do in fact estimate performance, such as estimates of embankment deformation, loss-of-freeboard, etc. In general there will be margin between the ground motion at which the seismic analysis performed and the motions that are likely to cause dam failure.

Using these concepts and the HCLPF approach, the following generalized model can be used to estimate the seismic fragility of dams, based on existing available seismic evaluations. The HCLPF can be estimated using the following relation:

HCLPF = PGAE

• Fs

• Fp (5-1)

where, PGAE = peak ground acceleration used in the seismic analysis Fs = calculated factor of safety in the existing analysis Fp = estimated margin that may exist between the existing calculations and a more realistic performance state Fp is a parameter that will be specific to the failure modes that are analyzed and the analysis method that was used. For cases in which there is no information, this parameter will be 1.0. As described in the next sub-section, the results of existing seismic analyses must be reviewed to determine the parameters in equation 5-1.

Once an estimate of the HCLPF is determined, the seismic fragility for the dam can be defined.

Based on the results of seismic fragility assessments for nuclear power plant structures, some dams and levees values of the combined logarithmic standard deviation (Oc) tend to be in the range of 0.30 to 0.60 (EPRI, 1994; URS/JBA, 2008). Assuming a value for ac, the median seismic capacity can be determined by the following relation, A = HCLPF e 2.645*ac (5-2)

For purposes of this evaluation it is conservative to use a value for 0 c that is in the lower end of this range; 0.30-0.40. The estimate of the fragility for the dam and the results of the risk calculation will be relatively insensitive to the choice of the ac value in this range (see Figure 5-3). A lower value in this case produces a lower estimate of the median seismic capacity of the dam, which is conservative.

1.00 U.

cc 0.90 0

I.- 0.80 0.70 c-0.60

.00 0.50 n.

0.40 0

0.30 0C C.) 0.20 0.10 0.00 0 0.5 1 1.5 2 2.5 3 PGA (g)

Figure 5 - 3 Illustration of the variation in the seismic fragility as a function of the combined logarithmic standard deviation.

The foregoing description is applicable to a single structure and single failure mode; for example an embankment dam and slope stability failure. If there are multiple structures and multiple modes of failure that could lead to uncontrolled release of the reservoir for a particular dam system, these must be taken into account since the overall fragility for the dam system as a whole will be a function of the multiple failure modes. This concept is illustrated in Figure 5-4.

When there are multiple structures/failure modes, the fragility for each must be estimated and an overall fragility for the dam system determined.

5.3 Steps in the Fragility Evaluation This section identifies the high-level steps to be carried out to conduct the seismic fragility analysis5.

1. Data Gathering - Gather data on seismic analyses that have been performed for the dams that will be considered in the seismic risk analysis. In addition new information on properties, etc. that may be relevant to assessing the seismic capacity of the dams should be identified and retrieved.

5Note, these steps apply to the fragility analysis only. The steps listed assume the list of dams that must be considered have been identified in a separate evaluation.

2. Potential Failure Mode Analysis Results - Obtain results (if available) of potential failure mode analysis studies that may have been performed for the dams under consideration.

If a PFMA has not considered seismic events, a high level PFMA should be conducted.

3. Seismic Dam Systems Model - For each dam develop a high-level systems model to identify the sequences of events (structure failures) that can lead to uncontrolled lease of the reservoir. The purpose of this step is to identify the number of system level failure modes that lead to uncontrolled release of the reservoir. For each system level failure mode the critical structural failure mode(s) is also identified.

Dam System with Three Failure Modes 1

0.9 LL.

0.8 U-0 0.7

3 0.6 0.5 0.

L5 0.4 0.3 CL 0 0.2

0. 0.1 0

0 0.5 1 1.5 2 2.5 3 PGA (g)

Figure 5 - 4 Comparison of the fragility for a dam system based on the number of failure modes. In this example the seismic fragility of the individual failure modes was assumed to be the same.

4. Estimate Dam Fragility - For each dam structural failure mode, develop an estimate of the HCLPF based on available information. Ifprior seismic calculations are not available, limited calculations should be performed. As part of the estimate of the HCLPF, the sources of conservative (and unconservative, if any) bias in prior analyses should be identified. The objective is to develop a basis for estimating Fp in equation 5-1 and to document the basis for stating that the fragility assessment is a conservative estimate of the true fragility of the dam. An appropriate estimate of the combined logarithmic standard deviation should be selected for each failure mode.

5. Estimate the Dam System Fragility - Based on the systems model for a dam and the dam failure mode fragility curves, determine the system level fragility for the dam. This fragility curve will be used in the risk quantification.

6. Summary This document has described a conservative, risk-based approach to evaluate the likelihood that multiple dams in a region could experience strong ground shaking from the same earthquake creating the potential that multiple failures would occur (effectively simultaneously) and lead to flooding at a downstream nuclear plant site. The method is not a replacement for a full-scope seismic risk analysis, rather it is a conservative evaluation to assess whether the potential for flooding from upstream dam failures can be screened out as a design basis event.

The implementation of the methodology for a plant site may lead to the following outcomes:

1. Determine the mean frequency of occurrence of seismically initiated dam failures is less than 10-8 per year and therefore can be screened out from further evaluation, or

2. Identify the upstream dams that are the dominant contributor to the likelihood of flooding sequences. These dams could be the basis for detailed fragility analysis and the basis for re-assessment, or

3. Determine the frequency of occurrence of dam failures leading to flooding is sufficiently high that screening upstream dam failure is not possible.

In the event the later outcome is realized, the plant owner would have the option to perform a full-scope seismic risk analysis, eliminating sources of conservatism, making a more realistic (unbiased) estimate of the potential for upstream dam failure and a direct estimate of the frequency of flood levels at the plant.

7. References Abrahamson, N.A., Somerville, P.G. and Cornell, C.A. (1990). Uncertainty in Numerical Strong Motion Predictions, Proceedings of the Fourth U.S. National Conference on Earthquake Engineering, May 20-24, 1990, Palm Springs, California, Earthquake Engineering Research Institute.

ANSI/ASME/ANS RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications."

Boore D.M., Gibbs J.F., Joyner W.B., Tinsley J.C., and Ponti D.J. (2003). Estimated Ground Motion from the 1994 Northridge, California, Earthquake at the Site of the Interstate 10 and La Cienega Boulevard Bridge Collapse, West Los Angeles, California, Bulletin of the Seismological Society of America, 93(6), 2737-2751.

Chiou, B.S.J. and Youngs, R.R. (2008). An NGA Model for the Average Horizontal Component of Peak Ground Motion and Response Spectra, Earthquake Spectra, 24, 173-215.

EPRI. (1994). Methodology for Developing Seismic Fragilities. Prepared by Jack R. Benjamin &

Associates, Inc. and RPK Structural Mechanics Consulting. TR-103959.

EPRI (2004). CEUS Ground Motion Project Final Report, prepared by Jack R. Benjamin &

Associates, Inc., Geomatrix Consultants, Inc., and Bechtel Corporation, Inc., TR 1009684.

EPRI (2006). Truncation of the Lognormal Distribution and Value of the Standard Deviation for Ground Motion Models in the Central and Eastern US, TR 1014381.

Interagency Performance Evaluation Taskforce (IPET). (2009). Performance Evaluation of the New Orleans and Southeast Louisiana Hurricane Protection System: Volume VIII - Operational Risk and Reliability. New Orleans, LA: USACE.

McCann, M. W. Jr. (2011). Seismic Risk of a Co-Located Portfolio of Dams - Effects of Correlation and Uncertainty, presented at 3rd International Week on Risk Analysis, Dam Safety, Dam Security, and Critical Infrastructure Management, Polytechnic University of Valencia, Valencia, Spain, October 17-18.

National Research Council (2013). Levees and the National Flood Insurance Program:

Improving Policies and Practices, Committee on Levees and the National Flood Insurance Program, Washington, D.C.

Park, J., Bazzurro, J.P., and Baker, J.W. (2007). Modeling Spatial Correlation of Ground Motion Intensity Measures for Regional Seismic Hazard and Portfolio Loss Estimation. Applications of Statistics and Probability in Civil Engineering. Edited by Kanda, Takada and Furuta. London:

Taylor & Francis Group.

Senior Seismic Hazard Advisory Committee (SSHAC) (2009). Recommendations for Probabilistic Seismic Hazard Analysis: Guidance on Uncertainty and Use of Experts, prepared for the U.S. Nuclear Regulatory Commission, NUREG/CR-6372.

U.S. Nuclear Regulatory Commission (USNRC) (2009). RG 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities. March.

U.S. Nuclear Regulatory Commission (USNRC) (2012). Practical Implementation Guidelines for SSHAC Level 3 and 4 Hazard Studies, Rev. 1, NUREG-2117, Office of Nuclear Regulatory Research, Washington, DC.

U.S. Nuclear Regulatory Commission, EPRI, U.S. Geological Survey (2012), Central and Eastern United States Seismic Source Characterization for Nuclear Facilities, NUREG-2115, U.S. Nuclear Regulatory Commission, Washington, DC.

U.S. Nuclear Regulatory Commission (USNRC) (2013). Guidance for Assessment of Flooding Hazards Due to Dam Failure, JLD-ISG-2013-01, April.

URS Corporation/Jack R. Benjamin & Associates, Inc. (URS/JBA) (2008). Delta Risk Management Strategy (DRMS), Phase 1, Risk Analysis Report. Sacramento, CA: California Department of Water Resources.