ML18135A109

Qualitative PRA Insights from Operational Events

ML18135A109
Person / Time
Issue date:	06/20/2018
From:	M'Lita Carr, Ian Gifford, Joseph Kanney, Nathan Siu, Zeechung Wang NRC/RES/DRA
To:
N. Siu 415-0744
References
Download: ML18135A109 (15)

Text

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA Qualitative PRA Insights from Operational Events Nathan Siua*, Ian Gifforda, Zeechung Wanga, Meredith Carra, and Joseph Kanneya aOffice of Nuclear Regulatory Research, U.S. Nuclear Regulatory Commission, Rockville, MD, USA Abstract: Qualitative, structured reviews of major accidents and accident precursors (e.g., incidents triggered by major fires) have led to useful insights regarding probabilistic risk assessment (PRA) methods, models, tools, and data. This paper provides the current results of an ongoing, exploratory project involving PRA-oriented, qualitative reviews of an additional ten incidents, selected for their relevance to the treatment of external floods and other storm-related hazards (e.g., high winds, lightning, and ice). These results corroborate insights generated by other investigations, but also provide some less-discussed insights of interest to PRA practitioners and developers. The paper also provides insights regarding the educational benefits of such an exploratory project and identifies a number of potentially important challenges to activities aimed at developing intelligent search tools intended to aid in PRA-oriented reviews and analyses of nuclear power plant (NPP) incidents.

Keywords: PRA, major events, accident precursors, operational experience.

1. INTRODUCTION Nuclear power plant accident data are sparse. This aphorism concisely expresses much of the motivation for the familiar, decomposition-based modelling approach used in current nuclear power plant (NPP) probabilistic risk assessments (PRAs), and for various standard techniques used to compensate for sparse data at the basic event level (including modelling of key phenomena, expert elicitation, and Bayesian estimation). However, like all aphorisms, caution is needed to avoid overuse.

In particular, it should not be (and has not been) taken to mean that empirical information from operating experience is not useful for PRA and that efforts to make improved use of this information are not worth pursuing.

Information from operational experience is, of course, reflected in NPP PRAs and related activities in a number of ways. Besides the routine use of performance data in the quantification of a variety of PRA model parameters, lessons from operational events have been used to update the PRA models themselves. For example, the 1975 Browns Ferry fire [1] led to a scoping level analysis of fire risk in WASH-1400 [2], and a subsequent full-fledged fire PRA methodology [3]. The major elements of the latter remain in use today [4]. More recently, the Fukushima Dai-ichi reactor accidents spurred re-examinations of a number of potential risk contributors including seismic, flooding, and multi-unit events (e.g., [5, 6]), and have led to the identification of a number of lessons regarding PRA methods, models, tools, and data (e.g., [7]).

On the other hand, there are also examples of noteworthy operational incidents1 whose significance to PRA has been underappreciated until recently. The 1999 Blayais flooding incident [9] provides a prime example. This incident, which involved multiple external hazards (high wind and flooding) and multiple reactor units and is now recognized as a precursor to the Fukushima accidents [10], apparently had little impact on the general PRA community until after the Fukushima accidents [11].

1 In this paper, consistent with International Atomic Energy Agency (IAEA) usage, we use the term incident to refer to NPP events that did not have significant impacts to the public, environment, or the facility [8]. Of course, in some instances, the conditions triggering the incident (e.g., a major storm) had a significant impact on the public and the environment, independent of their effect on potentially exposed NPPs.

• Contact email: Nathan.Siu@nrc.gov

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA In the late 1990s, as part of its fire risk research program [12], the U.S. Nuclear Regulatory Commission (NRC) Office of Nuclear Regulatory Research (RES) sponsored a qualitative investigation of notable NPP historical fire incidents aimed at identifying technical issues that may need further research. The project team consisted of three experts with combined expertise in fire PRA, fire science and engineering, and electrical engineering. The project analyzed 30 incidents from two viewpoints:

chronological, and PRA-oriented. The chronological analysis considered each key event during the incident and asked how a contemporary fire PRA would treat the event. The PRA-oriented analysis considered each element in fire PRA (e.g., ignition, detection, suppression, plant response) and, for each incident, asked what (if any) insights that incident provided regarding fire PRA treatment of that element. The results of the project, documented in NUREG/CR-6738 [13], provided valuable information for the NRCs fire risk research program, including empirical examples of recognized technical issues (e.g., fire-induced spurious actuations, fire-induced control room abandonment) and a number of phenomena that might warrant further fire PRA methods development (e.g., multiple fires during a single incident, multiple hazards during an incident, non-proceduralized recovery actions by plant staff under severe conditions). However, the project also required a significant effort to: a) identify and collect detailed, original-source information for many of the incidents, and b) to analyze this information.

Recognizing that many issues revealed by historical operating experience have been addressed (for example, the Browns Ferry fire led to stronger regulatory requirements for fire protection), nevertheless it is reasonable to expect that similarly-resourced data mining projects focused on other important PRA topics (e.g., external hazards, passive systems reliability, dependent failures, operator errors of commission, recovery actions, multi-unit events) could be valuable to PRA analysts, reviewers, and researchers. It is less obvious what insights might be provided by a smaller-scale effort, albeit one aided by modern search tools and databases.

2. OBJECTIVES AND SCOPE This paper summarizes the current results and insights of an ongoing, exploratory project to review selected NPP incidents, performed by a small team with varying degrees of PRA expertise. The project has three objectives.

1. Identify insights regarding PRA methods, models, tools, and data (i.e., PRA technology) potentially useful for PRA analysts, reviewers, and/or developers.

2. Provide an educational experience for the authors in support of NRCs increase use of risk information in regulatory decision making.

3. Identify lessons regarding the mining of operational experience that may be useful in the development of intelligent search tools.

Regarding the first objective, encouraged by the results of the fire incident review project mentioned earlier, the presumption is that PRA technology insights can be drawn from the incident descriptions.

Of course, by their nature, actual incidents typically dont progress deep into a PRA scenario -

sometimes an incident that provides PRA modelling lessons may not even involve a reactor trip - and are generally less thoroughly documented than accidents. This tempers our expectations regarding the extent and depth of insights that might be drawn from many operational experience reports. We also recognize that, as mentioned earlier, there have been and continue to be tremendous efforts to draw lessons from the Fukushima Dai-ichi reactor accidents. Such efforts have, for example, prompted national and international activities, too numerous to list, to reconsider the risk from external hazards, to address multi-unit (and multi-source) events, and to more strongly consider the effect of environmental factors (both those associated with the initial hazard and those induced by accident progression) on plant staff. It is quite possible that a limited study will serve only to confirm recognized lessons.

Regarding the second objective, two imperatives faced by the NRC are its need to compensate for its loss of PRA-knowledgeable staff (e.g., due to retirement) and its desire to increase the use of risk

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA information in its regulatory activities. This project can provide a demonstration of a non-traditional, hands-on activity that can supplement ongoing knowledge management activities (including formal training, workshops, and seminars) [11]. In addition to learning about interesting incidents, the project team members can gain an improved appreciation of empirical failure mechanisms, events, and scenarios, i.e., how things fail (in broad terms, the first element in Kaplan and Garricks risk triplet

[14]), and of associated, current PRA modelling practices. It is also hoped that the act of formulating PRA-relevant insights from available information will promote a deeper and longer-lasting understanding and will also sharpen each team members analytical skills.

Regarding the third objective, NRC is currently using advanced knowledge engineering (KE) tools (e.g.,

content analytics)2 to draw lessons from operational experience. Such use can only be expected to increase, given the ever-increasing volume of relevant information3 and the rapid developments in KE technology.4 In our experience, at least with the current generation of tools, tool development requires the identification of key word patterns and associations by subject matter experts [11]. It is hoped that this project will provide information useful for future KE tool development.

As an exploratory effort, this project has a tightly limited scope. As discussed in the following section, we are only reviewing a small number of U.S. and international incidents and are relying upon information readily available to the NRC staff. We recognize that the information in many of our sources is provided at a summary level; a more extensive research effort could yield more detailed documents and additional insights.

Finally, it should be emphasized that our project is neither an attempt to engage in post-event fault finding nor an exercise to characterize the conditional likelihoods of key failures during postulated accidents. The focus is on identifying qualitative lessons for future PRA use and development.

3. APPROACH 3.1 General Approach This project involves the review of qualitative information on ten NPP incidents (see Table 1). The incidents were chosen by the team following discussions that considered some of the broad PRA topic areas highlighted by the Fukushima Dai-ichi reactor accidents, namely external hazards, loss of offsite power (LOOP), and loss of ultimate heat sink (LOUHS), and the availability of information. The selected incidents generally involved external flooding (including flooding caused by local intense precipitation - LIP) and/or severe weather effects (e.g., high winds, salt spray). The incidents had, from a conditional risk perspective, varying levels of safety significance. For the U.S. incidents, the estimated conditional core damage probabilities (CCDPs) range from insignificant (no analysis needed) to 2E-4.5 The highest CCDP was for the Turkey Point event. For the non-U.S. incidents, per Refs. 22 and 25, respectively, it appears that the Blayais and Maanshan events had CCDPs higher than 1E-3. We do not have CCDP estimates for the Cruas and Hinkley Point events but note that the former was reported as 2 In this paper, the term knowledge engineering refers to engineering activities associated with the development and maintenance of information systems and the term content analytics refers to a broad class of software tools that use a variety of approaches (e.g., natural language queries, trends analysis, contextual discovery, and predictive analytics) to identify patterns and trends across an unstructured database (e.g., text).

3 For example, in the U.S., the NRC continues to receive hundreds of Licensee Event Reports (LERs) each year.

4 The NRC, as with many other government agencies, is investigating how Big Data and artificial intelligence (AI) technologies can be used to improve effectiveness and efficiency [15].

5 In the NRCs Accident Sequence Precursor - ASP - program, events with a CCDP of 1E-3 or greater are considered to be significant precursors [34, 35]. It should be cautioned that the ASP analyses are performed under boundary conditions that, although appropriate for the ASP program, may be limiting for the purposes of this paper. In particular, the ASP analyses consider the possibility of additional random hardware failures during an incident, but do not address potential variations in the effects of an external hazard. Additional discussions on limitations of current precursor analysis approaches can be found in numerous papers (e.g., [36, 37]).

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA an IAEA International Nuclear and Radiological Event Scale (INES) Level 2 event, and that the latter appears to be a Level 2 event or less.6 Table 1: Incidents Reviewed

• The LOOP categories affect LOOP recovery times in the NRCs Standardized Plant Analysis Risk (SPAR) models [34].

Two of the authors of this paper are serving as principal analysts. One is a reliability and risk analyst working on the NRC ASP program [34, 35] and has experience performing Level 1 PRA for precursor analysis. The second also has experience with ASP analyses and has provided technical and programmatic support related to risk-informed license amendment applications. The other authors are providing technical direction and subject matter expertise (e.g., on weather-and flooding-related hazards).

As compared with the fire incidents review mentioned earlier, this project performs only a chronologically-oriented review of the events in each incident, considering broad elements in external hazards PRA: screening, hazard, fragility, and plant response (with special attention to human reliability and other potential sources of dependency), but not the detailed approaches used in current PRAs to 6 The INES scale was created in 1990 [8], i.e., after the Hinkley Point event.

Date Plant(s)

Scenario Type*

Notes 1981-12-13 Hinkley Point A-1, A-2 External Flood; LOOP (weather)

Pump house flooding. Winter storm causes LOOP; storm surge on top of high tide floods station cooling water pump house. [16, 17]

1982-12-03 Dresden 2, 3 External Flood Pump house flooding. Illinois and Kankakee rivers flood after several days of heavy rainfall; flood is 2 above historical maximum; a higher flood level could have failed service water (SW) pumps. [18]

1992-08-24 Turkey Point 3, 4 High Wind; LOOP (weather)

Severe weather LOOP. Hurricane Andrew caused 5-day LOOP and loss of: communications, site access, some water tanks.

Severe stress on operators. [19, 20]

1999-12-27 Blayais 1, 2 External Flood Severe weather LOOP and flooding. LOOP caused by high winds; tide, storm surge, wind-driven waves overtop dyke, flood Units 1 and 2. Unit 1 SW degraded, Units 1 and 2 low-head safety injection and containment spray pumps lost. Site access lost. [9, 21-23]

2001-03-17 Maanshan 1 LOOP (Weather);

Fire (HEAF)

Severe weather LOOP and subsequent station blackout (SBO).

Salt spray caused LOOP. Emergency Diesel Generator (EDG) A started but tripped. Heavy smoke from high energy arcing fault (HEAF) prevented access to switchgear room to restore EDG B.

Swing EDG used to restore power after ~2 hours. [24, 25]

2009-12-01 Cruas 2-4 External Flood LOUHS due to flood debris. Vegetation blocked SW intake.

Total loss of SW for Unit 4, partial loss Units 2 and 3. [26]

2011-04-27 Browns Ferry 1-3 High Wind; LOOP (weather)

Severe weather LOOP. LOOP caused by tornado (part of a tornado swarm). Complications with EDG C, loss of shutdown cooling at Units 1 and 2. [27, 28]

2013-02-08 Pilgrim LOOP (weather)

Severe weather LOOP. A severe winter storm caused grid problems, LOOP. EDGs started and loaded. Complications included an unstable grid and a second LOOP due to ice bridging of the startup transformer. Overall duration ~4 days. [29]

2013-04-17 LaSalle 1, 2 LOOP (switchyard)

Lightning induced LOOP. Lighting strike at switchyard, fault propagated to direct current (DC) protective system. One residual heat removal (RHR) pump failed to start due to control design fault. Offsite power restored ~17 hours after LOOP. [30]

2014-01-09 St. Lucie 1 External Flood Reactor Auxiliary Building flood due to LIP. Heavy rainfall challenged site storm drains, backed into Reactor Auxiliary Building through unsealed conduits. Attempts to control flooding failed; Unusual Event (UE) declaration cleared when storm passed (~8 hours). [31-33]

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA address these elements. In general, the approach is to let the data speak, rather than perform a highly-structured (and therefore constrained) analysis.

For the U.S. incidents, the team is using publicly available information, primarily LERs, staff analyses performed for the NRCs ASP program, and selected reports. For the international incidents, the team is using information found through Internet searches, the IAEAs Incident Reporting System (IRS) restricted-access database and, in a few cases, publicly available documents provided by international colleagues. For a number of incidents, our analyses have raised questions concerning the storms that created the onsite hazards. We have usually been able to answer these questions using publicly available reports and/or agency websites providing access to weather data (e.g., www.climate.gov).

3.2 Example Incident Descriptions and Analyses The following discussions of the Turkey Point (1992) [19, 20] and St. Lucie (2014) [31-33] incidents illustrate the types of observations developed from our incident reviews. The PRA-related implications of these observations are discussed in Section 4.

3.2.1 Turkey Point On August 24, 1992, the Turkey Point site (two nuclear and two fossil units at the time of the event) was hit by a Category 5 hurricane (Hurricane Andrew). The eye of the hurricane passed directly over Turkey Point at 4:40 am EST. The site experienced high winds for seven hours, with peak wind gusts in excess of 300 km/h (187 mph) and sustained winds of 233-250 km/h (145-155 mph), a storm surge of 2.1m (7 ft) and associated debris, and rain sufficiently heavy to cause some damage but not to promote general site flooding. It appears that the site was not affected by any lightning or tornadoes associated with the hurricane.

Responding to hurricane warnings, the site started its emergency preparations several hours before the storm hit, and the nuclear units were in hot shutdown (Mode 4), using the RHR system for cooling, when the storm hit.7 One of the nuclear units (Unit 3) lost offsite power when the eye hit; the other nuclear unit (Unit 4) lost power roughly 40 minutes later.8 As designed, the EDGs started and loaded, providing needed power. One line of offsite power was restored four days after the event but was unreliable for several days. A second line of offsite power was restored on August 31, seven days after the event.

Some additional interesting event features are as follows.

The U.S. National Hurricane Center began tracking the storm off the coast of Africa on August 14 and declared Andrew a tropical storm on August 17. The Turkey Point staff initiated emergency preparations on August 21, with the storm approximately 800 miles off shore. These preparations included identifying plant staff that would stay on site during the event, and training on potential scenarios involving losses of instrument air, RHR, offsite power, and EDGs. On August 23, a hurricane warning was issued and Turkey Point declared an Unusual Event (UE).

The Turkey Point plant manager had prior experience working at the St. Lucie plant during Hurricane David in 1979. Due in large part to this experience, Turkey Point had revised its Emergency Plan Implementing Procedure before the hurricane. Also, although the plants commitments made in response to the NRC station blackout rule only required that the plant commence shutdown two hours prior to the expected onset of hurricane force winds, plant staff estimated that it would take eight hours to enter Mode 4 and initiated shutdown on Units 3 and 4 on August 23 at 6:00 pm and 8:00 pm, respectively. Plant staff were distributed to strategic 7 The plant operators chose to maintain the reactors in Mode 4 rather than Mode 5 (cold shutdown) in order to ensure the availability of turbine-driven auxiliary feedwater (AFW), should it be needed.

8 Unit 4 received power from one of the fossil units (Unit 2), until the latter unit was shutdown at 5:22 am EST.

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA locations and the plants Technical Support Center (TSC) and Operational Support Center (OSC) were relocated to Class I building locations, due to concerns about possible damage to their original (non-Class I) buildings. Both the TSC and OSC were declared operational at 11:22 pm. Unit 3 reached Mode 4 at 2:13 am, August 24; Unit 4 reached Mode 4 at 4:05 am. A site survey to ensure staff safety concluded at 3:00 am, as sustained winds started to exceed 48 km/h (30 mph). Its useful to note that the storm arrived two hours earlier than initially expected.

The sustained wind speeds experienced were above the plants design basis sustained wind speed of 233 km/h (145 mph), but well below the design basis tornado wind speed of 542 km/h (337 mph). The storm surge experienced was also well below the design basis storm surge height of 13.7m (22 ft).

The storm did not cause any significant damage to Class I buildings. The storm did fail many Class III structures, including a 380,000 liter (100,000 gallon) water tower. The tower collapse, caused by a wind-generated missile that struck an unprotected tower support, rendered two raw water tanks and fire system piping and associated support systems inoperable. The storm also damaged the chimney for fossil Unit 2. If that chimney had collapsed, it might have struck the Unit 4 EDG building.

The storm caused water damage to some equipment, including the breaker for an RHR discharge valve and a battery charger.

The storm also caused the loss of offsite communications. Helicopters and portable communications were used until traditional communication methods were restored on August

25. Temporary satellite communication was provided by the NRC.

Onsite communications remained available and enabled contact with staff distributed at various site locations. Many of these locations were isolated during the storm, due to the hazardous external conditions.

Storm debris did not cause the loss of plant service water. However, this was due to hourly cleaning of the service water strainers by plant staff.

Recovery actions were severely hampered due to storm damage. There was no lighting in support buildings, computer access was unavailable, and few vehicles survived the wind and rain damage. Spare parts and tools were also damaged during the storm. Even replacement parts that appeared intact could not be relied upon until properly tested.

Offsite damage also hampered recovery efforts. Roads were blocked with large debris. During road clearing efforts, the lack of high voltage detectors required the use of long chains thrown over downed power lines to check for energization.

Plant personnel performed under highly challenging conditions. The hazardous conditions which prevented staff from going outside their Class I buildings, a lack of instrumentation,9 and the loss of offsite communications prevented staff from developing a clear picture of site conditions. The loss of offsite communications also amplified staff concern regarding offsite conditions, their families, and homes. Furthermore, the site had difficulty providing food, temporary living quarters, and other basic necessities. The food supply was exhausted before access roads were cleared, requiring the use of helicopter delivery.

Offsite assistance proved invaluable during the event response. Local utilities and the St. Lucie plant provided needed staffing support, food, water, diesel fuel, portable generators, chain saws, hand tools, clothes, and personal items.

From a public and staff safety perspective, it is important to recognize that despite the extreme challenges posed by the storm, the sites actions before, during, and after the hurricane were ultimately successful.

9 As discussed in Ref. 19, the meteorological tower data was of limited use even before the towers and equipment failed.

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA 3.2.2 St. Lucie In the early afternoon of January 9, 2014, the St. Lucie plant (two nuclear units) was struck by a heavy rainstorm. Due to blockage of a normal drain path, water backed up in the emergency core cooling system (ECCS) pipe tunnel and then flowed into the Unit 1 reactor auxiliary building (RAB) through degraded conduits that were below the design basis external flood elevation but were missing required flood barriers. At 4:10 pm EST, operators reported that water was backing up through RAB floor drains and flowing into the ECCS pump room. Per procedure, operators isolated the ECCS pump room, but RAB flooding continued. A mitigation plan, involving the batchwise drainage of water into the ECCS pump room and then removal of that water using the ECCS sump pumps, was developed and implemented at 4:35 pm. One hour later, a higher capacity temporary pump was brought into service to reduce the water flow into the RAB. At 6:03 pm, it was determined that the accumulated rainfall exceeded the sites storm drain system capacity and a UE was declared. Operators removed the drain blockage by clearing a drainage pipe and opening a gate valve. The UE declaration remained in effect until midnight, when the rains subsided and storm drains were observed to be removing accumulated water. During the event, the reactor remained at power and all safe shutdown equipment remained operable.

It can be seen that this event had a very small actual safety impact. Nevertheless, it exhibits a number of interesting features.

National Weather Service data from local meteorological stations and from area radar indicate that: a) heavy rain conditions at the plant lasted from around 12:30 pm to around 6:00 pm; and b) most (nearly 90%) of the total rainfall was deposited before the operators observation of RAB flooding at 4:10 pm.

National Weather Service data also indicate large variations in measured rainfall across the area, ranging from a low of around 140mm (5.54 inches) to a high of 270mm (10.64 inches).

The flood did not reach design basis levels and it appears that all essential services (notably electric power) were available.

When the existing plant flooding procedures did not control the RAB flooding, operators were able to develop and implement a plan that prevented flooding of key equipment.

Some of the operator actions were performed outdoors under conditions of continuing heavy rainfall and gusty winds.

After the event, it was determined that a number of other conduits also lacked required flood barriers, that the barriers had been missing since plant modifications in 1978 and 1982, and that the missing barriers were not detected by flooding walkdowns performed in 2012.10

4. PRELIMINARY RESULTS Our review of the events listed in Table 1 is ongoing. This section provides our observations and insights developed to date. The discussion is organized to mirror the project objectives identified in Section 2 of this paper.

4.1 PRA-Related Observations and Implications As of this writing, many of our results echo insights developed not only by other, post-Fukushima PRA-related reviews and activities (e.g., [7, 38, 39]), but also some pre-Fukushima event lessons-learned activities (notably following the Blayais flood [22, 23]). Some even echo insights from early discussions of external hazards PRA (e.g., [40]). We do note that a number of the incidents in Table 1 are likely not well known within the PRA community. Thus, even if they do not provide fresh insights, they provide additional support to recognized lessons. We also note that a few of our insights suggest potentially important topics for future PRA research.

10 The documentation reviewed addresses the conduit flood barrier problems but does not provide information on the nature and duration of the drainage blockage.

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA 4.1.1 Hazard In this paper, all of the incidents were triggered directly or indirectly by major storms. Notable features of the hazards affecting the plant include the following.

Multiple hazards. A number of the incidents involved two or more of the following: high winds, salt spray, flooding, and debris clogging. A few winter events may have involved extreme cold, although no effects were explicitly identified. One event involved salt spray followed by heavy smoke within a building due to an electrical fault and HEAF.

Large extent. A number of the storms caused significant damage offsite, limiting or even blocking access to the site and hindering recovery activities. Some storms affected even larger geographical areas (e.g., multiple states, multiple countries). In a few of these cases, multiple sites were affected. The effects on sites not listed in Table 1 were minor, but it can be seen that a more severe (if presumably less likely) storm might affect plants relying on mutual aid agreements and/or regional support centers.

Asymmetrical impact. A number of storms affecting multi-unit sites did not affect all units to the same degree. Indeed, in some cases, some units appear to have suffered no significant impact.

Challenge from less extreme hazard levels. In some incidents, the external hazards appeared to be less severe than those addressed by the plant design basis, but nevertheless presented significant challenges to the operators. Even in the case of some floods beyond then-current design bases, it appears that significant flooding started before the design basis flood level was reached, due to a phenomenon (wind-driven waves) that had not yet been considered.

Persistence. For some events, the effects of flooding (offsite as well as onsite) persisted hours or even days after the storm passed.

Dynamic behaviour. In a number of incidents, the site experienced significant storm effects well before peak storm conditions were reached. Also, a number of storms presented multiple, sequential threats to the affected plants. One event involved multiple flood peaks, another multiple wind peaks, and others different hazards (e.g., high wind, flooding) at different times.

The time gap between hazards likely affected the degree of challenge to the operators in achieving safe shutdown.

Offsite natural hazard risk management actions. Early severe weather warnings, leading to pre-emptive measures onsite, played an important role in a number of the events. In one case, on the other hand, a lack of warning to potentially affected units may have contributed to difficulties in plant response. Regarding a different aspect of risk management, river flood control actions had no apparent effect on the plant in one event but had a downstream effect on a plant in another.

Some of the above features (e.g., regarding storm dynamics) can be handled in a PRA with standard, conservative modelling assumptions (e.g., assuming a maximum flood height is reached instantaneously at the beginning of the scenario). Stochastic storm simulation tools that enable more realistic treatment of storm dynamics also are available (e.g., [41, 42]). Other features (e.g., PRA treatment of multiple hazards) are the subject of active research (e.g., [43, 44]). Still others (e.g., treatment of multi-site effects) are starting to be investigated (e.g., [45]) but have not yet received the full attention of the broad PRA community. We note that all of the features affect the context for plant staff and organizational actions, and may be worth considering in a qualitative manner, even in a conservative, single unit PRA.

4.1.2 Fragility Although specific information on the exposure of systems, structures, and components (SSCs) to potential hazards is generally lacking in the documents reviewed, information is available on actual failures. Notable failures during the incidents reviewed include the following.

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA Hazard-induced failures of protection-related SSCs (including dikes, penetrations, and internal doors) affecting exposure of other SSCs to the hazard LOOP (including partial losses followed by subsequent failures leading to complete loss)

LOUHS (due to service/cooling water pump motor immersion or intake clogging by debris)

Failure of other SSCs explicitly modelled in PRAs (including water damage to an electrical breaker probably due to wetting but not immersion, as well as immersion of ECCS and support system pump motors)

Failure of other SSCs typically not explicitly modelled in PRAs (including non-safety structures; communications, lighting, computer systems; spare parts and tools; onsite automobiles, trucks, and trailers)

Pre-event failures not caused by the hazard but affecting the exposure of modelled SSCs included missing or faulty penetration seals and clogged storm drains. For such failures, which can be detected by inspections or walkdowns but can also be undetected for long periods of time, it can be seen that the uncertainty in SSC status might be more epistemic than aleatory in nature, and standard random process models for standby component failures might be worth revisiting.

4.1.3 Plant Response Although at least one incident caused sufficient alarm to mobilize national-level crisis centers, none of the incidents reviewed actually progressed very far down the sequence of events associated with risk-significant accident scenarios. Nevertheless, we have observed some features of interest, as follows.

Precautionary measures. As discussed in Section 3, the Turkey Point plant had substantial early warning and took a number of major precautionary measures that helped prepare the plant for the arrival of the hurricane.

Multiple shocks. As discussed in Section 4.1.1, a number of incidents involved multiple storm hazards (e.g., high wind, flooding). A further incident involved a LOOP, recovery from that LOOP, and then a second LOOP. In another incident, the LOOP was followed by other faults and a HEAF, ultimately resulting in a two-hour SBO.

Scenario dynamics. In at least two cases, the timing of the multiple shocks to the plant apparently led to different plant responses. In one case, a storm-induced LOOP occurred well before flooding of the plants pump house, and it appears the plant achieved shutdown before service water was lost without major complications.11 In another case, the storm-induced LOOP and plant flooding occurred at about the same time, and the plant operators were significantly challenged.

HRA complexities. Many of the incidents illustrated challenges to the operators. In addition to coping with the multiple shocks and scenario dynamics mentioned above, these challenges included:

o Storm damage to SSCs not explicitly modelled in PRAs. The previously mentioned damage to communications, lighting, etc. in some incidents clearly affected the operators ability to assess the situation and to implement needed actions. At Turkey Point, as discussed previously, even apparently undamaged spare parts could not be confidently relied upon without proper testing. Further, the onsite loss of cars, trucks, and trailers (which could have provided needed housing for the staff, given the sites isolation from the outside) hindered recovery efforts.

o Need to take shelter. A number of storms were sufficiently severe as to require sheltering. At Turkey Point, when combined with a loss of communication, this made it difficult for the staff to assess external conditions (e.g., whether the storm had subsided).

o Need for outdoor actions. Despite storm conditions, some incidents required outdoor actions (e.g., to determine the status of outdoor drainage systems). Other actions (e.g.,

11 Our summary level information for this event does not indicate any complications.

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA cleaning of service water strainers) may have required activity under hazardous conditions.

o Offsite damage. A number of incidents led to large scale damage offsite, with safety consequences to the general public and therefore attention from general emergency organizations. A further consequence of this damage was loss of offsite access. At Turkey Point, this led to difficulties in providing food and other basic necessities.

Further, the staffs expectation of severe offsite damage, in combination with loss of offsite communication, increased stress due to concerns regarding families and homes.

Our reports on other incidents contain no information on the psychological challenges faced by the staff at other plants, so we do not know if their situations were similar to those seen at Turkey Point (and later at Fukushima Dai-ichi).

On the subject of HRA, it is important to recognize that while the HRA analyst is typically performing the analysis in the context of a pre-defined PRA scenario, the plant staff is performing under extremely uncertain conditions. The staff will not necessarily know, for example, when a flood will stop (recall that flooding can continue well after a storm has passed),

whether mitigation actions using pumps and drains will actually work given unknown and potentially changing water inflow rates, or whether a new shock (e.g., a subsequent LOOP) is the last one or just the latest in a series of problems.

It is also important to recognize that, despite the challenges identified above, the plant operators were ultimately successful. Assessing the appropriate degree of credit to operator actions under such circumstances remains a challenge for HRA.

Site-wide considerations. As discussed in Section 4.1.1, a number of incidents involved multiple units, sometimes in different operating states. At least one incident appears to have involved challenges in coordinating actions across the units. On the positive side, cross-ties to other units on site (including, in the case of Turkey Point, fossil fuel units) provided important support (e.g., power, cooling water) during a number of incidents.

Similar to the treatment of hazards, many of these features can be treated in current PRAs either conservatively, or more realistically with particular attention to contextual factors important to HRA.

We note that some features could be relevant to detailed modelling efforts aimed at addressing pre-core damage endstates (i.e., Level 0 PRA [46]), perhaps for the purpose of supporting enterprise risk management applications (e.g., [47]). We also note that dynamic PRA [48-50] provides a natural framework for the realistic treatment of the interactions between a hazard and the plant.

4.2 Learning-Related Observations Our initial reviews of available information on the incidents in Table 1 have led to a number of follow-up questions, and so we are still in the process of completing our technical analysis. Nevertheless, we are confident that this project has been an extremely successful learning exercise for all members of the team.

Broadly speaking, we have gained awareness of a number of incidents for which we had little or no prior knowledge (notably Hinkley Point) and have learned about a number of PRA-relevant features (discussed above) associated with incidents for which several of the authors had limited awareness (e.g.,

Turkey Point, St. Lucie). Even for those incidents for which many of the authors had a greater degree of awareness, our review provided useful perspectives. For example, one of the authors framing of the Maanshan incident as a demonstration of a HEAF-induced SBO was changed to a more global view, where the HEAF was just one of a series of events in an external-hazard initiated scenario. As another example, our understanding of the conditions faced by the operators at Blayais was improved through a comparison with the Hinkley Point and Turkey Point incidents, which appear to have shared key features with Blayais (and with the Fukushima Dai-ichi reactor accidents), including: storm-induced multiple hazards and LOOP, multi-unit effects, and degradation or loss of site access.

At a more detailed level, the authors have gained a better understanding of the challenges associated with the general modeling of external hazards and of associated scenario features. The latter include:

early hazard notification and site preparation (equipment and personnel staging, decisions to remain in

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA hot shutdown to facilitate decay heat removal via turbine-driven systems), current modeling of LOOP recovery considering the LOOP type (severe weather, grid, or switchyard) and the complexities of actual recovery (e.g., when power sources can actually be considered reliable), other recovery actions (including the difficulties introduced by damage to spare parts and tools as well as the sources and effects of stress), and equipment fragility (e.g., potential increases due to debris clogging that necessitates cleaning actions). We have also gained a better understanding of the different sources of publicly available information (e.g., LERs, precursor analyses, event notification reports, inspection reports, and weather data) that can be useful in the review of past events.

We note that, as indicated in Section 2, we are hopeful that by virtue of an active, PRA-oriented analysis, the authors will: a) have enhanced their PRA-related analytical skills, and b) will have gained knowledge longer lasting than would have been gained by a less-involved review of events. We have no immediate plans to formally assess the realized degree of benefit but may revisit this question in the future should the need arise (e.g., to support proposals for future, analogous exercises).

4.3 Knowledge-Engineering Related Observations As discussed in Section 2, the NRC, as with many organizations, is interested in using advanced KE tools (e.g., content analytics) to make better use of available data. The following list provides a number of information processing challenges that we have identified in the course of this project. These challenges can be met by human analysts as a normal research matter but may take some thought when developing automated tools for extracting factual information from documents.

Computed or assigned event significance measures (e.g., CCDPs, IAEA INES ratings, inspection finding significance levels) can be helpful when screening out less significant incidents. However, these measures are not designed to identify events that may be of interest to PRA practitioners and researchers. For example, the CCDPs computed in the NRCs ASP program consider the possibility that additional independent hardware failures could have occurred during an incident, but not the possibility that the experienced hazard could have been worse. Thus, a screening approach that relies exclusively on reported CCDPs might eliminate flooding incidents in which the flooding level stopped just short of key equipment.

Notable events can be documented in multiple papers and reports published over time. Some of the factual details provided in these documents may not always be consistent. A tool developer will need to consider if and how to assess the credibility of the information (e.g., considering consistency with other facts presented in that document and other documents). We note that credibility ratings based purely on the document source can be misleading, as even official records can contain errors.

Especially when dealing with external hazards, a full understanding of the incident can require the integration of multidisciplinary information scattered over a variety of documents. These documents, often written for a variety of purposes and audiences, can focus on different aspects and even use different terms. For example, a nuclear-safety oriented event report might focus on flooding - an effect - whereas a weather-oriented report might focus on the storm - the source of the hazard - and might not even use the term flood or its variants. Even more challenging for the tool developer, different disciplines can have different preferred conceptual frameworks. For example, a plant systems analyst, thinking in terms of discrete events, may be unsuccessful in a naive search for data indicating when a storm hit the site because the available hazard information is presented with a view that hazard growth is a continuous process over time.

As a related point, massive amounts of quantitative weather data have become available in the last few years. To provide easy and efficient access, modern websites generate graphical presentations based on user queries. (For example, detailed isopleths for rainfall, based on meteorological station reports and radar imaging, can be interactively generated for user-specified time and space intervals.) It appears to us that mining such information to answer such questions as When did heavy rainfall start at Plant X? will present a significant challenge to the KE tool developer.

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA Most of the above challenges relate to the identification of sound, factual information regarding an incident. Some appear to be addressable with currently available KE technology, others may require additional developments. A different type of challenge involves the automated development of broad lessons through the identification of similar (but not necessarily identical) patterns across incidents, in order to address such broad questions as Besides Blayais, have there been any other precursors to the Fukushima Dai-ichi reactor accidents? We can envision approaches to develop KE solutions to this class of problems but do not know the state of practical tools or approaches in this area.

5. CONCLUSIONS AND CLOSING REMARKS This paper presents the current results of an ongoing project aimed at: 1) developing qualitative insights based on past NPP incidents, 2) providing an educational experience for the project participants, and 3) identifying potential lessons for the development of future data mining tools. Our results to date are as follows.

1) We have identified insights we consider to be useful for PRA practitioners and developers.

Some of these insights (e.g., regarding warning times, hazard persistence, offsite hazard management activities, multi-unit and offsite impacts, and HRA complexities) provide additional empirical support to lessons well-recognized by the hazards and PRA communities, especially in the aftermath of the Fukushima Dai-ichi reactor accidents of 2011. Others, including the potential importance of multiple shocks, scenario dynamics and multi-site events, appear to be less-widely discussed and may imply future development needs.

2) We have improved our understanding of events and mechanisms for some well-known incidents involving external hazards and have identified and analyzed a number of notable incidents that were previously unknown to us and, we believe, many in the PRA community.

3) We have identified a number of challenges potentially important to the development of advanced KE tools aimed at mining operational experience records in support of external hazards PRAs.

Regarding the second point, it is interesting to note that although it was not a project aim, we have identified two incidents (Hinkley Point, 1981; Turkey Point, 1992) bearing notable similarities with the well-known Blayais flooding event of 1999, and therefore, from a technical perspective, might be reasonably considered as precursors to the Fukushima Dai-ichi reactor accidents of 2011.

When considering the above results, it is important to recognize the following limitations.

The project is a limited scope, exploratory effort. Most of the documents reviewed do not provide sufficient details of interest to PRA modelers. A more extensive effort to identify, acquire, and analyze further documents could very well result in additional useful insights.

Many of the incidents reviewed are quite old, and the subject plants have changed since then.

Some of our insights may no longer be applicable for these plants.

The project is a purely qualitative exercise. Our observations provide an empirical indication of possibility, but do not provide any indication of quantitative likelihood.

Given our positive view of the results to date, we believe that, following project completion, a number of follow-on activities could be valuable. These activities could range from similar, modestly-scoped staff development activities exploring incidents illustrating various topics of interest to the PRA community (e.g., passive systems, errors of commission) and/or the various natural hazards communities (e.g., major storms that could have but didnt affect NPPs), to larger-scale efforts, perhaps involving international organizations (e.g., to compile a set of authoritative, PRA-oriented descriptions of selected events). These activities, of course, need not be limited to the treatment of external hazards.

We expect to have a clearer picture of the potential costs and benefits of such follow-on efforts after we have completed this project.

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA Acknowledgements The authors gratefully acknowledge R. Sigmon, C. Jones, F. Corenwinder, and H. Pesme for information provided to help this project, and P. Dupuy, G. Georgescu, and J. Gauvain for information provided to past projects that we have used in the current effort. We also thank H. Rasouli for his support during the initial stages of the project, and F. Ferrante and M. Bensi for their useful comments.

References Note: NRC documents can be found NRC Agencywide Documents and Management (ADAMS) system, https://adams.nrc.gov/wba/ using the accession numbers (designated by ML) provided below, and/or the NRC page for document collections https://www.nrc.gov/reading-rm/doc-collections/index.html.

LERs and Inspection Reports can be found using the NRCs LERSearch tool:

https://lersearch.inl.gov/Entry.aspx.

[1]

U.S. Nuclear Regulatory Commission, The Browns Ferry Fire Nuclear Plant Fire of 1975 Knowledge Management Digest, NUREG/KM-0002, 2013.

[2]

U.S. Nuclear Regulatory Commission, Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants, WASH-1400 (NUREG-75/014), 1975.

[3]

G. Apostolakis, M. Kazarians, and D.C. Bley, Methodology for assessing the risk from cable fires, Nuclear Safety, 23, pp. 391-407, (1982).

[4]

N. Siu, N. Melly, S. P. Nowlen, and M. Kazarians, Fire risk assessment for nuclear power plants, The SFPE Handbook of Fire Protection Engineering, 5th Edition, Springer-Verlag, New York, 2016.

[5]

S. Poghosyan and O. Coman, IAEA project: multiunit probabilistic safety assessment, Proceedings of PSAM 14, Fourteenth International Conference of Probabilistic Safety Assessment and Management (this conference), Los Angeles, CA, September 16-21, 2018.

[6]

S. Yalaoui, et al., WGRISK Site-level PSA project: status update and preliminary insights for the risk aggregation focus area, Proceedings of ANS International Topical Meeting on Probabilistic Safety Assessment (PSA 2017), Pittsburgh, PA, September 24-28, 2017.

[7]

N. Siu, et al., PSA technology challenges revealed by the Great East Japan Earthquake, Proceedings of PSAM Topical Conference in Light of the Fukushima Dai-Ichi Accident, Tokyo, Japan, April 15-17, 2013.

[8]

International Atomic Energy Agency and Nuclear Energy Agency, INES: The International Nuclear and Radiological Event Scale, Users Manual 2008 Edition, IAEA, Austria, 2008.

[9]

Institut de Protection et de Sûreté Nucléaire, Rapport Sur LInondation Du Site Du Blayais, Fontenay-aux-Roses, France, 2001. (Available from:

http://www.irsn.fr/FR/expertise/rapports_expertise/Documents/surete/rapport_sur_l_inondation_

du_site_du_blayais.pdf)

[10] Nuclear Energy Agency, Working Group on Operating Experience [WGOE] Report on Fukushima Daiichi NPP Precursor Events, NEA/CNRA/R(2014)1, Boulogne-Billancourt, France, 2014.

[11] N. Siu, K. Coyne, and F. Gonzalez, Knowledge management and knowledge engineering at a risk-informed regulatory agency: challenges and suggestions, U.S. Nuclear Regulatory Commission, March 2017. (ADAMS ML17089A538)

[12] N. Siu, J.T. Chen, and E. Chelliah, Research needs in fire risk assessment, Proceedings of 25th U.S. Nuclear Regulatory Commission Water Reactor Safety Information Meeting, Bethesda, MD, October 20-22, 1997, NUREG/CP-0162, Vol. 2, pp.93-116, (1997).

[13] S.P. Nowlen, M. Kazarians, and F. Wyant, Risk Methods Insights Gained from Fire Incidents, NUREG/CR-6738, U.S. Nuclear Regulatory Commission, 2001.

[14] S. Kapan and B.J. Garrick, On the quantitative definition of risk, Risk Analysis, 1, pp. 11-37, (1981).

[15] U.S. Nuclear Regulatory Commission, Achieving Modern Risk-Informed Regulation, SECY 0060, May 23, 2018. (ADAMS ML18110A187)

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA

[16] R. Kirby, Hinkley Point Sediment Transport - Potential Impacts of and on New Structures, BEEMS Technical Report 149, Ravensrodd Consultants, Ltd., September 2010. (Available from https://infrastructure.planninginspectorate.gov.uk/projects/south-west/hinkley-point-c-new-nuclear-power-station/?ipcsection=docs&stage=app&filter1=Environmental+Statement)

[17] United Kingdom Environmental Agency, Somerset and the Sea: The 1981 Storm - 25 Years On, 2006.

[18] Commonwealth Edison, Untitled, LER 237-1982-050, December 13, 1982.

[19] F.J. Hebdon, Effect of Hurricane Andrew on the Turkey Point Nuclear Generating Station from August 20-30, 1992, NUREG-1474, U.S. Nuclear Regulatory Commission, 1993. (Available from https://www.osti.gov/biblio/10158520)

[20] M. Leach, et al., NRC 2005 Hurricane Season Lessons Learned Task Force Final Report, STP-06-039, U.S. Nuclear Regulatory Commission, Washington, DC, 2006. (ADAMS ML060900005)

[21] A. Gorbatchev, et al., Report on flooding of Le Blayais power plant on 27 December 1999, Proceedings of EUROSAFE 2000, Cologne, Germany, November 6-7, 2000, Gesellschaft für Anlagen-und Reaktorsicherheit (GRS) Gmbh, Cologne, Germany, 2000.

[22] E. Vial, V. Rebour, and B. Perrin, Severe storm resulting in partial plant flooding in Le Blayais nuclear power plant, Proceedings of International Workshop on External Flooding Hazards at Nuclear Power Plant Sites, Atomic Energy Regulatory Board of India, Nuclear Power Corporation of India, Ltd., and International Atomic Energy Agency, Kalpakkam, Tamil Nadu, India, August 29 - September 2, 2005.

[23] E. de Fraguier, Lessons learned from 1999 Blayais flood: overview of EDF flood risk management plan, NRC Regulatory Information Conference, Rockville, MD, March 9-11, 2010.

(Available from:

https://www.nrc.gov/public-involve/conference-symposia/ric/past/2010/slides/th35defraguierepv.pdf)

[24] Atomic Energy Council, Taiwan, The Station Blackout Incident of the Maanshan NPP unit 1, April 18, 2001. (Available from:

https://www.aec.gov.tw/webpage/control/report/safety/safety_04_002.pdf)

[25] W.S. Raughley and G.F. Lanik, Operating Experience Assessment Energetic Faults in 4.16 kV to 13.8 kV Switchgear and Bus Ducts That Caused Fires in Nuclear Power Plants 1986-2001, U.S.

Nuclear Regulatory Commission, February 2002. (ADAMS ML021290358)

[26] P. Dupuy, G. Georgescu, and F. Corenwinder, Treatment of the loss of ultimate heat sink initiating events in the IRSN Level 1 PSA, NEA/CSNI/R(2014)9, Probabilistic Safety Assessment (PSA) of Natural External Hazards Including Earthquakes: Workshop Proceedings, Prague, Czech Republic, June 17-20, 2013, Nuclear Energy Agency, Boulogne-Billancourt, France, 2014.

[27] Tennessee Valley Authority, Three-Unit Scram Caused By Loss of All 500-kV Offsite Power Sources, LER 259-2011-001, June 27, 2011.

[28] J.L. Hayes, Service Assessment: The Historic Tornadoes of April 2011, U.S. National Weather Service, 2011. (Available from:

https://www.weather.gov/media/publications/assessments/historic_tornadoes.pdf)

[29] Entergy Nuclear Operations, Inc., Loss of Off-Site Power Events Due to Winter Storm Nemo, LER 293-2013-003, April 8, 2013.

[30] LaSalle County Station, Unusual Event Declared Due to Loss of Offsite Power and Dual Unit Scram, LER 373-2013-002, January 22, 2014.

[31] Florida Power and Light Co., Internal RAB Flooding During Heavy Rain Due to Degraded Conduits Lacking Internal Flood Barriers, LER 335-2014-001, September 22, 2014.

[32] U.S. Nuclear Regulatory Commission, St. Lucie Plant - Final Significance Determination of White Finding and Notice of Violation, NRC Inspection Report 05000335/2014010 and 05000389/2014010, EA-14-131, 2014. (ADAMS ML14323A786)

[33] U.S. Nuclear Regulatory Commission, Degraded Ability to Mitigate Flooding Events, Information Notice IN-2015-01, 2015. (ADAMS ML14279A268)

[34] U.S. Nuclear Regulatory Commission, Status of the Accident Sequence Precursor Program and the Standardized Plant Analysis Risk Models, SECY-15-0124, Washington, DC, USA, 2015.

(ML15187A434)

Probabilistic Safety Assessment and Management PSAM 14, September 2018, Los Angeles, CA

[35] I. Gifford, C. Hunter, and J. Nakoski, U.S. Nuclear Regulatory Commission Accident Sequence Precursor Program: 2016 Annual Report, May 2017. (ADAMS ML17153A366)

[36] J. Primet and E. Panato, Precursor event program at EDF: objectives, method, results and insights, Proceedings of PSAM 10, Tenth International Conference of Probabilistic Safety Assessment and Management, Seattle, WA, June 14-19, 2010.

[37] N. Siu, et al., Accidents, near misses, and probabilistic analysis: on the use of CCDPs in enterprise risk monitoring and management, Proceedings of ANS International Topical Meeting on Probabilistic Safety Assessment (PSA 2017), Pittsburgh, PA, September 24-28, 2017.

[38] Nuclear Energy Agency, Probabilistic Safety Assessment (PSA) of Natural External Hazards Including Earthquakes, NEA/CSNI/R(2014)9, Proceedings of OECD/NEA/CSNI/WGRISK Workshop, Prague, Czech Republic, 17-20 June 2013.

[39] J. Weglian, External Flooding Hazard Analysis: State of Knowledge Assessment, TR 3002005292, Electric Power Research Institute, Palo Alto, CA, 2015.

[40] R.J. Budnitz and H.E. Lambert, An Evaluation of the Reliability and Usefulness of External -

Initiator PRA Methodologies, NUREG/CR-5477, 1990.

[41] A. Burton, et al., "A stochastic model for the spatial-temporal simulation of nonhomogeneous rainfall occurrence and amounts," Water Resources Research, 46(11): W11501, (2010).

[42] M.G. Schaefer, Stochastic event flood model (SEFM) stochastic modeling of extreme floods, Western Hydropower Dam Owners

Workshop, July 2011.

(Available from:

http://www.mgsengr.com/damsafetyfiles/Workshop_H&H_SEFM_Overview_Folsom.pdf)

[43] M. Roewekamp, S. Spebeck, and G. Gaenssmantel, Screening approach for systematically considering hazards and hazard combinations in PRA for a nuclear power plant site, Proceedings of ANS International Topical Meeting on Probabilistic Safety Assessment (PSA 2017), Pittsburgh, PA, September 24-28, 2017.

[44] Nuclear Energy Agency, Severe Weather and Storm Surge, NEA/CSNI/R(2017)13, Proceedings of OECD/NEA/CSNI/WGEV Workshop, Paris, France, in publication.

[45] G. Heo, et al., Gap analysis between single-unit and multi-unit PSAs for Korean NPPs, Proceedings of 13th International Conference on Probabilistic Safety Assessment and Management (PSAM 13), Seoul, Korea, October 2-7, 2016.

[46] S.M. Cetiner, et al, Level-0 PRA: Risk-informing the nuclear power plant I&C system, Nuclear News, pp. 48-52, February 2015.

[47] D. Dube, et al., Exelon economic enterprise risk modelling of a BWR, Proceedings of ANS International Topical Meeting on Probabilistic Safety Assessment (PSA 2017), Pittsburgh, PA, September 24-28, 2017.

[48] N. Siu, "Risk assessment for dynamic systems: an overview," Reliability Engineering and System Safety, 43, No. 1, pp. 43-73, (1994).

[49] Advanced Concepts in Nuclear Energy Risk Assessment and Management, T. Aldemir (Ed.),

World Scientific Publishing Co (2018). (Available from:

https://www.worldscientific.com/worldscibooks/10.1142/10587)

[50] Z. Ma, C. Smith, and S. Prescott, A case study of simulation-based dynamic analysis approach for modeling plant response to flooding events, Proceedings of ANS International Topical Meeting on Probabilistic Safety Assessment (PSA 2017), Pittsburgh, PA, September 24-28, 2017.