ML21081A040

Probabilistic Risk Assessment (PRA) Lessons from Seismic Events

ML21081A040
Person / Time
Issue date:	03/31/2021
From:	Nick Melly, Jose Pires, Nathan Siu, Frederick Sock, Jing Xing NRC/RES/DRA
To:
Siu, Nathan - 301 415 0744
References
Download: ML21081A040 (88)

Text

QUALITATIVE PRA INSIGHTS FROM SEISMIC EVENTS N. Siu, J. Xing, N. Melly, F. Sock, and J. Pires Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission March 2021 ABSTRACT Probabilistic risk assessment (PRA) oriented reviews of historical operational events can help identify potential gaps where improved approaches can increase analysis realism. This report documents the results of an exploratory project reviewing seismic events affecting nuclear power plant (NPP) operations through the full range of induced hazards (e.g., ground motion, displacement, fires, floods). Observations regarding human and organizational factors, seismic/fire interactions, and reactivity effects reinforce the importance of an integrated, multidisciplinary approach to seismic PRA.

i

TABLE OF CONTENTS ABSTRACT....................................................................................................................................................... i TABLE OF CONTENTS..................................................................................................................................... ii ABBREVIATIONS AND ACRONYMS ............................................................................................................... iv

1. BACKGROUND ....................................................................................................................................... 1

2. OBJECTIVES AND SCOPE........................................................................................................................ 2

3. APPROACH ............................................................................................................................................ 3

4. GENERAL OBSERVATIONS ..................................................................................................................... 4

5. DETAILED OBSERVATIONS AND INSIGHTS ............................................................................................ 8 5.1 Human and Organizational Factors............................................................................................... 8 5.1.1. Detection............................................................................................................................... 9 5.1.2. Understanding....................................................................................................................... 9 5.1.3. Decisionmaking ................................................................................................................... 10 5.1.4. Action Execution ................................................................................................................. 11 5.1.5. Teamwork ........................................................................................................................... 11 5.2 Seismic/Fire Interactions ............................................................................................................ 15 5.2.1. Fire Initiation ....................................................................................................................... 15 5.2.2. Fire Growth, Detection, and Suppression ........................................................................... 16 5.2.3. Plant Response .................................................................................................................... 17 5.2.4. Comment - Seismically-Induced HEAFs .............................................................................. 17 5.3 Reactivity Effects ......................................................................................................................... 17

6. INSIGHTS FROM EVENTS ..................................................................................................................... 19 6.1 Summary Insights ........................................................................................................................ 19

6.2. Commentary

Seismic Community Viewpoint ............................................................................ 20

7. KNOWLEDGE MANAGEMENT ............................................................................................................. 21

8. INSIGHTS FOR ADVANCED KNOWLEDGE ENGINEERING TOOL DEVELOPMENT ................................. 23 8.1 Inferencing from Indirect Indications ......................................................................................... 23 8.2 Temporal Reasoning ................................................................................................................... 26 8.3 Need for and Use of Broad Knowledge Bases............................................................................. 26 8.4 Varying Information Quantity and Quality ................................................................................. 28 8.5 Commentary - Near-Term KE Tool Improvements .................................................................... 30

9.

SUMMARY

CONCLUSIONS AND RECOMMENDATIONS ...................................................................... 31 9.1 Conclusions ................................................................................................................................. 31 ii

9.1.1 Technical Insights Relevant to Seismic PRA ........................................................................ 31 9.1.2 Knowledge Management Insights....................................................................................... 31 9.1.3 Knowledge Engineering Tool Insights ................................................................................. 32 9.2 Near-Term Actions ...................................................................................................................... 32 9.3 Recommendations ...................................................................................................................... 33 ACKNOWLEDGMENTS ................................................................................................................................. 33 REFERENCES ................................................................................................................................................ 34 NON-PUBLIC REFERENCE ............................................................................... Error! Bookmark not defined.

APPENDIX A - NOTABLE SEISMIC EVENTS AND EFFECTS ON NPPS ............................................................ 40 A.1 Events .......................................................................................................................................... 41 A.2 References .................................................................................................................................. 48 APPENDIX B - LICENSEE EVENT REPORTS ................................................................................................... 51 B.1 Events .......................................................................................................................................... 52 B.2 References .................................................................................................................................. 54 APPENDIX C - SEISMICALLY-INDUCED STRESS AND SITUATION ASSESSMENT AT FUKUSHIMA DAIICHI ... 55 C.1 Discussion.................................................................................................................................... 55 C.2 Data ............................................................................................................................................. 57 C.3 References .................................................................................................................................. 61 APPENDIX D - IDHEAS-G CFMS AND PIFS ................................................................................................... 62 APPENDIX E - HEAF EVENTS ....................................................................................................................... 67 E.1 Events .......................................................................................................................................... 68 E.2 References .................................................................................................................................. 76 APPENDIX F - U.S. SEISMIC PRA PERSPECTIVES.......................................................................................... 77 F.1 Results of Seismic PRAs ............................................................................................................... 77 F.2 Seismic PRA Maturity - Views Within Seismic PRA Community................................................. 78 F.3 References .................................................................................................................................. 78 iii

ABBREVIATIONS AND ACRONYMS AC alternating current ACRS Advisory Committee on Reactor Safeguards (NRC)

ADAMS Agencywide Documents and Management System (NRC)

AFW auxiliary feedwater ANS American Nuclear Society AOT Allowed Outage Time ASME American Society of Mechanical Engineers ATWS anticipated transient without scram BWR boiling water reactor CCDP conditional core damage probability CCW component cooling water CDF core damage frequency CETC core exit thermocouple CEUS central and eastern United States CFM cognitive failure mode CRDM control rod drive mechanism CSNI Committee for the Safety of Nuclear Installations (OECD/NEA committee)

CST condensate storage tank DBE Design Basis Earthquake DC direct current DG diesel generator E-W East-West (when referring to accelerations)

EAL Emergency Action Level ECCS emergency core cooling system EDG emergency diesel generator EOP emergency operating procedure EPRI Electric Power Research Institute EQ earthquake ESF engineered safety feature ETH Eidgenssische Technische Hochschule (Swiss university)

FLEX diverse and flexible mitigation strategies FME foreign material exclusion FWST fire water storage tank GL Generic Letter (NRC)

GSU generator step-up H horizontal (when referring to accelerations)

HEAF high energy arc fault HFE human failure event HPSI high-pressure safety injection HRA human reliability analysis I&C instrumentation and control IAEA International Atomic Energy Agency IDHEAS Integrated Human Event Analysis System ICES INPO Consolidated Event System (proprietary)

IDAC Information-Detection-Action-Crew IEEE Institute of Electrical and Electronics Engineers IN Information Notice (NRC)

INPO Institute of Nuclear Power Operations iv

IPEEE Individual Plant Examination of External Events IPSSS Indian Point Probabilistic Safety Study IRS Incident Reporting System (IAEA, proprietary)

ISFSI Independent Spent Fuel Storage Installation ITIC International Tsunami Information Center KE knowledge engineering LER Licensee Event Report LERF large early release frequency LFD local fire department LLNL Lawrence Livermore National Laboratory LLW low-level waste LOCA loss of coolant accident LOOP loss of offsite power LPI low pressure injection LPSI low pressure safety injection MCR main control room MDAFW motor-driven auxiliary feedwater MFW main feedwater MR master relay Mw moment magnitude (indication of earthquake magnitude)

N-S North-South (when referring to accelerations)

NAPS North Anna Power Station NEA Nuclear Energy Agency (OECD)

NEI Nuclear Energy Institute NIS nuclear instrumentation system NISA Nuclear and Industrial Safety Agency (Japan)

NM New Mexico NOAA National Oceanic and Atmospheric Administration NOUE Notice of Unusual Event NPP nuclear power plant NRC U.S. Nuclear Regulatory Commission NSC Nuclear Safety Commission (Japan)

NUREG designation for publications prepared by NRC staff NUREG/CR designation for publications prepared by NRC contractors OBE Operating Basis Earthquake OECD Organization for Economic Cooperation and Development OpE operational experience OL Operating License ONI Off-Normal Instruction PDA primary disconnect assembly PGA peak ground acceleration PIF performance influencing factor PM preventive maintenance PRA probabilistic risk assessment PSA probabilistic safety assessment Probabilistic Safety Assessment (ANS conference)

PSAM Probabilistic Safety Assessment and Management (conference)

RCP reactor coolant pump RCS reactor coolant system RES NRC Office of Nuclear Regulatory Research RIDM risk-informed decision making v

RPS reactor protection system RWST refueling water storage tank SBO station blackout SECY designation for NRC staff papers to the Commission SEL Seismic Equipment List SFP spent fuel pool SFPE Society of Fire Protection Engineers SI safety injection SME subject matter expert SMiRT Structural Mechanics in Reactor Technology (conference)

SNSWP Standby Nuclear Service Water Pond SS stainless steel SSC systems, structures, and components SSE Safe Shutdown Earthquake SSPS Solid-State Protection System TDAFW turbine-driven auxiliary feedwater TEPCO Tokyo Electric Power Company TSC technical support center UAT unit auxiliary transformer UE Unusual Event UPS uninterruptable power supply USGS U.S. Geological Survey UTC Coordinated Universal Time V vertical (when referring to accelerations)

WGRISK Working Group on Risk Assessment (OECD/NEA/CSNI working group)

WNA World Nuclear Association WUS western United States vi

1. BACKGROUND As described by SECY-18-0060 [1], the U.S. Nuclear Regulatory Commission (NRC) is seeking to increase its use of risk information in support of regulatory decision making. In support of this initiative, it is important to ensure that supporting probabilistic risk assessment (PRA) studies for nuclear power plants (NPP) provide treatments of the various contributing hazards, including seismic events, that are sufficiently realistic for the decisions at hand. PRA-oriented reviews of historical operational events involving these hazards can help identify and prioritize potential gaps where improved models, methods, tools, and/or data can improve analysis realism.

Examples of such reviews are provided by NUREG/CR-6738 [2], which looks at fires, an exploratory study of storms and flooding events [3], and in numerous papers following the March 2011 Fukushima Daiichi reactor accidents (e.g., [4, 5]).

In addition to supporting the improvement of PRA models, operational experience reviews can provide an empirically oriented point of view on key hazards that complements the decomposition-logic view of PRAs. In a risk-informed environment, the broadened perspective from these different points of view can be useful to decision makers as well as analysts. Thus, as the NRC staff changes with personnel knowledgeable of past events leaving the agency, associated knowledge management activities, including "active learning" exercises involving reviews of events and the development of "smart search" tools as well as more conventional activities (e.g., training courses, seminars), are becoming increasingly important. In late 2018, encouraged by the lessons of the previously mentioned study on storms and flooding events [3],

staff in the NRC Office of Nuclear Regulatory Research (RES) initiated an exploratory data mining project looking at historical seismic events.

This report documents the results of the project. It is an expansion of a conference paper that presented some of the early project results [76]. Some of the conclusions of this report are based on information from proprietary sources. That information can be found in a proprietary version of this report [80].

1

2. OBJECTIVES AND SCOPE The objectives of the project were as follows:

• Identify insights regarding seismic PRA methods, models, tools, and data potentially useful for seismic PRA analysts, reviewers, and/or developers.

• Provide an educational experience for the authors that supports NRCs risk-informed initiatives.

• Identify lessons regarding the mining of seismically related operational experience that might be useful in the development of advanced knowledge engineering (KE) tools. 1 The project considered the full range of hazards (e.g., ground motion, displacement, fires, floods) induced by seismic events. However, as an exploratory project, the project scope was limited to seismic events affecting NPP operations. In particular:

• The project did not address seismic operational experience involving discoveries of plant conditions (perhaps identified by inspections) that can degrade a plants response to a seismic event.

• The project did not address seismic effects on non-reactor facilities.

• The seismic engineering community routinely looks at hazard and fragility lessons from seismic events (e.g., [6-16]). The projects focus, therefore, was on the third major element of seismic PRA: plant response analysis.

It should be emphasized that the project was neither an attempt to engage in post-event fault finding nor an exercise to characterize the conditional likelihoods of key failures during postulated earthquakes. The focus was on identifying qualitative lessons for future PRA use and development.

1 At the start of this project, the original objective was framed in terms of intelligent search tools.

Recognizing that there are many tools that go beyond finding information, we broadened the objective to include knowledge engineering tools. Advanced knowledge engineering tools include such things as content analytics tools, a broad class of software tools that use a variety of approaches (e.g.,

natural language queries, trends analysis, contextual discovery, and predictive analytics) to identify patterns and trends across an unstructured database (e.g., text). See Chapter 8 for further discussion.

2

3. APPROACH The project team started with three members with combined expertise in general PRA methods development and seismic fragility analysis. These team members are quite familiar with seismic PRA (e.g., as reviewers), but do not consider themselves to be experts in the performance of seismic PRA. As the project progressed, the team added staff with expertise in human reliability analysis (HRA) and fire PRA.

The project employed a straightforward two-step process to develop insights. First, the team performed a literature search to identify candidate events for detailed review. This search involved the use of the NRCs Licensee Event Report (LER) search system (https://lersearch.inl.gov/Entry.aspx), the International Atomic Energy Agencys (IAEA) proprietary Incident Reporting System (IRS) (https://irs.iaea.org), the Institute of Nuclear Power Operations (INPO) proprietary INPO Consolidated Event System (ICES)

(https://apps.inpo.org/xICES), a publicly accessible event database developed and managed by Eidgenssische Technische Hochschule (ETH) Zürich (http://www.er.ethz.ch/nuclear-energy.html) [17], and various publicly available documents that were identified through typical web search strategies. These latter documents included seismic analysis guidance documents

[7, 18] as well as industry trade publications (e.g., [19]). As indicated earlier, the focus was on actual seismic events, as opposed to seismically relevant degraded plant conditions (e.g., as identified during inspections and reported through LERs).

To provide appropriate caveats on the project results, it is important to recognize the following.

• Most of the seismically-induced transients identified in the search were relatively minor events for which little detailed plant response information is readily available. Many of the detailed insights reported in this paper are therefore based on lessons from three well-documented events: the July 16, 2007 Niigataken Chuetsu-oki Earthquake that involved the Kashiwazaki-Kariwa NPP, the March 11, 2011 Great East Japan Earthquake that involved multiple NPPs, and the August 23, 2011 Mineral, Virginia Earthquake that involved the North Anna NPP. 2

• As a scoping study, we did not attempt to develop a comprehensive event database in the spirit of that described by Ref. 17, nor did we exhaustively review the voluminous literature on Fukushima Daiichi. 3 2 For brevity, the remainder of this report uses Kashiwazaki-Kariwa to refer to the events associated with the 2007 Niigataken Chuetsu-oki Earthquake, 3/11 to refer to the 2011 Great Eastern Japan Earthquake, Fukushima Daiichi to refer to the 2011 Fukushima Daiichi reactor accidents, and North Anna to refer to the events associated with the 2011 Mineral earthquake.

3 Note that some of the authors have performed more extensive (but still not exhaustive) reviews in support of Refs. 4 and 5.

3

4. GENERAL OBSERVATIONS The projects literature search has identified 50 earthquakes that:

• affected power operation (e.g., by triggering a reactor trip);

• could have affected power operation but didnt (e.g., events that might have triggered a reactor trip but didnt because the plant was not yet operating or was already shutdown for other reasons);

• were large but were documented as having little or no actual effect on NPPs in the general region.

The last category of events was included in case there was useful information to be gleaned.

In addition, the project has reviewed information on a small number of severe earthquakes for which reports provide useful information on earthquake effects but little or no information about NPP impacts.

The full set of events reviewed is provided in Appendix A. It is important to note that the appendix, which draws upon information from multiple documents, is a synthesis and initial compilation of information that we consider adequate for the needs of the project. However, the data have not been peer reviewed and should not considered to be authoritative. Additional verification of the information and associated revision of the notes will be necessary for uses other than those for this project.

Note also that Appendix A includes a number of earthquakes for which we did not find explicit mention of effect (or non-effect) on an NPP. (These earthquakes are not included in the final tally of 50 events.)

Table 1 provides some summary statistics for the 50 earthquakes. It should be emphasized that this table only characterizes the project dataset. Given the exploratory nature of the project, it should not be used as quantitative basis for decision support.

Based on available documentation for the earthquakes in our dataset, we make the following general observations.

• A number of earthquakes have exceeded the NPPs Operating Basis Earthquake (OBE) and/or Safe Shutdown Earthquake (SSE) for at least part of the response spectrum. 4 In a number of cases, this occurred before the plant had started commercial operation.

Note that per Refs. 7 and 20 and empirical experience, simple exceedance of the OBE/SSE is not necessarily a good indicator of actual damage. In our project, OBE/SSE exceedance is only an indicator of an event of potential interest for deeper review.

4 Note that the OBE and the SSE have different regulatory roles. The OBE is used to establish shutdown following an earthquake event and other operational parameters such as fatigue thresholds.

The SSE is a design parameter to protect against onset of damage for the SSCs.

4

Table 1. Summary Statistics for 50 Reviewed Earthquakes (1975-2019)

Japan Outside Japan Earthquakes Earthquakes exceeding then-current OBE or SSE 3 7 Earthquakes with large aftershocks (Mw > 6)a 4 3 Earthquakes felt at multiple sites 7 9 Earthquakes causing at least one reactor tripb 8 3 Reactor Effects Seismically-induced reactor tripsc 24 9 Seismically-induced complicated transientsd 12e 8 aA somewhat arbitrary value chosen solely for illustrative purposes.

b Excludes events where trip signals were triggered but the reactor was already shutdown.

c Includes trips due to causes other than local ground motion (e.g. seismically-induced tsunamis or offsite grid damage causing loss of offsite power - LOOP).

d A subset of seismically-induced reactor trips. For the purposes of this report, a complicated transient involves a reactor trip and potentially significant additional failures (e.g., LOOP, challenges to ultimate heat sink, failures requiring significant offsite resources in response).

e Eleven of these transients occurred on March 11, 2011.

• The highest peak ground accelerations (PGA) reported were for Kashiwazaki-Kariwa.

Per Ref. 21, these were in the free-field and near the foundation levels. Both of these foundation level PGAs were less than 1.0g. (Values around 0.88g were reported from a downhole array in the proximity of the Unit 1 Reactor Building.) At the ground surface, a PGA of about 1.25g was reported in the proximity of Unit 5.

• Some of the larger earthquakes had large (moment magnitude - Mw - greater than 6.0 5) aftershocks. For one event (3/11), the main shock was preceded by a number of large foreshocks. One event (Kashiwazaki-Kariwa) was followed by an independent, large earthquake (Mw 6.8) some distance away. The potential PRA-significance of multiple shocks is discussed in Section 5.1.

• Earthquakes affecting one unit on a site generally affected other units at the same site.

(In some cases where a multi-unit impact is not indicated, it is not clear from the event description if the other units were already shutdown.)

• Ten earthquakes affected operations (e.g., through the triggering of some alert level) at multiple sites, some of which were separated by significant distances. It appears that only two of these ten events (the 1999 Chi Chi earthquake in Taiwan and the 3/11 event) involved a system response (e.g., reactor trip) at multiple sites. The 3/11 event, which 5 See Note a for Table 1. Depending on a variety of factors (including NPP distance from the earthquake epicenter), a shock with Mw less than 6.0 can affect the plant. For example, the North Anna main shock was magnitude 5.8. Detailed information on earthquakes (whether) fore-, main, or aftershock, can be found using the U.S. Geological Surveys (USGS) online Earthquake Catalog:

https://earthquake.usgs.gov/earthquakes/search/.

5

affected the Fukushima Daiichi, Fukushima Daini, Onagawa, Tokai, and Higashidori sites - the last two separated by over 500 km - is the only event involving serious challenges across multiple sites.

• None of the earthquakes reviewed appear to have damaged major mitigating systems (e.g., emergency diesel generators - EDG, emergency core cooling systems - ECCS, auxiliary feedwater - AFW) via ground motion. Most onsite equipment losses and other complications (e.g., debris, heavy smoke) during 3/11 were caused by induced hazards, namely seismically-induced tsunamis and fires. Note that per post-3/11 interviews [22]:

o it is possible that the earthquake damaged air lines needed to operate an air-operated containment vent valve at Fukushima Daiichi; o operators had to consider the possibility that the earthquake had damaged fire protection lines inside of buildings that they were trying to use to provide cooling water to the reactors. 6

• A few earthquakes resulted in very low (0.01 to 0.03g) PGAs at the plant but nevertheless triggered reactor trips or safety system actuations (for shutdown plants).

• In at least two cases (Onagawa 1, 1993; North Anna 1 and 2, 2011), reactor trips were caused by neutron flux readings rather than ground motion detectors.

• Beyond 3/11, other earthquakes causing complicated transients 7 are as follows. (See Appendix A for more details.)

o Chi Chi (Taiwan) Earthquake (1999) - failure of 345 kV transmission line offsite led to grid instability and automatic shutdown of Chinshan 2-3 and Kuosheng 1-3.

The onsite PGAs (less than 0.05g) were significantly smaller than the OBE (Chinshan: 0.15g; Kuosheng: 0.20g) [14].

o Sumatra-Andaman Earthquake (2004) - tsunami flooding and debris failed seawater pumps, complicating shutdown of Madras 2 [31].

o Kashiwazaki-Kariwa (2007) - an onsite large transformer fire at Kashiwazaki-Kariwa 3 (caused by differential ground subsidence) led to complications in event response. Ground movement also ruptured an underground pipe, leading to some reactor building flooding [78]. 8 The maximum onsite PGAs at the foundation levels were around 0.88g in the free field and 0.69g in reactor building basements [23].

6 Interestingly, based on observations from Kashiwazaki-Kariwa, the plant manager thought such damage was unlikely. However, he knew he had to consider the possibility.

7 See Note c for Table 1.

8 The earthquake damaged an external, buried fire suppression system pipeline. Water soaked into the ground and entered the reactor building through a penetration. Water accumulated in the basement of the radwaste portion of the building, overwhelming the building sump pumps, leading to a water level of 48 cm [79].

6

o North Anna (2011) - the earthquake induced both reactor trip and LOOP at North Anna 1 and 2. The reactor trips were due to high neutron flux rate; the LOOP was due to actuation of sudden pressure relays for multiple transformers (i.e.,

due to ground motion but not actual damage). The spectral accelerations exceeded the OBE and design basis earthquake (DBE). However, post-event walkdowns and inspections found no significant physical or functional damage to safety related structures, systems, and components (SSCs) [24]. These appear to be the only seismically-induced commercial NPP reactor trips in the U.S.

(Appendix B provides a listing of LERs from the period 1980-2014 that include the search terms earthquake and reactor trip.)

• There has been at least one earthquake that, to a non-expert, would appear to have had more damage potential had circumstances (e.g., epicenter location, plant status) been somewhat different. This is the 1993 Hokkaido-Nansei-Oki earthquake (near the Tomari NPP). It appears that there was a 4-5 m tsunami in the vicinity of the plant (per data from Ref. 53) but no effect on plant operations [19]. Per Ref. 53, the tsunami runups were 7-9 m some 45-60 km down the coast. However, recognizing the importance of bathymetry, we do not know if a slightly different epicenter location would have resulted in a significantly larger tsunami at the plant.

7

5. DETAILED OBSERVATIONS AND INSIGHTS It is well recognized that, in addition to causing SSC failures by ground motion, earthquakes can influence the progression of an accident scenario by affecting plant operators and/or by causing induced (sometimes called secondary or consequential) hazards such as seismically-induced fires and floods that, in turn, can cause additional SSC failures. Perhaps less well recognized within the NPP PRA community, earthquakes can also cause reactivity excursions that might trigger a class of scenarios (anticipated transients without scram - ATWS).

This section provides some PRA-relevant observations regarding these potential effects based primarily on the descriptions of the Kashiwazaki-Kariwa, 3/11, and North Anna events. Given that these events are several years old and have been extensively studied, some of the observations are not new or unique. Nevertheless, they are useful enough to bear repeating.

5.1 Human and Organizational Factors In NPP PRAs, the influence of human and organizational factors on accident progression is modelled through human failure events (HFEs), i.e., basic events representing the failure of needed human actions. (In a few cases, inappropriate actions, called errors of commission, are also modelled.) The role of HRA is, as part of an integrated PRA effort, to identify which actions should be included in the PRA model, determine whether these actions are feasible under various conditions specified in the PRA model, and, if so, determine the likelihood of failure. The last step, typically referred to as quantification, requires a qualitative analysis of the actions (What tasks need to be performed? What are the specific conditions of performance and how might these conditions affect performance?) as well as quantification.

The general principles of NPP HRA are agreed upon by the HRA community (e.g., see NUREG-1792 [25]), but there are many different HRA methods and models, and, consequently, a variety of ways of looking at operational experience. The following observations are organized following the Information-Detection-Action-Crew (IDAC) cognitive framework developed by Mosleh [26] and adapted by the NRCs Integrated Human Event Analysis System - General (IDHEAS-G) methodology [26]. This framework is based on five macrocognitive functions underlying human decision making and action.

As shown in Figure 1, performance of a broad action of interest in the PRA (e.g., depressurizing the reactor coolant system - RCS - to enable low pressure injection - LPI) involves a number of tasks. For each task, needed information must be detected and understood, an appropriate decision must be made, and appropriate action taken. Depending on the task, these macrocognitive functions can be accomplished by a single individual, by a team, by a larger organization, or even multiple organizations, and so coordination is important.

8

Figure 1. Macrocognitive Functions in IDHEAS-G [27]

The following observations are organized by macrocognitive function. Note that they are focused on impacts particularly relevant to seismic PRA. There are, of course, many more lessons (particularly from 3/11) regarding human and organizational lessons (e.g., [28-32]).

HRA-specific lessons are also available in the literature (e.g., [4, 5]). 9 5.1.1. Detection The collection of needed information has been directly hampered by earthquake ground motions and/or induced hazards (e.g., flood, fire). The hazard impacts include:

• Unavailability of instrumentation and control (including the seismic event detection system)

• Spurious alarms

• Degraded and dangerous site conditions (e.g., debris, damaged roads, uncovered manholes, onsite flooding 10) that hampered surveys and, in combination with loss of communication systems, delayed relaying of field information to decision makers 5.1.2. Understanding The ability of the operating crew to understand plant status and event progression can be affected by a severe seismic event. In addition to the information issues mentioned above, 9 Most HRA-related observations derived from the events of March 11 emphasize negative aspects.

Given our interest identifying areas of potential PRA improvement, this paper has a similar emphasis.

However, it should be recognized that, in spite of the enormous challenges facing operators, there were also significant human action successes (e.g., the prevention of damage to other reactor units, including Fukushima Daiichi Units 5 and 6).

10 Note that two workers died at Fukushima Daiichi while performing a field survey [29].

9

seismic events can raise stress levels and potentially impact cognitive processing. At Fukushima Daiichi, operators were highly stressed not only because of the deteriorating plant conditions but also because of concerns of offsite conditions affecting family, friends, etc. We note that operators were initially confident in their response to the earthquake shock but became increasingly stressed after the second tsunami struck and reactor units lost power. 11 However, at this point, we do not have clear evidence that stress affected operator understanding. Additional discussion is provided in Appendix C.

It should be recognized that such cognitive effects are not mentioned for the other seismic events reviewed in this project. However, in most cases, it can be reasonably assumed that the effects (if any) were minor, due to the minor ground motions at the site. Furthermore, in at least one case involving more severe shaking (North Anna), the effects also appear to have been minor, as evidenced by the Shift Managers appropriate decision to enter the Emergency Action Level matrix despite the lack of indication from the Seismic Monitoring Instrumentation Panel (which had lost power). It would be interesting to investigate the reactions and performance of the operating crews at the Kashiwazaki-Kariwa plant during the 2007 earthquake, given the significant ground accelerations (greater than those experienced by Fukushima Daiichi on 3/11) and offsite damage caused by that earthquake.

5.1.3. Decisionmaking Of the events reviewed, naturally the greatest decision-making challenges were posed by the multiple unit accidents at Fukushima Daiichi. Given the lack of preparation and resources for such events, decision makers, particularly the Site Superintendent, had to decide upon and prioritize recovery activities (in a situation where key plant status information was unavailable).

We note that tsunami warnings following the main earthquake shock apparently affected the superintendents accident management plans, focusing concern on the potential loss of the seawater pumps (the plants ultimate heat sink). This is an illustration of how the anticipation of seismically-induced events (whether or not they actually occur) might need to be considered in an HRA and is related to the topic of aftershocks discussed below.

It is worth noting that post-event interviews (e.g., [22]) indicate the Site Superintendents lack of confidence in available accident management plans, due to the view that these plans focused on scenarios triggered by internal events and did not cover the ongoing, seismic-/tsunami-triggered conditions:

Yoshida [the Site Superintendent] was asked if he opened up the accident management manual and used it as a reference. He said he never referred to it or even opened it up.

He explained how ineffective measures thought up by people beforehand can be.

Yoshida also explained that nuclear plants in Japan were designed with priority 11 The staff at the Emergency Response Center was lost for words at the ongoing unpredicted and devastated state [28].

10

placed on internal factors leading to malfunctions. He went on to explain that no thought was given to malfunctions occurring simultaneously at a number of plants due to external factors, such as tsunami, tornado, a plane crash or an act of terrorism.

Based on our reading of the record, most of the decision-making challenges during 3/11 appear to have been due to the knock-on effects of the earthquake and tsunami (notably the loss of all power and subsequent losses of equipment and indications), and not literally the earthquake (ground motion) and tsunami (inundation, dynamic forces, etc.) themselves. We can only speculate whether frustrations with the limited scope of pre-event planning affected the timing and nature of specific decisions.

5.1.4. Action Execution As discussed earlier, onsite conditions induced by the seismic shock and induced hazards hampered the performance of needed actions. In addition to debris and flooding at Fukushima Daiichi 12 and road damage at both Kashiwazaki-Kariwa and Fukushima Daiichi, the following are worth noting.

• Access system failure (loss of power to a security gate) at Fukushima Daiichi

• Heavy smoke from a high energy arc fault (HEAF) at Onagawa on 3/11

• Multiple major aftershocks and tsunami warnings at Fukushima Daiichi Regarding aftershocks and warnings, these are important because of associated concerns with worker safety: a) delayed the initiation of needed activities (e.g., plant damage surveys), and b) interrupted ongoing work activities.

Although not seismic-specific, it is interesting to note that understaffing played a role during the Kashiwazaki-Kariwa event (the earthquake occurred on a national holiday) as well as during the Fukushima Daiichi reactor accidents. In the latter case, self- and directed evacuation of some onsite personnel contributed to the lack of organizational knowledge (e.g., operation of equipment, location of items).

5.1.5. Teamwork Coordination challenges arose during responses to the Kashiwazaki-Kariwa and 3/11 events.

The following are noteworthy from the standpoint of seismic PRA.

12 One fire truck was carried away by the tsunami; another was unable to reach other parts of the plant because of road damage.

11

• For Kashiwazaki-Kariwa, the arrival of the local (offsite) fire department was delayed.

Given the scale of offsite destruction caused by the earthquake, it seems possible that offsite needs for emergency services played a role in this delay.

• For 3/11, this was a regional event with widespread impact on national infrastructure and emergency response systems (including a key offsite emergency response center as well as communications 13).

• For 3/11, coordination difficulties also arose due to the involvement of multiple offsite organizations which demanded information and provided suggestions and directions.

Such difficulties are not unique to seismic events but could have been amplified by the regional scale of the event (which is characteristic of a major earthquake). 14 Note that the IDHEAS-G methodology has more detailed structure underlying the five macrocognitive functions used to structure our observations. Two key elements of this detailed structure are cognitive failure modes (CFMs) and performance influencing factors (PIFs).

Table 2 maps our observations from the reviewed seismic events to IDHEAS-Gs mid-level CFMs and PIFs. (Appendix D provides a complete list of the IDHEAS-G CFMs and PIFs. 15) 13 The Off-site Center (OFC) at Okuma, some 5 km away from Fukushima Daiichi, was initially non-functional due to loss of normal power, loss of emergency power (the diesel generator fuel transfer pump was damaged by the earthquake), limited staffing (due to transportation network damage and heavy traffic congestion), and loss of primary telecommunications systems. A Vice Minister who was supposed to lead the OFC activities tried but was unable to leave the Tokyo area by car because of traffic congestion; he eventually had to take a military helicopter. [28]

14 From a positive standpoint, despite these coordination challenges, Fukushima Daiichi did receive assistance from offsite organizations, including less-affected NPPs 15 Appendix D provides draft descriptions of the CFMs and PIFs. Work to finalize these descriptions, including some rewording and re-categorization of PIF attributes is ongoing 12

Table 2. Mapping of Human Factors Observations to Mid-Level Cognitive Failure Modes (CFMs) and Performance Influencing Factors (PIFs)

Macrocognitive Function(s) and Observation Applicable CFMs Relevant PIFs Detection Decisionmaking pS2 human-system interface (HSI)

Unavailability of I&C (including seismic event pS3 equipment and tools detection) D2 Fail to select, identify, or attend to pT1 information availability and reliability sources of information DM3 Information is under-represented Detection Action Execution D1 Fail to establish the mental model for pT2 multitasking, interruptions, and Spurious alarms (e.g., fire alarms) detection distractions D3 Fail to perceive, recognize, or classify information E4 Fail to perform the planned action Detection Action Execution Degraded and dangerous site conditions pE1 accessibility/habitability of workplace (e.g., debris, road damage, unknown including travel paths D2 Fail to select, identify, or attend to structural damage) pE5 resistance to physical movement sources of information, E4 Fail to perform the planned action Understanding Stress due to plant conditions and U3 Incorrect integration of data and mental pT5 time pressure and stress progressive loss of control model U4 Fail to iterate the understanding Decisionmaking Scenario dynamics (e.g., expectations of DM3 Information is under-represented pT1 scenario familiarity tsunamis after seismic shock)

DM5 Failure to simulate or evaluate the decision/strategy/plan 13

Macrocognitive Function(s) and Observation Applicable CFMs Relevant PIFs pE1 accessibility/habitability of workplace Execution including travel paths Aftershocks (prompting precautionary pE3 noise in workplace and communication E3 Fail to coordinate action measures as well as actual damage) pathways implementation pE5 resistance to physical movement E4 Fail to perform the planned action pT6 physical demands Teamwork pP1 staffing Offsite damage (local, including road damage) T1 Fail to establish or adapt the teamwork pP3 teamwork and organizational factors T6 Fail to implement decisions pE5 resistance to physical movement T7 Fail to control the implementation Teamwork pP1 staffing Offsite damage (regional, including T2 Fail to manage information pT1 information availability and reliability emergency response center damage)

T3 Fail to maintain shared situational pP3 teamwork and organizational factors awareness Teamwork pT2 multitasking, interruptions, and Organizational interactions (e.g., demands for distractions information, suggestions/directions for action; T4 Inappropriately manage resources pT3 task complexity amplified for regional events) T5 Fail to plan/make interteam decisions pT5 time pressure and stress or generate commands 14

5.2 Seismic/Fire Interactions In 1989, Sandia National Laboratories performed a Fire Risk Scoping Study (NUREG/CR-5088

[33]) that identified seven potential seismic/fire interactions based apparently on general principles and supported by non-nuclear seismic experience:

1. Cable pulling

2. Flammable liquid spills

3. Flammable gas release

4. Spread of fire from non-Category I SSCs

5. Failure of suppression systems

6. Spurious suppression actuation (leading to loss of suppressant inventory as well as SSC wetting)

7. Degradation of fire recognition and fire fighting in a post-earthquake environment (including spurious fire alarms, aftershocks, LOOP, loss of non-emergency lighting)

NPP operational experience in the 30 years since then provides examples for some of these interactions. It also introduces an interaction - seismically-induced HEAFs - not explicitly identified by the scoping study. The following discussion of observations is structured using a three-element fire PRA framework commonly used to describe fire PRA (e.g., [34, 35]). The elements are: fire initiation, fire-induced damage to SSCs (considering fire detection and suppression as well as fire growth), and plant response.

5.2.1. Fire Initiation Seismically-induced fires occurred at Kashiwazaki-Kariwa and at Onagawa (on 3/11).

• Both events involved HEAFs.

o The Kashiwazaki-Kariwa HEAF involved a large station (house) transformer at Unit 3. It was caused by differential ground subsidence leading to vertical displacement of the transformer relative to its secondary connection bus, leading to one or more ground and/or short circuit faults.

o The Onagawa HEAF involved a non-emergency, 6.9 kV switchgear cabinet in the Unit 1 Turbine Building. It was caused by seismic shaking of Magne-Blast breakers, which have vertically oriented breaker stabs and are hung by buses in the cabinet (i.e., they are not fixed to the floor).

15

• No other seismically-induced fires have been reported for the Kashiwazaki-Kariwa and the 3/11 events. 16

• Seismically-induced fires have not been reported in any of the other event descriptions reviewed.

We recognize the possibility that: (a) the project dataset might not include all significant seismic events involving NPPs, and (b) the reports reviewed (many of which are high-level summaries) might not mention induced or coincident fires if they are considered to be minor. Nevertheless, we think that for at least the PGA ranges observed, considering the large number of potential fire initiation sites at any NPP, a seismically-induced NPP fire at any specific initiation site is certainly possible but not highly likely. 17 5.2.2. Fire Growth, Detection, and Suppression Our observations regarding the extent of seismically-induced fires and associated fire-fighting efforts are as follows.

• At Kashiwazaki-Kariwa, the HEAF-induced fire involved leaking transformer oil from a failed bushing but did not spread further due to existing fire walls.

• At Onagawa, the HEAF-induced fire affected all ten sectors of the switchgear cabinet. It also involved some vertical cables rising from the cabinet but did not spread further.

• Dust re-suspended by seismic shaking led to spurious fire detection alarms at Kashiwazaki-Kariwa, 18 Onagawa, and Fukushima Daiichi.

• At Onagawa, dense smoke filled large portions of the Turbine Building and hindered identification of the fire location.

• Fire suppression efforts were affected by the previously discussed coordination issues and broken underground fire lines (at Kashiwazaki-Kariwa) 19 and damaged roads (at 16 Reactor Building fires at Fukushima Daiichi Unit 4 apparently were initiated by a hydrogen explosion.

17 A similar inference, with similar caveats, can be made considering non-nuclear industrial facilities with electric power components analogous to those at NPPs. See, for example, Ref. 12 which provides a photograph of damage caused by a seismically-induced fire at the Kobe Substation. From the information presented, it appears that the fire might have been due to fracturing of anchor bolts for a 275/77 kV 300 MVA transformer and subsequent transformer movement.

18 This phenomenon is not mentioned in the Kashiwazaki-Kariwa documents in the project database but is mentioned in a report on 3/11 as something the Fukushima Daiichi shift supervisor knew about based on Kashiwazaki-Kariwa experience [28]. As with our discussion of seismically-induced fires, it should be cautioned that when an event report doesnt mention a particular phenomenon, this is not definitive proof that the phenomenon didnt occur.

19 Interestingly, fire protection lines moved aboveground at Fukushima Daiichi as a result of the Kashiwazaki-Kariwa experience were exposed to and damaged by the tsunami on 3/11.

16

both Kashiwazaki-Kariwa and Onagawa). The Kashiwazaki-Kariwa fire lasted for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />; the Onagawa fire lasted for 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />.

We note that within the U.S. and internationally, there are different strategies regarding reliance on onsite versus offsite fire brigades. These different strategies will likely lead to different firefighting challenges when responding to large scale events such as major earthquakes.

5.2.3. Plant Response It does not appear that the seismically-induced HEAFs at Kashiwazaki-Kariwa and Onagawa, by themselves, led to major complications in plant response. Of course, in the case of the latter, the seismically-induced partial LOOP and the following (seismically-induced) tsunami provided significant challenges.

5.2.4. Comment - Seismically-Induced HEAFs The HEAFs at Kashiwazaki-Kariwa and Onagawa did not have significant nuclear safety impacts. However, it is important to recognize that HEAFs can be safety-significant. A HEAF was a major contributor to a 2-hour station blackout at the Maanshan (Taiwan) NPP in 2001

[36], 20 and recent research activities have identified a HEAF-related damage mechanism (the creation of a cloud of conductive byproducts and particles) that, for certain plants, has the potential to affect SSCs outside of previously assumed zones of influence [37].

Current PRA standards (e.g., [38]) and guidance (e.g., [18, 39]) indicate there are significant challenges in quantitatively treating seismically-induced fires (including HEAFs) and rely heavily on walkdowns to qualitatively identify potential scenarios.

Given our observation of the potential significance of seismically-induced HEAFs, we have performed a quick review of 24 HEAF events (all non-seismically initiated) experienced by U.S.

NPPs (see Appendix E). Our review identified several HEAF root causes (including loose or degraded connections, foreign material) that might be triggered or exacerbated by a seismic event. It is not clear if many of these root causes are readily identifiable by visual inspection conducted as part of a typical seismic PRA walkdown. However, HEAF-targeted preventative maintenance activities described in Ref. 39, including bolted connection torque checks, foreign material exclusion (FME) measures, stab connection thermography and corona tracking efforts would likely be effective.

5.3 Reactivity Effects As indicated earlier in this report, two earthquakes in our dataset led to neutron-flux related reactor trips at Onagawa (1993) [19] and North Anna (2011) [41], rather than trips due to ground motion detection. (In the case of North Anna, the Seismic Monitoring Instrumentation Panel was 20 Note that during the Maanshan event, heavy smoke from the HEAF was a key factor in preventing operator actions needed to terminate the SBO.

17

unavailable.) The fact that earthquakes have caused reactivity excursions: a) may not be widely recognized in the PRA community when considering the potential for ATWS, and b) might be an important observation in the development and analysis of new reactor designs.

Also relevant to ATWS, it is worth noting that post-event inspections at Kashiwazaki-Kariwa identified a stuck control rod at Unit 7 [42, 43]. (The rod was inserted but couldnt be withdrawn.)

18

6. INSIGHTS FROM EVENTS 6.1 Summary Insights The large majority of the 50 events listed in Appendix A have had, at most, relatively minor impact on the operation of potentially affected NPPs. However, five earthquakes led to complicated (or at least non-routine) multi-unit and sometimes multi-site events and are of interest to seismic PRA modeling.

• 1999 Chi Chi (Taiwan) earthquake: affected Chinshan 2-3 and Kuosheng 1-3

• 2004 Sumatra-Andaman (Indian Ocean) earthquake and tsunami: affected Madras 1-221

• 2007 Niigata Chuetsu-Oki (Japan) earthquake: affected Kashiwazaki-Kariwa 1-7

• 2011 Great East Japan earthquake and tsunami: affected Fukushima Daiichi 1-6; Fukushima Daini 1-4, Onagawa 1-3, Tokai Daini, and Higashidori 1-2

• 2011 Mineral (VA) earthquake: affected North Anna 1-2 Of specific interest, earthquakes (and subsequent induced hazards, particularly tsunamis and HEAFs) have caused:

• LOOP and (in the case of Fukushima Daiichi) SBO

• Degradation or loss of ultimate heat sink

• Damage (and concerns of potential damage), disruptions (e.g., due to aftershocks and tsunami warnings) and/or adverse environmental conditions (e.g., debris, smoke) affecting event recovery

• Seismically-induced reactivity excursions and associated reactor trips (i.e., reactor trips not caused by seismic ground motion detectors)

We observe that the above effects have occurred from events with onsite ground motions significantly less than the maximum values (on the order of 2-4g for Central-Eastern United States - CEUS - plants) considered by current seismic PRAs. (See Appendix F.)

We further observe that many non-seismically-induced HEAFs in U.S. plants have involved root causes that might be triggered or exacerbated by a seismic event.

Available project resources did not permit a formal comparison of these summary observations (and the detailed observations provided earlier in this chapter) against current seismic PRA standards and guidance. We expect that such a comparison would yield useful insights for the performance of seismic PRA.

21 Madras 1 was in cold shutdown and we have no information on the tsunamis effect. Based upon the general event description, it appears that various components and systems related to the plants ultimate heat sink likely were affected.

19

6.2. Commentary

Seismic Community Viewpoint Appendix F provides seismic CDF estimates from a number of historical and recent studies. The large uncertainties shown in the appendix illustrate the more general point that seismic risk estimates are subject to large uncertainties, with much of the uncertainty being attributed to seismic hazard estimates for severe earthquakes [18]. Despite these large uncertainties, there seems to be little concern within the seismic PRA community regarding the maturity of seismic PRA as a tool for practical decision support. Ref. 44 provides a recent affirmation in this regard. 22 Its potentially instructive to contrast this situation with that facing the fire PRA community, where the maturity and realism of available methods, models, and tools have been hotly debated over the last several years [47, 48]. 23 Since operational experience doesnt provide a useful benchmark for the ultimate results of a fire PRA (no fire-induced core damage accidents have yet occurred), critics have focused on intermediate results (e.g., the estimated frequency of fire-induced LOOP). These results appear to be larger than observed in operating plants.

There are, of course, nuances and pitfalls associated with such comparisons - see Ref. 47 for detailed discussion. Nevertheless, we note that, some 50 years after Cornells landmark paper on seismic risk analysis [49] and 40 years after the first-of-a-kind seismic PRA for Oyster Creek

[50], a quantitative comparison of seismic PRA predictions with operational experience might usefully identify areas where improvements could support increased PRA realism. Such a comparison would supplement the qualitative exercise performed in this project.

22 It should be recognized that there are also naysayers. See, for example, the 1981 discussion in Ref. 45 on differences in viewpoints that stem from different roles and interests; and the recent critique in Ref. 46. However, in our experience, currently such views seem to be in a minority, at least within the seismic PRA community.

23 Interestingly, as discussed in Ref. 3, there have been a number of nuclear power plant fires that have posed severe safe shutdown challenges and can be viewed as significant accident precursors. In contrast, we believe there have been no significant accident precursors due directly to the strong ground motions that are currently the focus of most seismic PRAs. (The accidents at Fukushima Daiichi and the challenges to Fukushima Daini and Onagawa on 3/11, of course, were primarily due to the tsunami, although ground motion did cause LOOP at a number of plants.)

20

7. KNOWLEDGE MANAGEMENT As discussed in Chapter 2, the second project objective was to provide an educational experience for the authors that would support NRCs risk-informed initiatives. In particular, the intent was for team members, each of whom has a particular area of interest (e.g., HRA, fire PRA, structural engineering), to learn more about other aspects of seismic risk and seismic PRA through the performance of PRA-oriented event reviews and discussion of these reviews.

The individual project team members learned a number of lessons, some confirmatory and some surprising. Notable lessons include the following:

• Project lead (PRA generalist):

o The lack of major NPP safety impacts for the large majority of events reviewed o The lack of ground-motion/displacement induced damage for most NPP SSCs even for the most severe events reviewed o The occurrence of seismically-induced reactor trips due to the exceedance of neutron flux parameters (as opposed to ground motion measurements) o The potential risk importance of seismically-induced HEAFs

• HRA expert: the variety and nature of contextual factors (e.g., obstacles, visibility) potentially affecting post-earthquake operator actions

• Fire PRA expert:

o The lack of minor, seismically-induced fire events in the LER database. This raises the question as to whether only larger plant impacts are captured in LERs and minor fire challenges are judged unimportant for documentation, or if there have indeed been no minor fires.

o The limited number of fire events on 3/11 following the tsunami.

o The importance of collecting information on fire related systems in future seismic event follow-ups. This includes information related to fire suppression system effectiveness and robustness, fire alarm activation (including spurious alarms),

and fire initiations (major and minor).

• Structural engineer 1: the lack of ground-motion induced damage at Fukushima Daiichi, Fukushima Daini, Onagawa, and Tokai Daini plants from the 3/11 earthquake despite the severe recorded free-field and in-structure motions (which exceeded the current U.S.

and Japan shutdown thresholds) [77] and the difficulty in obtaining information on the seismic responses for key equipment at these plants.

• Structural engineer 2:

o Confirmation that seismic design approaches provide margin to prevent damage to safety-related components at the plants affected by the 2007 Kashiwazaki-Kariwa earthquake, the 2011 Great Eastern Japan earthquake and the North Anna earthquake despite the severe recorded free-field (for the first two earthquakes) and in-structure motions (which exceeded the current U.S. and Japan shutdown thresholds [77]).

21

o Occurrence of seismically-induced fires in the 2007 Kashiwazaki-Kariwa and 2011 Great Eastern Japan earthquake, which is related to ground motion effects on the affected components.

o Difficulty in obtaining information on the seismic response of key equipment to ground motion and value of reliable seismic instrumentation.

o Significance of human and organizational factors and how they can be affected by damage to non-safety-related components.

However, due to competing work priorities, most of the team members were unable to perform detailed reviews of key events, and the team as a whole had only limited discussions of the events and their implications. Thus, although all of the team members considered the project to be a useful exercise, the project was unable to completely achieve the intended objective.

22

8. INSIGHTS FOR ADVANCED KNOWLEDGE ENGINEERING TOOL DEVELOPMENT As discussed in Refs. 51 and 52, rapid advances in natural language processing and text analytics are opening new possibilities for using operational event reports to develop PRA-relevant insights. Similar to an earlier data mining project addressing storms and floods [3, 80]

and therefore, this project included a project objective to identify lessons regarding the mining of seismically-related operational experience that might be useful in the development of advanced knowledge engineering (KE) tools that help users identify, review, and assess key pieces of information in event reports. 24 Based on our work developing the technical insights discussed in Chapter 5, we make the following observations and KE insights. We elaborate on these observations and insights in the following subsections, noting that most are not unique to seismic events.

• Most of the event reports reviewed lack direct statements on human-factors related information important to HRA. Thus, many insights on performance influencing factors and cognitive failure mechanisms must be inferred from indirect indications.

• Some of the project insights rely on knowledge as to when an issue arose during an event. Thus, the KE tool needs to develop and use an understanding of the event chronology.

• Some of the new project insights, notably the potential risk importance of seismically-induced HEAFs and seismically-induced reactivity excursions, required knowledge of information outside the normal realm of seismic engineering. This implies that even for a domain-specific investigation, a broad knowledge base (as encoded in a project corpus 25) can be very useful.

• Most of the event descriptions are brief and lack details. A few events (most notably, 3/11) are covered by a multitude of reports, papers, and presentation slides. Both extremes of information volume present challenges to KE tool developers.

8.1 Inferencing from Indirect Indications As indicated in Chapter 5, a good HRA requires consideration of situational context as well as actual decisions and actions. In principle, operational event reports can provide empirical information on these matters. Thus, for example, they could answer:

- Were operators severely stressed during the event?

- Were they stressed by the earthquake?

- Did earthquake-induced stress affect macrocognition?

24 There appears to be no commonly accepted definition for the term knowledge engineering. In this report, consistent with Refs. 51 and 52, we it to refer to engineering activities associated with the development and maintenance of information systems 25 In KE terms, a project corpus is a selected set of documents which provides the search space for the project.

23

Unfortunately, however, much information is either lacking or only indicated indirectly in actual event narratives.

Examples of information not provided include:

• The experience of the operating crews on shift when the earthquake struck. 26

• The immediate effects of the earthquake and any seismically-induced hazards on operator situation assessment and decision making. 27 Of course, a KE tool cant supply factual information if none was reported. However, using some sort of model structure (such as that provided by IDHEAS), a tool can indicate if there are gaps in the factual record. In such heavily documented situations as 3/11 (see Section 8.3 below),

such a tool could be very useful in helping a user identify which documents to review and which ones are unlikely to be helpful.

Examples of situations where potentially useful HRA insights can be inferred include:

• An apparent understaffing problem during the Kashiwazaki-Kariwa event.

• The lack of a major impact on operations of spurious fire alarms triggered by the 3/11 earthquake.

Regarding the former, available reports and presentations dont directly state that staffing was an issue during the event. However, one presentation provides indirect information: in a section titled Measures for a Disaster-resistant Power Station, on a slide titled Enhancement of Self Fire Fighting System, under a bullet titled Weakness in Radiation Measurement System, one sub-bullet reads More radiation technicians on holiday and at night. [54]. (Its also helpful to know that a separate presentation thought it important to state that the event occurred during a national holiday.)

Regarding the latter, a report on the events at Fukushima Daiichi states [28]:

The shock of the earthquake caused the earthquake and fire alarms to sound in the Units 1&2 main control room at that time. The shift supervisor knew that even dust blown up into the air inside rooms activated the fire alarms at TEPCO's Kashiwazaki-Kariwa Nuclear Power Station (hereinafter called "Kashiwazaki-26 Of course, no crews prior to 3/11 had any experience with the conditions experienced at Fukushima Daiichi and other hard-hit plants. However, as indicated in Appendix A, some of the plants affected by 3/11 had been affected by previous seismic events. Further, overall experience could affect operator knowledge of SSC details that could be useful in event response. Note that operator experience was judged sufficiently important to warrant detailed characterization in past HRA-oriented simulator studies [53].

27 As discussed in Section 5.1, we judge that the effects were largely minor for most of the events reviewed. However, and important to the current discussion, the event descriptions lack direct statements of minor (or even no) effects. This can be contrasted with typical post-event descriptions of structural effects, which routinely indicate if a structure has not been damaged as well as if it has.

24

Kariwa NPS") at the time of the Chuetsu-oki Earthquake in July 2007. Since the fire alarm was designed so that it could not be turned off if a fire actually broke out, he tried turning it off to find out whether or not a fire had started. The shift supervisor was able to stop the fire alarm and thereby he judged that there was no fire within or near the Units 1&2 main control room.

It appears that although the situation required some attention, this was not a major distraction to the decision maker. (This impression is corroborated by informal discussions at another plant affected by 3/11, where a similar situation and response arose.) 28.

From a KE tool development standpoint, the inference of a staff shortage requires understanding of the context established by the presentation section, slide title, and major bullet. The inference of a small effect from fire alarms is heavily influenced by the lack of discussion of complications, i.e., by what was not said. Both of these inferencing challenges indicate a need for substantial subject matter expert (SME) involvement in KE tool development as technical expertise is needed to characterize the context and expectations for text passages.

We note that some of our insights are much easier to develop from event descriptions. In particular, simple word associations are often sufficient. For example, in the passage The lack of food, working toilets, and relief personnel during the early stages of the accident as well as the extended length of the accident response added greatly to personnel fatigue and distress. [30]

the terms fatigue and distress can be used as indicators of operator stress. SME involvement is still needed to create the appropriate associations, but this is a relatively straightforward activity at least in principle. However, as with the more complicated examples mentioned earlier, care is still needed. Consider, for example, the passage the female employees screamed during each aftershock. [55]

This would appear to be a clear indication of high stress caused by the earthquake. However, a more complete version of the passage because we had just conducted an emergency-preparedness drill the previous week, things were surprisingly orderly. TEPCO employees handed out water and crackers, and we took turns using a PHS that was able to connect to 28 Of course, care is generally needed in interpreting situations for which explicit statements are not provided. For example, as can be seen in Appendix C, official reports provide little information on the psychological state of plant staff immediately following the earthquake. Given the likely professional and personal experience of the staff with past earthquakes, and given the measured description of operator responses, it is reasonable to infer that the staff were reasonably calm. However, as also indicated in Appendix C, an eyewitness account by a plant worker provides a very different, emotionally-charged picture of the situation. More investigation would be needed to determine if there were indeed stronger reactions among the control room operators than assumed.

25

the outside world to confirm the safety of our families. Meanwhile, some foreigners sat on the floor and chatted, and the female employees screamed during each aftershock. [55]

could be read as indicating a less emotionally charged (or even a playful) situation. Regardless of the specifics of this particular episode, it can be seen that context still plays a role even when using simple word associations. The associated KE tool challenges are not only how to use such contextual text, but even how to decide how much contextual text is needed.

8.2 Temporal Reasoning The reports on 3/11 provide numerous narratives indicating that the operators at Fukushima Daiichi were severely stressed. One question of interest to seismic HRA is whether the operators were stressed by the immediate effects of the earthquake/tsunami (e.g., ground motion, site flooding), as opposed to the effects of earthquake/tsunami-induced SSC failures. 29 To answer this question, the narratives need to be associated with different chronological phases of the event. It can be seen that this is just one example of a situation where a KE tool capable of temporal reasoning is needed to develop desired PRA insights.

8.3 Need for and Use of Broad Knowledge Bases This project has identified two phenomena that might be worth further investigation to determine their risk significance for operating and new reactors:

- seismically-induced HEAFs

- seismically-induced reactivity excursions Figure 2 shows the simple reasoning chain for the HEAF insight; Figure 3 shows the analogous chain for reactivity excursions. In both cases, the insight relies on technical information that might not be considered in a review limited to consideration of actual plant effects due to seismic events.

Figure 2. Reasoning Chain for Seismically-Induced HEAFs 29 Arguably, the latter source of stress is not unique to seismically-induced scenarios.

26

As a different example, consider the following passage [19]:

The magnitude 7.8 earthquake off the coast of Hokkaido in July 1993, had no effect on nuclear facilities. Tomari 1 and 2 reactors (550 MWe, PWRs), located 95 km from the epicentre, continued normal operation.

Recognizing that offshore earthquakes might be the source of tsunamis, a search for earthquakes in that month and location results in identifying the Hokkaido-Nansei-Oki earthquake (July 12, 1993) and further searching identifies a paper discussing the subsequent tsunami [56]. This paper indicates that the earthquake indeed caused very large tsunamis in the region (e.g., 7-9 m runup some 45-60 km away) and a runup of around 4 m in the general vicinity of the plant. (See Figure 4.)

Figure 3. Reasoning Chain for Seismically-Induced Reactivity Excursions Figure 4. Tsunami runups from Hokkaido-Nansei-Oki earthquake (adapted from [56])

27

We do not know if the tsunami runup presented any challenge to the plant, nor if slightly different earthquake locations or intensities would have had any significant effects. However, the available information indicates that this event might be interesting to investigate further.

In general, the challenges for a KE tool raised in this section include:

• Determining the appropriate breadth of the project corpus

• Identifying facts in this corpus that are related to facts in the event description (i.e.,

connecting the dots)

• Generating and exploring reasonable possibilities as well as actual observations

• Identifying when an expected fact is not reported 30

• Determining which inferences from the above are potentially important (e.g., to require SME review for plausibility and significance) 8.4 Varying Information Quantity and Quality The useful event descriptions reviewed in this project range from very short - perhaps a single sentence - to extremely long - multiple reports, papers, and presentations in the case of 3/11.

Both extremes provide challenges to KE tool development.

As an example of an important but short description, consider the following passage on a 1993 event in Japan.

In November 1993, a magnitude 5.8 earthquake in northeast Honshu produced a ground acceleration of 121 Gal at Tohuku's Onagawa 1 power reactor (497 MWe, BWR), located 30 km from the epicentre. The design conditions for the S1 and S2 events at the site were 250 and 375 Gal respectively and the reactor was set to trip at a measured peak ground acceleration (PGA) of 200 Gal. In fact it tripped at a lower level due to variations in the neutron flux outside the set parameters. [19] 31 This is the sole record of the earthquake reviewed by the project. Aside from the challenges of a) recognizing that the last sentence refers to a reactivity excursion, and b) recognizing the potential significance of this event (as discussed in Section 8.2 above), this example illustrates a 30 Ref. 57 suggests using measures of surprise based on the prior probability of the observation: the lower the probability, the greater the surprise. It would appear that this general principle could be applied to non-observations.

31 Notes:

1) A Gal is a measure of acceleration, where 1 Gal = 1 cm/s2.

2) Per Ref. 31: S1 and S2 are the two levels of severity of design basis ground motions that should be taken into account. IAEA Safety Series No. 50-SG-S2 defined the application of these two levels in design as follows: (1) ground motion level 1 (S1), which is the maximum that reasonably can be expected to be experienced at the site area once during the operating life of the nuclear power plant; (2) ground motion level 2 (S2), which is considered to be the maximum earthquake potential at the site area.

28

challenge to analytics-based algorithms: a project corpus might not have many references to potentially important facts.

As an example of a massively documented event, consider 3/11. Figure 5 shows how the number of pages describing the event increased over time. This figure covers only reports in our project corpus and is therefore a lower bound.

Clearly analysts seeking to develop insights from those reports would greatly benefit from KE tools that go beyond simple searches. Aside from the previously discussed challenges regarding inferencing, challenges in dealing with a large (and growing) corpus include:

• Identifying and assessing the potential significance of changes across a series of documents from the same source (e.g., the series of post-investigation progress reports issued by TEPCO [58-61]), and even recognizing when one member of the series (the 2nd TEPCO post-investigation report in our case) is missing.

• Identifying and assessing the potential significance of differences in reporting across documents from different sources.

• Recognizing when information in a report is a replication of information provided in another report (which affects text analytics).

Figure 5. Page Count for Selected 3/11 Reports 29

8.5 Commentary - Near-Term KE Tool Improvements The previous sections describe a number of inferencing problems that appear to present considerable challenges to KE tool developers. Even with the rapid rate of developments in KE, it is unclear whether complete solutions can be developed in the near term. However, based on recent experience, there are two problems where partial solutions might not be difficult to develop and could be immediately useful.

1) Identification of text passages supporting a particular assertion about an event

2) Identification of documents that are unlikely to have information on a specified topic As an example of the first problem, consider the passage The Fukushima event provides multiple examples of performance delays and performance failures, resulting from miscommunications, lack of clear understanding of roles and responsibility, and complex chains of command and control.

Considering the tens of thousands of pages covering the event, if challenged, it is not easy to quickly find a specific citation supporting this passage, let alone citations in other reports that might support or contradict it. 32 The second problem is related to the first. If a KE tool is not able to find specific passages of interest, it still could provide valuable help by helping users screen out documents (or even document sections) if these are unlikely to have useful information.

In both cases, it appears that, at least in principle, relatively simple word association approaches could be helpful in a use-mode where the KE tool serves as an aide and not an oracle.

32 Such a challenge arose during a staff presentation to the Advisory Committee on Reactor Safeguards (ACRS) [62]. The challenge concerned not only the statement but also whether the statement was current, given numerous TEPCO reports issued since 3/11.

30

9.

SUMMARY

CONCLUSIONS AND RECOMMENDATIONS 9.1 Conclusions In this project, we have reviewed descriptions of 50 seismic events that potentially affected NPP operations and have developed a number of qualitative observations relevant to seismic PRA methods and models. Given the variety of sources consulted, we are reasonably confident our search has captured most significant events relevant to U.S. NPPs. We recognize that there are likely many minor events (e.g., low intensity earthquakes felt but not affecting NPP SSCs) that we have not captured but expect that they will add few insights to those developed from more severe events.

9.1.1 Technical Insights Relevant to Seismic PRA The large majority of the events reviewed have had, at most, relatively minor impact on the operation of potentially affected NPPs. However, five earthquakes led to complicated (or at least non-routine) multi-unit and sometimes multi-site events and are of interest to seismic PRA modeling.

For the more severe events, earthquakes (and subsequent induced hazards, particularly tsunamis and HEAFs) have caused:

• LOOP and (in the case of Fukushima Daiichi) SBO

• Degradation or loss of ultimate heat sink

• Damage (and concerns of potential damage), disruptions (e.g., due to aftershocks and tsunami warnings) and/or adverse environmental conditions (e.g., debris, smoke) affecting event recovery

• Seismically-induced reactivity excursions and associated reactor trips (i.e., reactor trips not caused by seismic ground motion detectors)

These effects have occurred from events with onsite ground motions significantly less than those considered by current seismic PRAs.

Finally, we note that this project has identified two phenomena that might be worth further investigation to determine their risk significance for operating and new reactors:

• seismically-induced HEAFs

• seismically-induced reactivity excursions 9.1.2 Knowledge Management Insights The observations developed by this project concern factors, mechanisms, and scenarios of interest to the human and organization, fire protection, and reactor physics technical communities. This breadth points out the importance of an integrated, multidisciplinary approach 31

to seismic PRA. It also emphasizes the need to ensure that seismic event reports address these other phenomena, going beyond descriptions of ground motion and direct effects on SSCs. 33 We also note that the activity of reviewing past events for PRA-related lessons was generally successful as a knowledge management exercise; all team members gained technical insights they considered to be useful.

9.1.3 Knowledge Engineering Tool Insights This project has identified a number of challenges to the development of advanced KE tools aimed at helping users extract PRA-relevant insights from operational event narratives. These challenges involve:

• the use of indirect indications of phenomena/events

• temporal reasoning

• the needed breadth of a project corpus

• connecting the dots across a broad range of (often disparate) documents

• generating and exploring reasonable possibilities

• identifying when expected information is not provided

• assessing the relative importance of inferences (e.g., to prioritize for SME review)

• non-text analytic approaches for identifying important insights

• identifying and assessing changes across a series of related documents (e.g., a series of progress reports)

• identifying and assessing differences in reporting across documents from different sources

• recognizing when information is replicated across multiple reports Two KE tool advances that appear to be both useful and achievable in a relatively short time frame involve tools supporting

• the identification of text passages supporting a particular assertion about an event

• the identification of documents that are unlikely to have information on a specified topic 9.2 Near-Term Actions

• Informal communications to date indicate that many staffers (and likely broad technical communities) are unaware of the fact that the 2011 North Anna earthquake-induced trips were due to a seismically-induced reactivity excursions (rather than the actions of seismic ground motion detectors). None were aware of the 1993 Onagawa event. The project team will disseminate this information to appropriate staff, including those involved in the review of advanced reactor designs.

33 Note that from a PRA perspective, it is important to have information on successes (e.g., definitive statements that an earthquake did not cause a fire at a particular location) as well as failures.

32

• The list of earthquake events in Appendix A is a useful resource for staff. The project team will ensure that potentially interested staff are aware of this list and will consider developing a summary version for NRCs Nuclepedia initiative.

• This project has identified two potentially useful and near-term candidates for Artificial Intelligence/Big Data use cases. As discussed in Section 9.1.3, these involve the identification of text passages supporting a particular assertion about an event and the identification of documents that are unlikely to have information on a specified topic. The project team will provide these ideas to cognizant staff.

9.3 Recommendations

• Due to resource limitations, this project has not compared its technical observations against current seismic PRA standards and guidance (e.g., [18, 38, 63-68, 81-82]), and against the findings of recent analyses (e.g., [69-75]). Given the continuing importance of seismic PRA in current risk-informed decision making applications, we recommend that such comparisons be made.

• We have found the information on post-earthquake environments useful when considering conditions operators face when performing needed actions. We recommend that: a) this information be summarized in a form suitable for HRA training, and b) be incorporated into NRC training courses.

• More generally, similar to the earlier project on storms and floods [3, 80], this project has demonstrated that qualitative reviews of past events can provide useful information for PRA analysts and reviewers. We recommend that additional reviews be performed for KM as well as immediate technical purposes. Recognizing that the KM benefits are directly related to level of effort, we further recommend that the review activity be given sufficient priority to enable active involvement by all team members.

• The project team has become aware of an ongoing activity at ETH Zurich to create a public, authoritative database on nuclear accidents [17]. We recommend consideration of the development and transmittal of a public version of the list of events in Appendix A.

We note that different intended uses of the information may dictate revisions in the table terminology, information highlighted, and commentary.

ACKNOWLEDGMENTS The authors gratefully acknowledge comments from N. Chokshi and J. Xu on a paper summarizing early results of this project [76] and information from S. Vasavada on recent seismic PRA results.

33

REFERENCES

[1] V.M. McCree, Achieving Modern Risk-Informed Regulation, SECY-18-0060, U.S.

Nuclear Regulatory Commission, 2019.

[2] S.P. Nowlen, M. Kazarians, and F. Wyant, Risk Methods Insights Gained from Fire Incidents, NUREG/CR-6738, U.S. Nuclear Regulatory Commission, 2001.

[3] N. Siu, I. Gifford, Z. Wang, M. Carr, and J. Kanney, Qualitative PRA Insights from Operational Events, Proceedings 14th International Conference on Probabilistic Safety Assessment and Management (PSAM 14), Los Angeles, CA, September 16-21, 2018.

(ADAMS ML18135A109)

[4] N. Siu, D. Marksberry, S. Cooper, K. Coyne, and M. Stutzke, M. (2013). PSA Technology Challenges Revealed by the Great East Japan Earthquake, Proceedings PSAM Topical Conference in Light of the Fukushima Daiichi Accident, Tokyo, Japan, April 15-17, 2013. (ML13038A203)

[5] N. Siu, K. Compton, S. Cooper, K. Coyne, and F. Ferrante, PSA Technology Reminders and Challenges Revealed by the Great East Japan Earthquake: 2016 Update, Proceedings 13th International Conference on Probabilistic Safety Assessment and Management (PSAM 13), Seoul, Korea, October 2-7, 2016. (ML16245A822)

[6] S. Swan, Seismic Fragility Functions Based on Actual Earthquakes, Pre-PSAM 14 Workshop on Seismic PRA, Los Angeles, CA, September 15, 2018. (Viewgraphs available on request.)

[7] J.R. Reed, N. Anderson, N. C. Chokshi, R.P. Kennedy, W.J. Metevia, D.K. Ostrom, and J.D. Stevenson, A Criterion for Determining Exceedance of the Operating Basis Earthquake, NP-5930, Electric Power Research Institute, Palo Alto, 1988.

[8] EQE Inc., Effects of the 1985 Mexico Earthquake on Power and Industrial Facilities, NP-5784, EPRI, Palo Alto, CA, April 1988.

[9] EQE Engineering, The October 1, 1987 Whittier Earthquake: Effects on Selected Power, Industrial, and Commercial Facilities, NP-7126, EPRI, Palo Alto, CA, December 1990.

[10] S.W. Swan and T.R. Roche, The October 17, 1989, Loma Prieta Earthquake: Effects on Selected Power and Industrial Facilities, NP-7500-SL, EPRI, Palo Alto, CA, September 1991.

[11] T.R. Roche, K.L. Merz, M.W. Eli, and S.C. Sommer, The January 17, 1994 Northridge Earthquake, TR-106635, EPRI, Palo Alto, CA, April 1997.

[12] Z. Li and T.R. Roche, The Great Hanshin-Awaji Earthquake of January 17, 1995: A Report on Electric Power and Other Impacts, TR-107083, EPRI, Palo Alto, CA, April 1998.

[13] The Michoacan, Mexico Earthquake of January 11, 1997: Effects on Power and Selected Industrial Facilities, EPRI, Palo Alto, CA: 1988 Report TR-109928.

[14] Investigation of the 1999 Chi Chi, Taiwan Earthquake, Electric Power Research Institute, Palo Alto, CA, 2001: TR-1003120.

[15] W. Dong, et al., Event Report: Chi-Chi, Taiwan Earthquake, Risk Management Solutions, Menlo Park, CA, 2000. (Available from: https://forms2.rms.com/rs/729-DJX-565/images/eq_chi_chi_taiwan_eq.pdf) 34

[16] Investigation of the 1999 Kocaeli Turkey Earthquake: Effects on Power and Industrial Facilities, EPRI, Palo Alto, CA: 2001. 1003119.

[17] S. Wheatley, W. Krger, L. Chen, and D. Sornette, Open Comprehensive Nuclear Events Database, Proceedings 14th International Conference on Probabilistic Safety Assessment and Management (PSAM 14), Los Angeles, CA, September 16-21, 2018.

[18] Seismic Probabilistic Risk Assessment Implementation Guide, Electric Power Research Institute, Palo Alto, CA: 2013. 3002000709

[19] Nuclear Power Plants and Earthquakes, Information Library, World Nuclear Association, London, UK, June 2018. (Available from http://www.world-nuclear.org/information-library/safety-and-security/safety-of-plants/nuclear-power-plants-and-earthquakes.aspx)

[20] Pre-Earthquake Planning and Immediate Nuclear Power Plant Operator Post-Earthquake Actions, Regulatory Guide 1.66, U.S. Nuclear Regulatory Commission, Washington, DC, 1997.

[21] Investigation of the M6.6 Niigata-Chuetsu Oki, Japan, Earthquake of July 16, 2007, Open File Report 2007-1365, U.S. Geological Survey, Reston, VA.

[22] The Yoshida Testimony: The Fukushima nuclear accident as told by plant manager Masao Yoshida, Asahi Shimbun, 2014. (Available from:

http://www.asahi.com/special/yoshida_report/en/)

[23] "Preliminary Findings and Lessons Learned from the 16 July 2007 Earthquake at Kashiwazaki-Kariwa NPP, IAEA Mission Report Volume II, International Atomic Energy Agency, Vienna, Austria, 2007.

[24] Virginia Electric and Power Company, Virginia Electric and Power Company (Dominion), North Anna Power Station Units 1 and 2, North Anna Independent Spent Fuel Storage Installation, Summary Report of August 23, 2011 Earthquake Response and Restart Readiness Determination Plan, Serial No.11-520, September 17, 2011.

(ML11262A151)

[25] A. Kolaczkowski, J. Forester, E. Lois, and S. Cooper, Good Practices for Implementing Human Reliability Analysis, NUREG-1792, U.S. Nuclear Regulatory Commission, 2005.

[26] Y.H.J. Chang and A. Mosleh, Cognitive Modelling and Dynamic Probabilistic Simulation of Operating Crew Response to Complex System Accidents: Part 1: Overview of the IDAC model, Reliability Engineering and System Safety, 94 (5), 1000-1018, 2007.

[27] J. Xing, Y.J. Chang, and J. DeJesus, The General Methodology of An Integrated Human Event Analysis System (IDHEAS-G), NUREG-2198, U.S. Nuclear Regulatory Commission, Washington, DC. (In preparation).

[28] Government of Japan, Interim Report (Main Text), Government of Japan Investigation Committee on the Accident at Fukushima Nuclear Power Stations of Tokyo Electric Power Company), Tokyo, Japan, 2011.

[29] Tokyo Electric Power Co., Fukushima Nuclear Accident Analysis Report, Tokyo, Japan, 2012.

[30] National Research Council, Lessons Learned from the Fukushima Nuclear Accident for Improving Safety of U.S. Nuclear Plants, National Academies Press, Washington, DC, 2014.

35

[31] International Atomic Energy Agency, The Fukushima Daiichi Accident, Director General Report, Vienna, Austria, 2015.

[32] Special Report on the Nuclear Accident at the Fukushima Daiichi Nuclear Power Station, INPO 11-005, Institute of Nuclear Power Operations, Atlanta, GA, USA, 2011.

[33] J.A. Lambright, S.P. Nowlen, V.F. Nicolette, and M.P. Bohn, Fire Risk Scoping Study:

Investigation of Nuclear Power Plant Fire Risk, Including Previously Unaddressed Issues NUREG/CR-5088, U.S. Nuclear Regulatory Commission, 1989.

[34] N. Siu, N., Melly, S.P. Nowlen, and M. Kazarians, Fire Risk Assessment for Nuclear Power Plants, The SFPE Handbook of Fire Protection Engineering, 5th Edition, Springer-Verlag, New York, 2016.

[35] Organization for Economic Cooperation and Development, CSNI Technical Opinion Paper No. 17: Fire Probabilistic Safety Assessments for Nuclear Power Plants: 2019 Update, NEA 7417, Nuclear Energy Agency, Committee for the Safety of Nuclear Installations, 2019.

[36] The Station Blackout Incident of the Maanshan NPP unit 1, Atomic Energy Council, Taiwan, 2001.

[37] T.H. Boyce, Initial Screening Results for Pre-GI-018, Proposed Generic Issue on High Energy Faults Involving Aluminum Components, U.S. Nuclear Regulatory Commission, May 17, 2016. (ML16132A415)

[38] American Society for Mechanical Engineers and American Nuclear Society, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sb-2013, Addendum B to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, 2013.

[39] EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, EPRI 1011989 and NUREG/CR-6850, Electric Power Research Institute (EPRI), Palo Alto, CA and U.S.

Nuclear Regulatory Commission, Washington, DC, 2005.

[40] Critical Maintenance Insights on Preventing High-Energy Arcing Faults. Electric Power Research Institute, Palo Alto, CA, 2019: 30020015459.

[41] Dual Unit Reactor Trip and ESF Actuations During Seismic Event with a Loss of Offsite Power, Licensee Event Report 338/2011-003-00, Virginia Electric and Power Co.,

Mineral, VA, October 20, 2011.

[42] Control rod stuck in Kashiwazaki Kariwa unit, World Nuclear News, World Nuclear Association, London, UK, October 19, 2007. (Available from. http://www.world-nuclear-news.org/regulationSafety/Control_rod_stuck_in_Kashiwazaki_Kariwa_unit-191007.shtml)

[43] Kashiwazaki Kariwa inspections continue, World Nuclear News, World Nuclear Association, London, UK, November 15, 2007. (Available from: http://www.world-nuclear-news.org/Articles/Kashiwazaki-Kariwa-inspections-continue)

[44] M.K. Ravindra, Alls Well in SPRA Land!, Pre-PSAM 14 workshop on Which way SPRA? Los Angeles, CA, 2018.

[45] R.V. Whitman, The eternal triangle: seismologists/geologists, engineers/architects, and owners/regulators, Proceedings of Conference on Earthquakes and Earthquake Engineering: The Eastern United States, Knoxville, TN, September 14-16, 1981. (ISBN 0-250-40496-6) 36

[46] F. Mulargia, P.B. Stark, R.J., Geller, Why is Probabilistic Seismic Hazard Analysis (PSHA) still used? Physics of the Earth and Planetary Interiors, 2016.0 doi:

http://dx.doi.org/10.1016/j.pepi.2016.12.002

[47] N. Siu, K. Coyne, and N. Melly, Fire PRA Maturity and Realism: A Technical Evaluation, U.S. Nuclear Regulatory Commission, March 2017. (ML17089A537)

[48] Organization for Economic Cooperation and Development, CSNI Technical Opinion Paper No. 17: Fire Probabilistic Safety Assessments for Nuclear Power Plants: 2019 Update, NEA 7417, Nuclear Energy Agency, Committee for the Safety of Nuclear Installations, 2019. (Available from: http://www.oecd-nea.org/nsd/pubs/2019/7417-csni-top17.pdf)

[49] C.A. Cornell, Engineering seismic risk analysis, Bulletin of the Seismological Society of America, 58, No. 5, 1583-1606, 1968.

[50] R.P. Kennedy, C.A. Cornell, R.D. Campbell, S. Kaplan, and H. Perla, Probabilistic seismic safety study of an existing nuclear power plant, Nuclear Engineering and Design, 59, 315-338, 1980.

[51] N. Siu, S. Dennis, M. Tobin, P. Appignani, K. Coyne, G. Young, and S. Raimist, Advanced Knowledge Engineering Tools to Support Risk-Informed Decision Making:

Final Report (Public Version), December 2016. (ML16355A373)

[52] N. Siu, K. Coyne, and F. Gonzalez, Knowledge Management and Knowledge Engineering at a Risk-Informed Regulatory Agency: Challenges and Suggestions, U.S.

Nuclear Regulatory Commission, March 2017. (ML17089A538)

[53] A. Bye, E. Lois, V.N. Dang, G. Parry, J. Forester, S. Massaiu, R. Boring, P. Ø. Braarud, H. Broberg, J. Julius, I. Mnnist, and P. Nelson, International HRA Empirical Study -

Phase 2 Report: Results from Comparing HRA Method Predictions to Simulator Data from SGTR Scenarios, NUREG/IA-0216, Vol. 2, U.S. Nuclear Regulatory Commission, Washington, DC., 2011.

[54] J. Matsumoto, Kashiwazaki-Kariwa Nuclear Power Station after Niigataken Chuetsu-Oki Earthquake, Tokyo Electric Power Co., Inc., 7th International Symposium on Andean Geodynamics (ISAG), Nice, France, July 25, 2008.

[55] Independent Investigation Commission on the Fukushima Nuclear Accident and Masaharu Fujiyoshi, Prologue to catastrophe, Bulletin of the Atomic Scientists, 70(2),

36-41, 2014.

[56] E. Bernard, et al., Tsunami Devastates Japanese Coastal Region, American Geophysical Union 0096/3941/74373/93/417/$0 1.00, 1993. (Available from https://nctr.pmel.noaa.gov/okushiri_devastation.html)

[57] R. Younglood, G. Maggio, C. Everett, and A. Hall, Value of Analyzing Operating Events, Proceedings Ninth International Conference of Probabilistic Safety Assessment and Management (PSAM 9), Hong Kong, China, May 18-23, 2008.

[58] Evaluation of the situation of cores and containment vessels of Fukushima Daiichi Nuclear Power Station Units-1 to 3 and examination into unsolved issues in the accident progression, Progress Report No. 1, Tokyo Electric Power Co., Inc., December 13, 2013.

37

[59] Evaluation of the situation of cores and containment vessels of Fukushima Daiichi Nuclear Power Station Units-1 to 3 and examination into unsolved issues in the accident progression, Progress Report No. 3, Tokyo Electric Power Co., Inc., May 20, 2015.

[60] Evaluation of the situation of cores and containment vessels of Fukushima Daiichi Nuclear Power Station Units-1 to 3 and examination into unsolved issues in the accident progression, Progress Report No. 4, Tokyo Electric Power Co., Inc., December 17, 2015.

[61] Evaluation of the situation of cores and containment vessels of Fukushima Daiichi Nuclear Power Station Units-1 to 3 and examination into unsolved issues in the accident progression, Progress Report No. 5, Tokyo Electric Power Co. Holdings, Inc.,

December 25, 2017.

[62] U.S. Nuclear Regulatory Commission, Official Transcript of Proceedings: Advisory Committee on Reactor Safeguards (ACRS) Reliability & Probabilistic Risk Assessment Subcommittee, September 18, 2019. (ML19309E316)

[63] U.S. Nuclear Regulatory Commission, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Regulatory Guide 1.200, Revision 2, March 2009. (ML090410014)

[64] Nuclear Energy Institute, External Hazards PRA Peer Review Process Guidelines, NEI-12-13, August 2012. (ML12240A027)

[65] Surry Seismic Probabilistic Risk Assessment Pilot Plant Review, Electric Power Research Institute, Palo Alto, CA: 2010. 1020756

[66] American Nuclear Society and the Institute of Electrical and Electronics Engineers, PRA Procedures Guide, NUREG/CR-2300, January 1983.

[67] J.T. Chen, N.C. Chokshi, R.M. Kenneally, G.B. Kelly, W.D. Beckner, C. McCracken, A.J.

Murphy, L. Reiter, and D. Jeng, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, NUREG-1407, June 1991.

[67] R.J. Budnitz, H.E. Lambert, G. Apostolakis, J.K. Salas, J-S. Wu, and M.K. Ravindra, A Methodology for Analyzing Precursors to Earthquake-Initiated and Fire-Initiated Accident Sequences, NUREG/CR-6544, April 1998.

[68] R.G. Starck and C.S. Schlaseman, Seismic Walkdown Guidance: For Resolution of Fukushima Near-Term Task Force Recommendation 2.3: Seismic, Electric Power Research Institute, Palo Alto, CA: 2012. 1025286

[69] Southern Nuclear, Vogtle Electric Generating Plant Units 1 and 2, Fukushima Near-Term Task Force Recommendation 2.1: Seismic, Seismic Probabilistic Risk Assessment, March 27, 2017. (ML17088A130)

[70] Tennessee Valley Authority, Seismic Probabilistic Risk Assessment for Watts Bar Nuclear Plant, Units 1 and 2 - Response to NRC Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(f) Regarding Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Daiichi Accident, June 30, 2017. (ML17181A485)

[71] Virginia Electric and Power Company, Virginia Electric and Power Company North Anna Power Station Units 1 and 2 Response to March 12, 2012 Information Request, Seismic 38

Probabilistic Risk Assessment for Recommendation 2.1, March 28, 2018.

(ML18093A445)

[72] Tennessee Valley Authority, Tennessee Valley Authority (TVA) - Watts Bar Nuclear Plant Seismic Probabilistic Risk Assessment Supplemental Information, April 10, 2018.

(ML18100A966)

[73] Pacific Gas and Electric Company, Seismic Probabilistic Risk Assessment for the Diablo Canyon Power Plant, Units 1 and 2 - Response to NRC Request for Information Pursuant to 10 CFR 50.54(f) Regarding Recommendation 2.1: Seismic of the Near-Term Task Force Review of Insights from the Fukushima Dai-lchi Accident, April 24, 2018.

(ML18120A201)

[74] Exelon Corporation, Seismic Probabilistic Risk Assessment Report, Response to NRC Request for Information Pursuant to 1 O CFR 50.54(f) Regarding Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Daiichi Accident, August 28, 2018. (ML18240A065)

[75] South Carolina Electric and Gas Co., Virgil C. Summer Nuclear Station (VCSNS), Unit 1, Docket No. 50-395, Operating License No. Npf-12, Fukushima Near-Term Task Force Recommendation 2.1: Seismic, Seismic Probabilistic Risk Assessment, September 28, 2018. (ML18271A109)

[76] N. Siu, J. Xing, N. Melly, F. Sock, and J. Pires, Qualitative PRA Insights from Seismic Events, Proceedings 25th Conference on Structural Mechanics in Reactor Technology (SMiRT-25), Charlotte, NC, August 4-9, 2019. (ML19162A422)

[77] F. Grant, Y. Tang, G.S. Hardy, and R. Kassawara, Seismic damage indicating parameters at nuclear power plants affected by the 2011 Tohoku-Oki earthquake and plant shutdown criteria, Earthquake Spectra, 33, No. 1, 109-121 (2017).

[78] Institut de Radioprotection et de Sûreté Nucléaire, IRSNs Viewpoint on the Safety and Radiation Protection of French Nuclear Power Plants in 2007, DSR Report No. 271, Reactor Safety Division, Institut de Radioprotection et de Sûreté Nucléaire, 2009.

[79] Japan Nuclear Technology Institute, Information of Kashiwazaki-Kariwa Power Plant (the 4th news), Rev. 0, July 25, 2007. (ML080320300)

[80] N. Siu, I. Gifford, Z. Wang, M. Carr, and J. Kanney, Qualitative PRA Insights from Seismic Events, U.S. Nuclear Regulatory Commission, 2020. (ML20309A718, non-public)

[81] An Approach to Human Reliability Analysis for External Events with a Focus on Seismic, Electric Power Research Institute, Palo Alto, CA: 2016. 3002008093 (non-public)

[82] Seismically-induced Internal Fire and Flood Probabilistic Risk Assessment, Electric Power Research Institute, Palo Alto, CA: 2015. 3002005289 (non-public]

39

APPENDIX A - NOTABLE SEISMIC EVENTS AND EFFECTS ON NPPS This appendix lists the 50 seismic events reviewed during the project. For events where the only plant impact information we reviewed was non-public, we only indicate the country and some of the earthquake specifics. Reactor trips are highlighted with green boldface.

It is important to note that this appendix, which draws upon information from multiple documents, is a synthesis that we consider adequate for the needs of the project. However, the data have not been peer reviewed and should not considered to be authoritative.

40

A.1 Events Note that the following table includes some earthquakes without a numerical identifier in the left-hand column. These are notable earthquakes for which we collected information but did not identify any records specifically indicating effect (or lack of effect) on a nuclear power plant.

Table A.1.1. Summaries of Reviewed Events No. Date Plants Notes Ferndale CA Earthquake (M 5.5, Intensity V) [1]. Plant ~15 mi south of epicenter. Exceeded/OBE/SSE response 1 1975-06-07 Humboldt Bay 3 spectrum levels [2].

Miyagi-Oki Earthquake (M 7.7, Intensity VIII). [1] No tsunami identified by International Tsunami Information Center 2 1978-06-12 Japan (ITIC) [3].

Summerville SC Earthquake (M 2.7) [1]. Plant ~175 km from epicenter. Exceeded OBE and SSE above 10 Hz; 3 1978-09-07 V.C. Summer plant awaiting operating license (OL) [2].

Summerville SC Earthquake (M 2.7) [1]. Plant ~175 km from epicenter. Exceeded OBE and SSE above 10 Hz; 4 1979-12-07 V.C. Summer plant awaiting OL [2].

Eureka Earthquake (M 7.2, VIII) [1]. Plant ~45 km from epicenter. Exceeded OBE/SSE; plant already shut down 5 1980-11-08 Humboldt Bay 3

[2]

6 1980-11-23 Italy Campano-Lucano Earthquake (M 6.9) [1].

7 1983-05-02 USA (CA) Coalinga Earthquake (M 6.5) [1].

Nihonkai-Chubu Earthquake (M 7.4, VII) at 12:00 (02:59:59 UTC) [1]. Estimated tsunami heights 14 m (Minehama, 8 1983-05-26 Japan Honshu), 2-6 m (southern Hokkaido and northern Honshu), 4 m along coast of South Korea [3]..

9 1983-07-02 Japan Earthquake (M 5.8) [1]. No tsunami per ITIC [3].

Michoacan, Mexico (M 8.0, VII) at 07:18 (13:17:47 UTC), one major aftershock at Guerrero, 100 km away (M 7.6, VII) at (9/21, 01:37:13 UTC). Major ground motion at Mexico City despite being ~300 km away from epicenter.

1985-09-19 Industrial damage [25]. Per Wikipedia (Mexico City earthquake), intensity IX, 5000-45000 dead, 30000 injured.

Laguna Verde 1 started operation 7/29/1990; Unit 2 started 4/10/1995; on Gulf of Mexico (not Pacific).

Leroy OH Earthquake (M 5.0, VII) [1]. Plant 11 mi north of epicenter. Exceeded OBE and SSE above 10 Hz. Plant 10 1986-01-31 Perry not yet fueled. Staff observed no indication of damage to systems in operation, were even unsure an earthquake had occurred. [2]

Clinton, Dresden, Sumner IL Earthquake (M 5.2, VI) [1]. Exceeded OBE/SSE response spectrum level at Clinton (~180 km NW).

Quad Cities, D.C. Clinton and other plants declared UEs. No damage. [2]

11 1987-06-10 Cook, Palisades, Prairie Island Whittier Earthquake (M 5.9, VIII-IX) at 07:49 (14:49:05 UTC) [1]. Quake at 07:42. Non-nuclear industrial damage, 1987-10-01 also due to 10/4 M 5.5 (5.3 per [1]) aftershock at 03:59 [27].

Armenia Earthquake (M 6.8, IX) at (07:41:24 UTC) [1]. M 6.9. Plant is 75 km south, not damaged [5]. Plant was 12 1988-12-07 Armenia 1-2 closed due to public pressure after the earthquake but was reopened to meet energy needs (multiple sources).

41

No. Date Plants Notes Loma Prieta (World Series) Earthquake (M 6.9, IX) at (10/18, 00:04:15 UTC), multiple aftershocks (one above 1989-10-17 5.0) [1]. Industrial impacts [24]. Diablo Canyon nearest NPP.

Hokkaido-Nansei-Oki Earthquake (M 7.7, IX) at 21:17 (13:17:11 UTC). Several major aftershocks including a M 6.3 1 hr 28 min after and a M 6.0 2 hr 44 min after [1]. Per NOAA Hokkaido Tsunami Survey Group, large tsunami 13 1993-07-12 Tomari 1-2 (15-20 m runup) five minutes after EQ, maximum runup 31 m (Okushiri Island). Hokkaido runup 5-10 m in most heavily affected area; runups are 7-9 m some 45-60 km southwest of plant. Runup around plant appears to be around 4 m [6]. WNA article: M 7.8, Tomari plants are nearest (95 km away) but not affected [5].

M 5.8 at 14:11 (06:11:22 UTC) [1]. No tsunamis listed by ITIC [3]. U1 (30 km away) PGA 121 gal. Design reactor 14 1993-11-27 Onagawa 1 trip at 200 gal, S1 design level 250 gal, S2 design level 375 gal. Reactor tripped on neutron flux variation. [5].

Northridge (Reseda) Earthquake (M 6.7, IX) at 04:31 (12:30:55 UTC) [1]. M 6.6, both plants continued to operate San Onofre, Diablo 15 1994-01-17 normally. San Onofre about 112 km from epicenter [5]. San Onofre 85 km from epicenter, PGA = 0.025g. Units 2 Canyon and 3 operating (Unit 1 no longer in operation), not affected [23].

16 1994-09-01 USA (CA)

Honshu Earthquake (7.8, VII) at 20:19 (12:19:23 UTC). Major aftershocks include a M 6.2 8 hr 30 minutes later [1].

Higashidori, Ohma, 17 1994-12-28 No tsunamis listed by ITIC [3]. M 7.5 in northern Japan, no damage to 11 BWRs or nuclear fuel facilities in area Onagawa, ?

[5].

Great Hanshin-Awaji (Kobe) Earthquake (M 6.9, X) [1] at 05:46 (20:46:52 UTC), multiple aftershocks but none above M 5.0. No tsunamis listed by ITIC [3]. PGA: 817 gal (H), 332 gal (V). No reactors sustained damage; those running at the time continued to operate at capacity. Takahama and Oki (130 km); Mihama (180 km). Research reactors in Osaka and Kyoto also unaffected [5]. Return period ~1000-1500 years. PGAs up to 0.818g (Kobe City);

Takahama, Oki, 18 1995-01-17 several recordings 0.5-0.8 g. No damage to 500 kV transmission system, cluster of fossil plants to SE, NPPs more Mihama than 100 km to the north. Damage to 187 and 275 kV substations, a few fossil plants, a gas turbine plant. PGAs for gas turbine and NPPs 0.013-0.07g (H) and 0.006-0.06 g(V). Shin-Kobe Substation: 0.56g (H), 0.49g (V) (beyond 1980 design criteria). Fossil plants up to 0.34g (H), 0.20g (V) [22]. All substations restored by 08:00, 1/18 (1 day after earthquake).

Michoacan Earthquake (M 7.2, VIII) at 14:28 (20:28:26 UTC). Unlike 1985, no major shocks in Mexico City [1]. M 1997-01-11 7.3, industrial damage [26].

Izmit Earthquake (M 7.6, IX) at (00:01:39 UTC) [1]. M 7.4, Industrial damage [28]. Akkyu NPP site appears to be 1999-08-17 distant from most major historical quakes. Closest (~100 km) was M 6.3 (VIII) at 13:55:52 (UTC), 1998-06-27.

Chi Chi Earthquake (M 7.7, IX) at 01:47 (17:47:18, 9/20 UTC). Multiple aftershocks including at least 8 over M 6.0

[1]. No tsunamis listed by ITIC [3]. M 7.2. Three reactors at Chinshan (~185 km) and Kuosheng (similar) shutdown automatically, restarted 2 days later. (Chinshan 1 was down for refueling [20].) Maanshan continued to operate but reduced power later due to damage to distribution facilities [5]. EQ led to major (~8 m)

Chinshan, Kuosheng, 19 1999-09-21 displacements at a reinforced concrete gravity dam [7]. PGA at Chinshan/Kuosheng 0.3g [19] - very different from Maanshan EPRI report [20]. Plants located ~150 km from epicenter. Power grid instability due to damage to 345 kV transmission towers caused plant trips. Free-field accelerations: Chinshan PGA: 0.037g (N-S), 0.034g (E-W),

0.029g (V). Kuosheng < 0.05g. No recorded ground motion at Maanshan (too low). OBE (H): 0.15g (Chinshan),

0.2g Kuosheng. [20]

20 1999-10-16 USA (CA, AZ) Hector Mine Earthquake (M 7.1, VIII) at 02:47 (09:46:44 UTC). [1]

21 2000-07-21 Japan Ibaraki Prefecture Earthquake (M 6.0, VI) [1]. No tsunami listed by ITIC (magnitude cutoff = 6.5) [3].

Honshu Earthquake (M 7.1, VIII) at 17:25 (09:24:33 UTC) [1]. No tsunami per ITIC [3]. M 7.1, PGA of 225 gal, U3 22 2003-05-26 Onagawa 3 tripped. U1 and U2 were not operating [5].

23 2003-06-30 USA (OH) Lake Erie EQ (M 3.6, V) at 19:21:17 UTC [1].

42

No. Date Plants Notes 2003-10-31 Honshu Earthquake (M 7.0) at 9:06 (01:06:28 UTC) [1]. 50 cm tsunami [8].

2004-09-05 Kii Peninsula Earthquake (M 6.9 at 10:07 UTC and 7.4 at 14:57 UTC) [1]. Tsunamis less than 1 m [3].

Honshu Earthquake (M 6.6, IX) at 16:56 (08:56:00 UTC). Onshore, 16 km depth. Several aftershocks, including a 24 2004-10-23 Kashiwazaki-Kariwa M 6.1 ~7 min later and a M 6.3 ~38 min later [1]. No effect on plant [5].

Honshu Earthquake (M 5.3, VII) at 8:57 (11/03, 23:57:28 UTC), around 13 km from site. Multiple aftershocks including: M 5.1 at 11/5, 02:53 (~25 km from site); M 4.3 at 11/8, 10:43 (~14 km from site); M 5.5 at 11/8, 11:16

(~22 km from site); M 5.1 at 11/10, 03:19 (~20 km from site) [1]. M 5.2 two weeks after 10/23 event caused U7 25 2004-11-04 Kashiwazaki-Kariwa 7 trip. [5]. Per Wikipedia: Earthquake was on 11/4/2004. Measured 4 on Japanese seismological intensity scale.

(Intensity was 6 at other places). All reactors except Unit 4 were operating normally and continued to do so during the quake. Unit 4 was shut down due to routine maintenance.

Sumatra-Andaman Earthquake (M 9.1-9.3, IX) at 06:28 (0058 UTC). Major aftershocks include M 7.2 (12/26, 04:29 UTC) and several at M 6.0+ [1]. Tsunami arrival times at Colombo station 03:52, 03:58; height ~2 m per [9].

According to NOAA natural hazards database, runup at Madras is 1.62 m; runup at Kalpakkam is 2-4 m. Runups at other places in Tamil Nadu state as high as 12 m [10]. Unit 1 already under long shutdown. Unit 2 operating.

26 2004-12-26 Madras 1 and 2 Tsunami flooded pump house, tripped condenser cooling pumps. Manual turbine trip, reactor trip. Other pumps lost due to submergence or clogging. Fire water used for cooldown. Offsite power available, EDGs started as precautionary measure. Emergency alert declared at 1025, lifted 2143 2004-12-27 [35].

Battered but safe [11] plant shutdown automatically. Restarted January 1, 2005 (6 days after tsunami.) [5, 11]

Genkai, Sendai, M 6.6, VII-VIII) at 09:54 (01:53:41 UTC) [1]. No tsunami information listed by ITIC [3]. M 7.0, no plants affected [5].

27 2005-03-20 Shimane, Ikata Miyagi Earthquake (M 7.2, VII) at 11:46 (02:46:28 UTC) [1]. ITIC links to wrong event (3/28/2005 Sumatra). Per Wikipedia, only two small waves several centimeters high. All 3 units (~50 km) shut down automatically. Set 28 2005-08-16 Onagawa 1-3 to trip at 200 gal, S1 design basis of 250 gal was reached. U2 restarted January 2006 (with S2 of 580 gal -

equivalent to M 8.2 - upgraded from 350-400 gal). U3 restarted March 2006. U1 restarted May 2007. [5]

29 2005-10-08 Pakistan Earthquake (M 7.6) at 0852 (03:50:40 UTC). Major aftershock M 6.4 (10/8, 10:46:28 UTC) [1].

30 2006-12-26 Taiwan Earthquake (M 7.1, VII) at 06:26 (12:26:21 UTC). Another earthquake (M 6.9, VI-VII) at 08:34 (12:34:13 UTC) [1].

Earthquake (M6.7, V to IX) at 09:41 (00:41:57 UTC). Multiple aftershocks (none above 5.2), two (4.1, 4.6) near plant [1]. Plant ~35 km SE. Minor tsunami (22 cm at Suzushi Nagahashi; 18 cm at Kanazawa, some ways down 31 2007-03-25 Shika 1 and 2 the coast from plant. EQ said to be beyond seismic design standard. Appears that both units were already shutdown: Unit 1 due to an order from METI after utility admitted it should have reported a criticality event in June 1999; Unit 2 due to turbine blade failure in July 2006 [12].

43

No. Date Plants Notes Niigataken Chuetsu-oki Earthquake (M 6.6, intensity VIII to IX) at 1013. Aftershock (5.7, IV-VI) 5 hr 24 min later.

Earthquake (which was a shallow crustal event) was followed by an independent deep focus earthquake (M6.8) some 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> later and 330 km away [1]. No notable tsunami [3]. Plant 16 km SE. Units 3, 4, and 7 operating, Unit 2 in startup. All shutdown. Fire caused by bus duct subsidence (16-18 cm), collision with transformer terminal, insulator damage and oil leakage ignited by arc from short circuit [34]. Per Wikipedia, fault was previously unknown. Per WNA article, PGA exceeded S1 design values (170-270 gal) in all units; S2 (450 gal for bedrock) exceeded for U1, U2, U4. Four reactors shut down automatically at pre-set level of 120 gal with no apparent Kashiwazaki-Kariwa 32 2007-07-16 complications; other three were not operating at time. TEPCO proposed new standard of 2280 gal (2.33g) for U1-1-7 4, 1156 gal (1.18 g) for U5-7. While standard was under review by NISA and NSC, construction undertaken to withstand 1000 gal. NISA approved new estimates in November 2008. U7 restarted May 2009, U6 August, U1 May 2010, U5 November 2010. U2-4 remained shutdown [5]. Post-event inspections identify a stuck control rod (Unit 7). Cause unknown [21]. Some water/mud in-leakage to the composite reactor building (radwaste) through gaps in piping housing (penetration?); water from broken underground fire line. Some contaminated water from the U6 SFP sloshed out and reached the ocean through the storm drain system. Extensive roof collapse of administration building, one door jammed (blocking access to emergency phones).

33 2008-04-18 USA (IL, MI) Mount Carmel, IL (M 5.2, VII) at 09:36:59 UTC; aftershock (M 4.6, V) at 15:14:17 UTC [1]

Iwate-Miyagi Nairiku Earthquake (6.9, VII-VIII), 08:44 (23:43:45, 6/13 UTC). Onshore, shallow (7.8 km), large Onagawa, number of aftershocks including some above 5.1 [1]. No tsunami per ITIC [3]. 75km from Onagawa (100 gals), 175 Higashidori, 34 2008-06-14 km from Fukushima (300 gals) [numbers look wrong]. Reactors operated normally through the earthquake. Minor Fuukushima Daiichi, SFP spilling at 2F2 and 2F4. No alerts at Rokkasho reprocessing facility, tremors but no effect at Rokkasho Fukushima Daini enrichment facility and LLW storage [13].

Honshu Earthquake (M 6.2, VI-VII) at 04:07 (20:07:09 8/10 UTC) [1]. Very small (0.60 cm) wave per ITIC [3]. M 6.5. PGA = 426 gal at Hamaoka 5 (apparently much higher than others). U4 and U5 automatically shut down.

35 2009-08-11 Hamaoka 3-5 U3 and U4 restarted after checking. U5 restarted January 2011. U1 shutdown since 2001, U2 shutdown since 2004 (seismic upgrades). Decided too expensive to upgrade. Original S1 450 gal, S2 600 gal. Ss 800 gal (September 2007), now 1000 gal. [5].

36 2010-04-08 USA (AZ) Baja CA (M 5.3, VII) at 16:44:25 UTC [1]

Onagawa, Fukushima Honshu Earthquake (M 5.9, V) [1]. No tsunami listed by ITIC (below 6.5 cutoff) [3]. M 6.2. Reactors unaffected.

37 2010-06-13 Daiichi, Fukushima Fukushima Daiichi: 60 gal [5].

Daini 38 2010-06-23 USA (VT, IL) Related to Ontario-Quebec (M 5.4, VI) at 17:41:42 UTC or aftershocks [1].

Great Tohoku Earthquake and Tsunami (M 9.1, IX). First foreshock 3/9 (M 7.3); many other foreshocks including Fukushima Daiichi,1-three 6+ on 3/9 (6.0, 6.0, 6.5); aftershocks include a M 7.9 event some 30 minutes after main shock and a M 7.7 6,

event some 10 minutes after that. Total of 47 shocks with M 6.0 or greater from 3/9 through 3/12 [1]. SBO at Fukushima Daini 1-4, 39 2011-03-11 Fukushima Daiichi (U1-U3 at power, all tripped). LOOP at Higashidori (maintenance shutdown) and Tokai Onagawa 1-3, Daini (at power, tripped), EDGs operated. (Wikipedia says 2/3 EDGs at Tokai were out of order). Partial Tokai Daini, LOOP at Fukushima Daini (all units at power, tripped) and Onagawa (all units at power, tripped).

Higashidori 1-2 44

No. Date Plants Notes Mineral Earthquake (M 5.8, intensity VII-VIII). No fore shock (>M 2.5) in days before. One minor aftershock (M 2.8) roughly an hour later (well after Alert declared); a larger aftershock (M 4.2) roughly 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> later (T+6 hr). [1]. Also see [14, 15]).

Per [16]: EQ at 1351, dual unit trip (High Flux Rate) and LOOP (latter caused by sudden pressure relays for xfmrs). No seismic alarms on Seismic Monitoring Instrumentation Panel due to momentary loss of semi-vital power (LOOP, EDG start). Alert emergency classification declared at 1403 (T+12 minutes) due to seismic activity and LOOP condition. Shutdown per EOPs; operators also used additional operating and abnormal procedures to deal with plant conditions. U1 TDAFW pump was under surveillance; manually re-aligned 1424 (T+33). Other ESF equipment (MDAFW, charging, service water, EDGs) started as designed. U2 H EDG tripped 1440 (T+49) due to coolant system leak. Second Alert classification declared 1455 (T+64). Alternate AC DG aligned 1527 (T+86).

Offsite power to buses by 2055 (T+7hr 4 min). EDGs and alternate AC DG shut down at 2138 (T+7 hr 43 min).

Commenced cool down to Cold Shutdown 8/14 0851 (U1); U2 followed. Alert downgraded to NOUE 8/14 1116.

NOUE terminated 8/24 1315. Later determined that EQ spectral accelerations had exceeded the OBE and DBE.

EQ caused reactivity excursion (synergistic effects of core barrel movement, detector movement, core movement, thickening of thermal boundary layer along fuel rods; momentary under-moderated conditions leading 40 2011-08-23 North Anna 1 and 2 to oscillatory but overall decreasing flux profiles). U1 power increase turned around before control rod motion; U2 increase arrested by control rod motion. Did not exceed 100%.

No significant physical or functional damage to safety-related plant SSCs; limited damage to non-safety-related, non-seismically designed SSCs.

Per [17]: Spalled concrete on condensate polishing tank support pedestal (no functional impact), Generator Step Up (GSU) transformer bushing leakage (needed repair), limited cracking of ceramic/porcelain components on switchyard equipment, limited cracking of non-safety related walls, movement of ISFSI casks.

Per WNA M 5.8, 20 km away. PGA = 255 gal, design basis = 176 gal [5].

NRC IN 2012-25: several licensees (including Surry) felt seismic vibration, declared UEs. IN points out that seismic instrumentation, in addition to post-EQ walkdown, is used to determine EQ severity and whether plant should be shut down. At NAPS, seismic instrumentation was not powered by a UPS; power was lost for 8 sec (and EQ strong ground motions lasted for 3.1 sec). Operators could not determine if OBE or SSE were exceeded, could not use seismic entry criteria to enter EAL matrix. (Shift Manager did this based on judgment.) At Surry, sensors were misaligned and could not trigger the 0.01g setpoint. [18]

41 2012-01-30 USA (VA) Luisa, VA (M 3.1, V) at 23:39:47 UTC [1]

42 2012-03-25 USA (VA) Luisa, VA (M 3.0, IV) at 03:21:50 UTC [1]

43 2012-10-16 USA (NH) Maine (M 4.7, VI) at 23:12:25 UTC [1]

44 2012-10-21 USA (CA) Central CA (M 5.3, VII) at 06:55:09 UTC [1]

45 2014-02-14 USA (SC) 46 2014-06-28 USA (AZ) Lordsburg, NM (M 5.3, VII) at 04:59:35 UTC [1]

47 2015-05-02 USA (MI) Galesburg, MI (M 4.2, V) at 16:23:07 UTC [1]

45

No. Date Plants Notes EQ (M 4.2) at 08:22 close to plant. No automatic shutdown, plant continued to operate [29]. Ref. 30 also 48 2015-11-01 Krko mentions earthquake.

EQ (M 5.4, VI-VII) at 20:32 (11:32:55 UTC) [1]. Foreshock (M 4.9, VI) at 19:44 (10:44:33 UTC). M 5.8, largest ever in Korea. Foreshock was M 5.1. Wolsong, Hanul, and Gori close to epicenter, affected by earthquake but still Wolsong 1-4, Shin producing electricity. Shin Kori 3, not yet commercial, taken offline. Was already offline for maintenance. Other 49 2016-09-12 Kori 3, Hanul, Gori Shin Kori units may have been offline already. A combined cycle plant at Ulsan had one thermal unit shutdown automatically. Wolsong 1-4 suspended operations as precautionary measure [31]. EQ felt in Seoul, over 300 km away [32].

50 2017-11-30 USA (NJ) Dover, DE (M 4.1, V) at 21:47:31 UTC [1]

46

Table A.1.2. Seismically-Induced Effects (See Table A.1.1 for more details)

Trip Complicated Transienta Multi-Site Effectb No. Date Unit No. Date Unit No. Date Sites (Effect) 1 1983-07-02 Japan 1 Chinshan 2 1 1980-11-23 Latina and Garigliano (seismic system 2 1993-11-27 Onagawa 1 2 Chinshan 3 actuation while shutdown) 3 Chinshan 2 3 1999-09-21 Kuosheng 1 2 1987-06-10 Multiple U.S. (UE) 4 Chinshan 3 4 Kuosheng 2 3 1999-09-21 Chinshan and Kuosheng (LOOP) 5 1999-09-21 Kuosheng 1 5 Kuosheng 3 4 1999-10-16 USA (CA, AZ) 6 Kuosheng 2 6 2004-12-26 Madras 2 5 2008-04-18 USA (IL, MI) 7 Kuosheng 3 7 2007-07-16 Kashiwazaki-Kariwa 4 6 2010-06-23 USA (VT, IL) 8 2003-05-26 Onagawa 3 8 Fukushima Daiichi 1 Fukushima Daiichi (accidents);

9 2004-11-04 Kashiwazaki-Kariwa 7 9 Fukushima Daiichi 2 7 2011-03-11 Fukushima Daini, Onagawa, Tokai 10 2004-12-26 Madras 1 10 Fukushima Daiichi 3 Daini, and Higashidori (various losses) 11 Onagawa 1 11 Fukushima Daini 1 North Anna (LOOP); Harris and 8 2011-08-23 12 2005-10-08 Onagawa 2 12 Fukushima Daini 2 Susquehanna (UE) 13 Onagawa 3 13 2011-03-11 Fukushima Daini 3 Wolsong (suspended operations), Shin 9 2016-09-12 14 2006-12-26 Taiwan 14 Fukushima Daini 4 Kori (taken offline) 15 Kashiwazaki-Kariwa 2 15 Onagawa 1 10 2017-11-30 USA (NJ) 16 Kashiwazaki-Kariwa 3 16 Onagawa 2 2007-07-16 17 Kashiwazaki-Kariwa 4 17 Onagawa 3 18 Kashiwazaki-Kariwa 7 18 Tokai Daini 1 19 Hamaoka 4 19 North Anna 1 2009-08-11 2011-08-23 20 Hamaoka 5 20 North Anna 2 21 Fukushima Daiichi 1 22 Fukushima Daiichi 2 23 Fukushima Daiichi 3 24 Fukushima Daini 1 25 Fukushima Daini 2 26 2011-03-11 Fukushima Daini 3 27 Fukushima Daini 4 28 Onagawa 1 29 Onagawa 2 30 Onagawa 3 31 Tokai Daini 1 32 North Anna 1 2011-08-23 33 North Anna 2 a A subset of seismically-induced reactor trips. For the purposes of this report, a complicated transient involves a reactor trip and potentially significant additional failures (e.g., LOOP, challenges to ultimate heat sink, failures requiring significant offsite resources in response).

b Includes events where units were already shutdown, as well as events with minor effects (e.g., the declaration of an Unusual Event - UE) 47

A.2 References

[1] Earthquake Catalog, U.S. Geological Survey:

https://earthquake.usgs.gov/earthquakes/search/.

[2] J.R. Reed, N. Anderson, N.C. Chokshi, R.P. Kennedy, W.J. Metevia, D.K. Ostrom, and J.D. Stevenson, A Criterion for Determining Exceedance of the Operating Basis Earthquake, NP-5930, Electric Power Research Institute, Palo Alto, CA, July 1988.

(Available from www.epri.com)

[3] List of Tsunamis, International Tsunami Information Center: itic.ioc-unesco.org/index.php?option=com_content&view=category&layout=blog&id=1160&Itemi d=1077

[4] I. Arango, K. Tokimatsu, and L. Beratan, A Survey of the Ground Liquefaction Resulting from the Nihon-Kai-Chubu Earthquake, submitted to the National Science Foundation, December 19, 1983.

[5] Nuclear Power Plants and Earthquakes, Information Library, World Nuclear Association, London, UK, June 2018. (Available from http://www.world-nuclear.org/information-library/safety-and-security/safety-of-plants/nuclear-power-plants-and-earthquakes.aspx)

[6] E. Bernard, et al., Tsunami Devastates Japanese Coastal Region, American Geophysical Union 0096/3941/74373/93/417/$0 1.00, 1993. (Available from https://nctr.pmel.noaa.gov/okushiri_devastation.html)

[7] T. Heaton, The Physics of Tall Building Collapse, Pre-PSAM 14 Workshop on Seismic PRA, Los Angeles, CA, September 16, 2018.

[8] M7.0 Near East Coast of Honshu, Japan Earthquake of 31 October 2003, U.S.

Geological Survey, November 20, 2003. (Available from https://earthquake.usgs.gov/archive/product/poster/20031031/us/1457985076072/poster

.pdf)

[9] M.A. Merrifield, et al., Data from Tide Gauge Observations of the Indian Ocean Tsunami, December 26, 2004, Geophysical Research Letters, 32, L090603, doi:10.1029/2005GL022610. (Available from http://itic.ioc-unesco.org/images/docs/overview_26dec2004_Sumatra.pdf)

[10] Natural Hazards Database, National Oceanic and Atmospheric Administration National Centers for Environmental Information:

https://www.ngdc.noaa.gov/nndc/struts/results?EQ_0=2439&t=101650&s=9&d=92,183&

nd=display

[11] Risks to Nuclear Reactors Scrutinized in Tsunamis Wake, International Atomic Energy Agency, Vienna, Austria, August 16, 2005. (Available from https://www.iaea.org/newscenter/news/risks-nuclear-reactors-scrutinized-tsunamis-wake)

[12] High court overturns Shika 2 shutdown order, World Nuclear News, March 18, 2009.

(Available from http://world-nuclear-news.org/Articles/High-court-overturns-Shika shutdown-order) 48

[13] Reactors operated normally through quake, World Nuclear News, June 14, 2008.

(Available from http://world-nuclear-news.org/Articles/Reactors-operated-normally-through-quake)

[14] S.E. Hough, Initial Assessment of the Intensity Distribution of the 2011 Mw 5.8 Mineral, Virginia, Earthquake, Seismological Research Letters, 83, No. 4, July/August 2012, pp.

649-657.

[15] Hayes et al. (2016) Tectonic summaries of magnitude 7 and greater earthquakes from 2000 to 2015, USGS Open-File Report 2016-1192.

[16] Dual Unit Reactor Trip and ESF Actuations During Seismic Event with a Loss of Offsite Power, Licensee Event Report 338/2011-003-00, Virginia Electric and Power Co.,

Mineral, VA, October 20, 2011.

[17] Virginia Electric and Power Company, Virginia Electric and Power Company (Dominion), North Anna Power Station Units 1 and 2, North Anna Independent Spent Fuel Storage Installation, Summary Report of August 23, 2011 Earthquake Response and Restart Readiness Determination Plan, Serial No.11-520, September 17, 2011.

(ML11262A151)

[18] U.S. Nuclear Regulatory Commission, Performance issues with seismic instrumentation and associated systems for operating reactors, Information Notice 2012-25, February 1, 2013.

[19] W. Dong, et al., Event Report: Chi-Chi, Taiwan Earthquake, Risk Management Solutions, Menlo Park, CA, 2000. (Available from: https://forms2.rms.com/rs/729-DJX-565/images/eq_chi_chi_taiwan_eq.pdf)

[20] Investigation of the 1999 Chi Chi, Taiwan Earthquake, EPRI, Palo Alto, CA, 2001. TR-1003120

[21] Kashiwazaki Kariwa inspections continue, World Nuclear News, World Nuclear Association, London, UK, November 15, 2007. (Available from: http://www.world-nuclear-news.org/Articles/Kashiwazaki-Kariwa-inspections-continue)

[22] Z. Li and T.R. Roche, The Great Hanshin-Awaji Earthquake of January 17, 1995: A Report on Electric Power and Other Impacts, TR-107083, EPRI, Palo Alto, CA, April 1998.

[23] T.R. Roche, K.L. Merz, M.W. Eli, and S.C. Sommer, The January 17, 1994 Northridge Earthquake, TR-106635, EPRI, Palo Alto, CA, April 1997.

[24] S.W. Swan and T.R. Roche, The October 17, 1989, Loma Prieta Earthquake: Effects on Selected Power and Industrial Facilities, NP-7500-SL, EPRI, Palo Alto, CA, September 1991.

[25] EQE Inc., Effects of the 1985 Mexico Earthquake on Power and Industrial Facilities, NP-5784, EPRI, Palo Alto, CA, April 1988.

[26] The Michoacan, Mexico Earthquake of January 11, 1997: Effects on Power and Selected Industrial Facilities, EPRI, Palo Alto, CA: 1988 Report TR-109928

[27] EQE Engineering, The October 1, 1987 Whittier Earthquake: Effects on Selected Power, Industrial, and Commercial Facilities, NP-7126, EPRI, Palo Alto, CA, December 1990.

[28] Investigation of the 1999 Kocaeli Turkey Earthquake: Effects on Power and Industrial Facilities, EPRI, Palo Alto, CA: 2001. 1003119.

49

[29] Seismic event in Slovenia - The situation in the nuclear power plant of Krko, Istituto Superiore per la Protezione e la Ricerca Ambientale (ISPRA), Rome, Italy. (Available from: http://www.isprambiente.gov.it/en/archive/news-and-other-events/ispra-news/year-2015/november/seismic-event-in-slovenia-the-situation-in-the-nuclear-power-plant-of-krsko)

[30] Seismic hazard affecting the Krko nuclear power plant and public safety concerns, Parliamentary questions, European Parliament, September 14, 2016. (Available from:

http://www.europarl.europa.eu/doceo/document/P-8-2016-006880_EN.html)

[31] South Korean Nuclear Plants Shut Down After Record Earthquake, Power Magazine, September 12, 2016. (Available from: https://www.powermag.com/south-korean-nuclear-plants-shut-down-after-record-earthquake/)

[32] South Koreas biggest earthquake triggers nuclear safety concerns, Reuters, September 13, 2016. (Available from: https://www.reuters.com/article/us-southkorea-nuclear-quake-idUSKCN11J0R2)

[33] Nuclear watchdog approves restart of Miyagi reactor hit by 2011 tsunami, JapanToday, November 27, 2019. (Available from: https://japantoday.com/category/national/nuclear-watchdog-approves-restart-of-reactor-hit-by-2011-tsunami)

[34] Information of Kashiwazaki-Kariwa Power Plant (the 4th news), Japan Nuclear Technology Institute, July 25, 2007. (ML080320300)

[35] International Atomic Energy Agency, The Fukushima Daiichi Accident, Annex III Director General Report, Vienna, Austria, 2015.

50

APPENDIX B - LICENSEE EVENT REPORTS This appendix lists the results of a search using a search tool developed for an earlier knowledge engineering project [1].

Search Parameters:

LER dates: 1980-2014 Search string: earthquake AND reactor trip The search resulted in 26 matching events. It can be seen that the North Anna event of August 23, 2011 is the only event that led to a reactor trip; the rest of the LERs refer to seismically-relevant issues with plant conditions.

51

B.1 Events Year Plant LER Title Notes 1980 San Onofre 1 2061980027R00 Report of Information Presented at May 13, Analysis considers OBE and DBE loads 1980 NRC Meeting Regarding Preliminary Results of Main Steam Line Break Analyses and Auxiliary Feedwater System Automation Modifications 1981 D.C. Cook 1 3151981033R00 None. [Inadequacy in installation of safety Anchorage of 4KV and 600V switchgear cabinets and reactor equipment] trip and bypass breaker cabinets inadequate to prevent overturning during a DBE. (Design deficiency.)

1986 Oconee 1-3 2691986002R00 Some EFW and LPSW Piping and Valves Do In response to GL 81-14, determined some valves and pipes Not Meet Seismic Criteria were not seismically qualified (lacking certification to meet 0.3g) and some manual valves were not normally closed.

1987 Vogtle 1 4241987075R0 Missing Screws in the Nuclear Despite missing screws, Nuclear Instrumentation System (NIS)

Instrumentation Drawers Leads to Tech Spec functioned properly; would have taken an earthquake to fail.

3.0.3 Entry 1987 Robinson 2611987024R00 Discovery of Reactor Protection and Control Preliminary calcs indicated RPS analog instrumentation racks Analog Instrumentation Rack Inadequate (Hagan Racks) anchorage needed additional seismic supports Anchorage Due to Installation Discrepancy to assure operation during DBE 1987 San Onofre 3 3621987011R02 Reactor Trip on Low Steam Generator Water Intermittent circuit due to loose volt in 120VAC non-1E Level Instrument Bus, inability to control MFW, reactor trip. During subsequent ECCS testing, some HPSI pump snubbers found frozen. System would have performed during DBE.

1988 ANO 1 3131988002R00 Plant Instrumentation Found Not Seismically During plant mod, bolts found to be loose and pulling out of Qualified Due to Improperly Sized Anchor wall. Rack was for safety-related pressure transmitters which Bolts for Mounting Rack provide input to RPS. Rack might have failed during a seismic event.

1989 Catawba 1 and 4131989025R01 Technical Specification 3.0.3 Entered on Both High winds and rainfall from Hurricane Hugo, leak on 2 Units For Inoperable Power Range Nuclear switchgear, loss of power to Condenser Circulating Water Instrumentation Due To Power Reduction Cooling Tower Fans. Response per operating procedure During Hurricane Hugo RP/0/A/5000/07 Natural Disaster and Earthquake.

1991 Catawba 1 4131991006R00 Technical Specification Violation When DBE assumed to fail Wylie dam, leading to loss of lake level as Nuclear Service Water Valves Were Left well as LOOP. SNSWP would be required some 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> later.

Without an Emergency Power Supply Due To Inappropriate Action 1991 San Onofre 2 3611991018R01 Safety Related Instrumentation Not Installed Process Instrumentation cabinets missing guide rails and/or in a Seismically Qualified Configuration bumpers. Later testing showed instruments without bumpers would have functioned properly during and after DBE.

1993 South Texas 1 4981993007 Technical Specification Required Shutdown Shutdown b/c TDAFW pump not restored in time. Analysis due to the Inoperability of an Auxiliary indicated Units 1 and 2 could achieve cold shutdown following a Feedwater Pump SSE with single failure and LOOP. Note: same problem (water intrusion) led to TDAFW pump overspeed at both units.

52

Year Plant LER Title Notes 1995 Salem 1 and 2 2721995001R00 Technical Specification (TS) 3.0.3 Entry; Both Discovered AC power distribution within SSPS vulnerable to Trains of the Solid State Protection System CCF (design fault). SSPS signals were susceptible to short (SSPS) Being Inoperable circuits due to DBE. Event discovery followed issued identification by Diablo Canyon.

1996 Shearon Harris 4001996013R02 Condition outside of design basis where the Non-seismic portions of SFP purification system had been RWST had been aligned with a non- aligned to the RWST for cleanup; non-seismic portions of seismically qualified system hydrostatic test pump have been aligned to the RWST to fill SI accumulators. Earthquake could have failed non-seismic portions of systems, drained RWST.

1996 Comanche 4451996009R01 The 480V Switchgear Breakers Racked Out 9 spare breakers racked out in the REMOVE position; not Peak 1 and 2 in the Cubicle in Remove Position Resulting seismically qualified for this position.

in Seismically Unqualified Conditions Outside the Design Basis 1998 D.C. Cook 1 3151998002R01 Degraded Solid State Protection System Degraded SSPS master relay (MR) covers are susceptible to Master Relays Result in Condition Outside being loosened during 12g [!] earthquake. Notes that SSE is the Design Basis 0.2g, and that no SSEs have occurred over 1988-1998.

1998 Davis-Besse 3461998009R00 Reactor Coolant System Pressurizer Spray Nuts replaced due to improper materials (carbon steel, not SS),

Valve Not Functional with Two of Eight Body boric acid corrosion One nut not properly attached, another nut to Bonnet Nuts Missing degraded. In combination with maximum design pressure, SSE could have caused failure, RCS leak.

1999 Diablo Canyon 2751999007R00 Plant Outside Design Basis Due to degraded Increasing trend in control room lamp socket failures, some 1 and 2 Indicating Lamp Sockets affecting control circuits for redundant safety related components in both units. Lamp failures could affect response to a DBE. (Licensee analysis indicates critical functions not impacted, or had redundancy, or had sufficient time for operator action.)

1999 Diablo Canyon 2751999007R01 Plant Outside Design Basis Due to Degraded Increasing trend in control room lamp socket failures, some 1 and 2 Indicating Lamp Sockets affecting control circuits for redundant safety related components in both units. Lamp failures could affect response to a DBE. (Licensee analysis indicates critical functions not impacted, or had redundancy, or had sufficient time for operator action.)

2000 Prairie Island 2822000005R00 Failure to Test Cooling (Service) Water Recognized that DBE could result in river water supplies could Strainer Backwash Valves Due to Inadequate contain a significant amount of disturbed and unsettled solids Surveillance Procedure 2001 Diablo Canyon 2752001003R00 Technical Specification 3.7.6 Not Met When AOT exceeded due to manual valve isolation between FWST 1 the Fire Water Storage Tank Was Isolated and CST. CST and FWST are designed to withstand from the Auxiliary Feed Water Pumps Suction earthquakes.

Due to Personnel Error 2011 North Anna 1 3382011003R00 Dual Unit Reactor Trip and ESF Actuations and 2 During Seismic Event with a Loss of Offsite Power 53

Year Plant LER Title Notes 2012 Summer 3952012001R00 Core Exit Thermocouples Inoperable due to Core Exit Thermocouples (CETCs) would have been inoperable an Inadequate Maintenance Procedure if a LOCA had occurred, due to lack of Control Rod Drive Mechanism (CRDM) Cable Bridge hold-down bolts. Design calculation for Cable Bridge includes OBE and SSE as well as LOCA loads.

2013 TMI 1 2892013001R00 Technical Specification Prohibited Condition Battery declared unable to perform design function in the event Due to an Inoperable 33 Station Battery of a seismic event Caused by a Cell Crack 2013 TMI 1 2892013001R01 Technical Specification Prohibited Condition Battery declared unable to perform design function in the event Due to an Inoperable 33 Station Battery of a seismic event Caused by a Cell Crack B.2 References

[1] N. Siu, S. Dennis, M. Tobin, P. Appignani, K. Coyne, G. Young, and S. Raimist, Advanced Knowledge Engineering Tools to Support Risk-Informed Decision Making: Final Report (Public Version), U.S. Nuclear Regulatory Commission, December 2016. (ML16355A373) 54

APPENDIX C - SEISMICALLY-INDUCED STRESS AND SITUATION ASSESSMENT AT FUKUSHIMA DAIICHI C.1 Discussion As discussed in numerous post-mortems of the Fukushima Daiichi reactor accident (e.g., [1-4]),

particularly post-accident interviews of Site Superintendent Masao Yoshida [5] and an anonymous TEPCO contractor [6], it is clear that the operating staff (including onsite contractors as well as TEPCO employees) were under considerable stress. Much of that was due to the unforeseen and deteriorating plant situation, but some was also due to concerns with offsite damage with consequent effect on families, homes, etc. 34 Its also well-known that stress can affect operator situation assessment (as modeled by the IDHEAS macro-cognitive function Understanding). As discussed in NUREG-2114 [9], stress can cause

• Attentional narrowing and even tunneling

• Disorganization in scanning patterns

• Decreases in amount of information a person can attend to

• Decision making without considering all available information This is particularly important in severe accident response since, as stated in the National Research Councils investigation of the Fukushima Daiichi reactor accident [3], reliance on cognitive skills can become critically important when ad hoc responses are required for coping with unanticipated situations that are not well handled by the available procedural guidance and decision-support.

However, of interest to our project, it is less clear if stress due specifically to the earthquake and tsunami had a significant effect on the operators situation assessment beyond that due to:

• the loss of information and control caused by the loss of power (this is addressed by the IDHEAS macro-cognitive function Detection) and

• the stress due to the increasingly desperate plant conditions as the accident progressed (as such conditions can arise during non-seismically initiated accidents).

This appendix provides the evidence from numerous reports on the stress on plant personnel from the earthquake (including aftershocks and tsunamis), and of potential effects on situation assessment. We observe the following:

34 In an analogous situation during Hurricane Andrew, the Turkey Point staffs expectation of severe offsite damage, in combination with loss of offsite communication, increased stress due to concerns regarding families and homes [7, 8]

55

• Not surprisingly, the eyewitness narratives provide a much more dramatic picture of the frames of mind of various actors.

• Although it is reasonable to hypothesize that the earthquake- and tsunami-induced stress affected such cognitive activities as situation assessment, we have not found any direct indication of such effects. 35 35 Note that Koike et al. [13] characterize the operators decision to isolate the Unit 1 isolation condenser due to dryout concerns as a misinterpretation of the situation, i.e., a failure in situation assessment.

However, this failure: a) was attributed to a lack of training and education, not stress; and b) occurred well into the accident (i.e., it was not an immediate effect of the earthquake or tsunami),

56

C.2 Data Table C.1. Evidence of earthquake-induced stress and effects - before tsunami arrival Reference Quote Notes Investigation Committee [Summary of state prior to tsunami arrival]: The shift teams, the NPS ERC and the Indicates a reasonable Interim Report [1], p. 97 Tokyo Headquarters thought that they could put the reactors into a state of cold state of confidence shutdown before the loss of all AC power sources due to the tsunami so long as they implement the prescribed procedures.

Investigation Committee [Immediately after initial shock]: The shock of the earthquake caused the earthquake No evidence of surprise, Interim Report [1], p. 98 and fire alarms to sound in the Units 1&2 main control room at that time. The shift likely not a major stressor.

supervisor knew that even dust blown up into the air inside rooms activated the fire alarms at TEPCO's Kashiwazaki-Kariwa Nuclear Power Station at the time of the Chuetsu-oki Earthquake in July 2007.

Investigation Committee [Immediately after initial shock]: Dust blown up in the air by the shock of the Implies a calm response.

Interim Report [1], earthquake filled the main control room for Units 3 and 4 In the white smoke pp. 101-102 screen, the shift team waited for the quake to cease and then started the normal scram response operation Investigation Committee [Before tsunami arrival]: The [Units 3 & 4] shift team thought that they should activate Implies a calm Interim Report [1], the containment cooling system. At that time, however, a major tsunami warning had consideration of situation, pp. 101-102 already been issued. If the tsunami arrived after the pumps were activated, the pumps recognition of potential would run dry and fail because they would be unable to pump water up as the water tsunami effects.

level fell due to the backrush of the tsunami. Unlike the shift team of the Units 1&2 main control room, the shift team on duty at the Units 3 & 4 main control room decided not to activate the pumps for the time being in preparation for the arrival of the tsunami and to wait and see what would happen.

Investigation Committee [After tsunami warning, before tsunami arrival]: Site Superintendent Yoshida first Implies calm consideration Interim Report [1], learned from the news on television that a three-meter high tsunami would hit the of situation, expectation of pp. 109-110 Fukushima Daiichi NPS then he learned that the estimated height had been changed success.

to six meters. Site Superintendent Yoshida feet an apprehension that the Residual Heat Removal System (RHR) might lose its cooling function when (if) the emergency seawater pump facilities would be damaged by the backrush of the tsunami.

At that moment, however, Site Superintendent Yoshida did not yet expect that more than one unit were to lose all AC power sources at once and station blackout would continue for a long time. He thought that even if the emergency seawater pump facility were damaged, the IC of Unit 1 and the RCICs of Units 2 and 3 could be used to cool down the reactors or they could recover cooling capability by restoring the pump facility while constructing power interchange facility between the units.

57

Reference Quote Notes Bulletin of the Atomic [During shock] I first felt the earthquake as I walked from the vicinity of Units 5 and 6 Direct reference to panic.

Scientists [6] - which are located near the ocean - to the sites entrance gate. Suddenly, the asphalt began to ripple, and I couldnt stay on my feet. In a panic, I looked around and saw a 120-meter exhaust duct shaking violently and looking like it would rupture at any second. Cracks began to appear on the outside of Unit 5s turbine building and on the inside of the entryway to the units service building. The air was filled with clouds of dirt.

Bulletin of the Atomic [Workers trying to evacuate after initial shock] Let us out of here, we yelled. A Direct indication of panic.

Scientists [6] tsunami may be coming! Screams and shouts filled the air.

Table C.2. Evidence of earthquake-/tsunami-induced stress and effects - after tsunami arrival Reference Quote Notes Investigation Committee The NPS ERC received reports from the three main control rooms that the nuclear Operators are stunned Interim Report [1], reactors were successively losing their power supplies and Units 1, 2 and 4 in pp. 110-111 particular had lost all of their power sources. Everyone at the NPS ERC was lost for words at the ongoing unpredicted and devastated state.

Investigation Committee Site Superintendent Yoshida understood that a situation that far exceeded any Indicates surprise; Interim Report [1], expected major accident had actually taken place. presumably source of

p. 111 stress Investigation Committee Site Superintendent Yoshida thought it would be impossible to take any action Implies rational Interim Report [1], necessary to control the nuclear plants without the plant parameters, especially those consideration of situation

p. 112 for the reactor water level and pressure. He therefore directed the recovery team of and alternatives.

the NPS ERC to give priority to restoring the equipment necessary for measuring the main parameters.

Investigation Committee the "Emergency Operating Procedure" for AM contained only internal events as Presumably a stress-Interim Report [1], causal events for AM and did not consider external events such as an earthquake or inducing situation

p. 113 tsunami as causal events. There was no reference taking into account the events where all AC and DC power sources would be lost. In addition, the descriptions of the standards were written on the assumption that the state of the plants can be monitored by the control panel indicators and measuring instruments in the main control room and that the control panel could be manipulated.

As a result, the shift team was forced to predict the reactor state according to a limited amount of information and take such procedures operators think best on the spot instead of following the instructions described in the standard manuals.

58

Reference Quote Notes Diet Report [2], the main control room had no information about events outside, including the Direct statement of stress.

Chapter 2, p. 17 status of the other reactors and power plants, and the safety of their families[31] Fear, References are to hearings stemming from a lack of information, caused mental stress among the workers[32] and with workers made the emergency response even more difficult.

TEPCO Report [10], the first floor of the S/B was flooded, meaning equipment and dosimeters needed Unexpected condition:

p. 167 to enter the controlled area were rendered unusable by seawater. Not only that, but widespread damage and entire racks were knocked down. Power from power source equipment within the dangerous working building was entirely lost (both AC and DC). This shut down motorized valves and environment; presumably a pumps, as well as monitoring instruments. By this point, events had already veered stress-inducing situation.

far from the conditions foreseen in procedures determined in advance. The return of an operator, sopping wet, shouting Theres seawater rushing in! made MCR operators certain that a tsunami had struck.

At this point, debris from the tsunami was scattered about the seaside area of the station, manhole covers had been washed away, and outdoor roads were sunken. It was in these dangerous conditions that building lighting was lost, leaving operators to grope through the darkness. Communication troubles meant no contact could be taken within the building (outside the MCR) or outside of it. Meanwhile, aftershocks kept striking and large tsunami alerts continued to stay in effect. Tsunamis of differing heights came relentlessly, meaning the risk of being swept away in a tsunami was far too great to leave the MCR on the second floor of the S/B and travel through the S/B 1F to go outside.

National Research The lack of food, working toilets, and relief personnel during the early stages of the Direct statement of fatigue Council Report [3], accident as well as the extended length of the accident response added greatly to and distress (based on

p. 111 personnel fatigue and distress. Japanese reports)

Plant personnel who responded to the accident exhibited a strong degree of self-sacrifice. Many suffered personal losses (homes destroyed or damaged, family members displaced or lost) but continued to work, in some cases for weeks following the tsunami.

Yoshida Testimony [5] Piecing together those bits of information led to the likely realization that the entire Direct statement of frame of nuclear plant had been inundated by the tsunami. mind It finally dawned on Yoshida that he was confronting an unimaginable situation because events showed it was possible for all power sources at the plant to be lost.

Yoshida said, "To be honest, I was just devastated."

59

Reference Quote Notes Bulletin of the Atomic a section chief came rushing up to Fukushimas plant manager, Masao Yoshida, Direct indication of staff Scientists [6] and reported: A tank [has] been washed away and had sunk into the ocean. We all panic, decision maker went pale with shock: The tank that had been lost was a surge tank of suppression stress.

pool water at the Fukushima Daiichi Nuclear Power Station.

People continued coming in and out of the Crisis Center, delivering one report after another to Yoshida. Each time, the plant managers shouts reverberated through a microphone: Thats not the question I asked! and Give me the answer to . . . this and that! The workers surrounding Yoshida kept trying to get in touch with people at the reactor buildings at Units 1 through 4, but they were unsuccessful, because the dedicated on-site PHS [Personal Handy-phone System] base station had lost electrical power due to the tsunami.

Bulletin of the Atomic [Shortly after 4 pm, 3/11] By this point, around 700 people had taken refuge in the Direct indication of panic.

Scientists [6] earthquake-resistant building; and, because we had just conducted an emergency-preparedness drill the previous week, things were surprisingly orderly..TEPCOemployees handed out water and crackers, and we took turns using a PHS that was able to connect to the outside world to confirm the safety of our families. Meanwhile, some foreigners sat on the floor and chatted, and the female employees screamed during each aftershock.

New York Times article My town is gone, wrote a worker named Emiko Ueno, in an email obtained by The Direct statement of stress

[11], 3/30/2011 Times. My parents are still missing. I still cannot get in the area because of the due to offsite effects.

evacuation order. I still have to work in such a mental state. This is my limit.

Inagaki presentation [Lesson] In a total dark control room, operators feel strong fear. Presumably reflects actual

[12], p. 34 condition (i.e., not just a reasonable hypothesis)

Inagaki presentation [Operator testimony] In an attempt to check the status of Unit 4 D/G, I was trapped Life threatening situation,

[12], p. 45 inside the security gate compartment. Soon the tsunami came and I was a few presumably stressful minutes before drowning, when my colleague smash opened the window and saved my life.

Koike et al. [13] Operators in high risk site were exposed to extreme conditions such as acute stress. Assessment based on The most important factors of extreme stressful conditions such as acute stress[7] are reading of reports, press Event that no one in the shift team had experienced, Performance anxiety of releases, on-site equipments, High radiation, and these factors had some impact on the operators investigation. References decision-making and actions which were required by the emergency procedures. [7] and [8] are general.

Cognitive activity such as decision-making and task-planning has previously been Unclear if the link between found to be negatively affected by stress[8]. human factors (e.g., stress) and problems with cognitive activities is assumed or the result of an investigation.

60

C.3 References

[1] Government of Japan, Interim Report (Main Text), Government of Japan Investigation Committee on the Accident at Fukushima Nuclear Power Stations of Tokyo Electric Power Company), Tokyo, Japan, 2011.

[2] K. Kurokawa, et al., The Official Report of the Fukushima Nuclear Accident Independent Investigation Commission, National Diet of Japan, Tokyo, Japan, 2012.

[3] National Research Council, Lessons Learned from the Fukushima Nuclear Accident for Improving Safety of U.S. Nuclear Plants, National Academies Press, Washington, DC, 2014.

[4] International Atomic Energy Agency, The Fukushima Daiichi Accident, Director General Report, Vienna, Austria, 2015.

[5] The Yoshida Testimony: The Fukushima nuclear accident as told by plant manager Masao Yoshida, Asahi Shimbun, 2014. (Available from:

http://www.asahi.com/special/yoshida_report/en/)

[6] Independent Investigation Commission on the Fukushima Nuclear Accident and Masaharu Fujiyoshi, Prologue to catastrophe, Bulletin of the Atomic Scientists, 70(2),

36-41, 2014.

[7] F.J. Hebdon, Effect of Hurricane Andrew on the Turkey Point Nuclear Generating Station from August 20-30, 1992, NUREG-1474, U.S. Nuclear Regulatory Commission, 1993.

(Available from https://www.osti.gov/biblio/10158520)

[8] M. Leach, et al., NRC 2005 Hurricane Season Lessons Learned Task Force Final Report, STP-06-039, U.S. Nuclear Regulatory Commission, Washington, DC, 2006.

(ADAMS ML060900005)

[9] A.M. Whaley, J. Xing, R.L. Boring, S.M.L. Hendrickson, J.C. Joe, K. L. LeBlanc, and S.L.

Morrow, Cognitive Basis for Human Reliability Analysis, NUREG-2114, January 2016.

[10] Tokyo Electric Power Co., Fukushima Nuclear Accident Analysis Report, Tokyo, Japan, 2012.

[11] K. Belson, Workers Give Glimpse of Japans Nuclear Crisis, New York Times, March 30, 2011. (Available from http://www.nytimes.com/2011/03/31/world/asia/31workers.html?_r=1)

[12] T. Inagaki, East Japan Earthquake on March 11, 2011 and Fukushima Daiichi Nuclear Power Station, Tokyo Electric Power Co., March 2014.

[13] H. Koike, T. Hata, and R. Kubota, Analysis on human and organizational factors regarding initial responses of shift teams and fieldworkers to the Fukushima Daiichi NPP accident, Transactions American Nuclear Society, 107, pp. 323-326, ANS Winter Meeting, San Diego, CA, November 11-15, 2012.

61

APPENDIX D - IDHEAS-G CFMS AND PIFS This appendix provides draft descriptions of the cognitive failure modes (CFMs) and performance influencing factors (PIFs). Work to finalize these descriptions, including some rewording and re-categorization of PIF attributes is ongoing.

Table D.1. IDHEAS-G CFMs High-Level Mid-Level Detailed CFM CFM CFM D1-1 Detection is not initiated (e.g., skip steps of procedure for detection, forget to check information, fail to realize D1 - Fail to the need to check information, fail to check the right establish the information) mental model D1-2 Wrong mental model for detection (e.g., incorrect for detection planning on when, how, or what to detect)

D1-3 Failure to prioritize information to be detected D2 - Fail to select, identify, D2-1 Fail to access the source of information (e.g., fail to access, or attend to view, or measure partial or all sources) sources of D2-2 Attend to wrong source of information information D3-1 Unable to perceive information D3-2 Key alarm not perceived D3-3 Key alarm incorrectly perceived D3-4 Fail to recognize that primary cue is not available or D - Failure of D3 - Fail to misleading Detection perceive, D3-5 Cues not perceived recognize, or D3-6 Cues misperceived (e.g., information incorrectly perceived; classify information failure to perceive weak signals; reading errors; incorrectly interpret, organize, or classify information)

D3-7 Fail to monitor status (e.g., information or parameters not monitored at proper frequency or for adequate period of time, failure to monitor all of the key parameters, and incorrectly perceiving the trend of a parameter)

D4 - Fail to D4-1 Fail to self-verify the perceived information against the verify the detection criteria perceived information D4-2 Fail to peer-check the perceived information D5-1 The detected information not retained or incorrectly D5 - Fail to retained (e.g., wrong items marked, wrong recording, and communicate the wrong data entry) acquired D5-2 The detected information not communicated or information miscommunicated 62

High-Level Mid-Level Detailed CFM CFM CFM U1-1 Incomplete data selected (e.g., critical data dismissed, U1 - Fail to critical data omitted) assess or select U1-2 Incorrect or inappropriate data selected (e.g., failure to data recognize the applicable data range or recognize that U - Failure of information is outdated)

Understanding U2-1 No mental model exists for understanding the situation U2 - Incorrect U2-2 Incorrect mental model selected mental model U2-3 Fail to adapt the mental model (e.g., fail to recognize and adapt mismatched procedures)

U3-1 Incorrectly assess situation (e.g., situational awareness not U3 - Incorrect maintained, and incorrect prediction of the system integration of evolution or upcoming events) data and mental U3-2 Incorrectly diagnose problems (e.g., conflicts in data not model resolved, under- diagnosis, fail to use guidance outside main procedure steps for diagnosis)

U4-1 Premature termination of data collection (e.g., not U - Failure of seeking additional data to reconcile gaps, Understanding discrepancies, or conflicts, or fail to revise the outcomes U4 - Fail to based on new data, mental models, or viewpoints iterate the U4-2 Fail to generate coherent team understanding (e.g.,

understanding assessment or diagnosis not verified or confirmed by the team, and lack of confirmation and verification of the results).

U5 - Fail to U5-1 Outcomes of understanding miscommunicated or communicate the inadequately communicated outcome DM1 - Incorrect DM1-1 Incorrect goal selected goals or priorities DM1-2 Unable to prioritize multiple conflicting goals DM2-1 Incorrect decision model or decisionmaking process DM2 - (e.g., incorrect about who, how, or when to make Inappropriate decision, decision goal is not supported by the decision DM - Failure of decision model model or process)

Decisionmaking DM2-2 Incorrect decision criteria DM3-1 Critical information not selected or only partially selected DM3 - (e.g., bias, undersampling of information)

Information is DM3-2 Selected information not appropriate or not applicable to under-represented the situation DM3-3 Misinterpretation or misuse of selected information 63

High-Level Mid-Level Detailed CFM CFM CFM DM4-1 Misinterpret procedure DM4-2 Choose inappropriate strategy or options DM4-3 Incorrect or inadequate planning or developing solutions (e.g., plan wrong or infeasible responses, plan the right DM4 - Incorrect judgment or response actions at wrong times, fail to plan planning configuration changes when needed, plan wrong or infeasible configuration changes)

DM4-4 Decide to interfere or override automatic or passive safety-critical systems that would lead to undesirable consequences DM5-1 Unable to simulate or evaluate the decisions effects DM5 - Failure to (e.g., fail to assess negative impacts or unable to simulate or evaluate the pros and cons) evaluate the DM5-2 Incorrectly simulate or evaluate the decision (e.g., fail to decision/ evaluate the side effects or components, or fail to strategy/plan consider all key factors)

DM5-3 Incorrect dynamic decisionmaking DM6 - Fail to DM6-1 Decision incorrectly communicated DM - Failure of communicate or DM6-2 Decision not authorized Decisionmaking authorize the DM6-3 Decision delayed in authorization decision E1-1 Action is not initiated E1-2 Incorrect interpretation of the action plan (e.g., wrong equipment/tool preparation, or coordination)

E1 - Fail to E1-3 Wrong action criteria assess action E1-4 Delayed implementation of planned action plan and criteria E1-5 Incorrect addition of actions or action steps to manipulate safety systems outside action plans (e.g., error of commission)

E2-1 Fail to modify, adapt, or develop action scripts for a E2 - Fail to high-level action plan develop/ modify action scripts E2-2 Incorrectly modify or develop action scripts for the action plan E - Failure of E3-1 Fail to coordinate the action implementation (e.g., fail to Action Execution E3 - Fail to coordinate team members, errors in personnel allocation) coordinate action E3-2 Fail to initiate action implementation E3-3 Fail to perform status checking required for initiating actions E4-1 Fail to follow procedures (e.g., skip steps in procedures)

E4-2 Fail to execute simple action E4-3 Fail to execute complex action (e.g., execute a complex E4 - Fail to action with incorrect timing or sequence, execute actions perform the that do not meet the entry conditions) planned action E4-3A Fail to execute control actions E4-3B Fail to execute long-lasting actions E4-4 Fail to execute physically demanding actions E4-5 Fail to execute fine-motor actions 64

High-Level Mid-Level Detailed CFM CFM CFM E5-1 Fail to adjust action by monitoring, measuring, and assessing outcomes E5 - Fail to verify E5-2 Fail to complete entire action scripts or procedures or adjust action (e.g., omit steps after the action criteria are met)

E5-3 Fail to record, report or communicate action status or outcomes T1 - Fail to establish or adapt the teamwork infrastructure T2 - Fail to T - Failure of manage Teamwork information T3 - Fail to maintain shared situational awareness T4 -

Inappropriately manage resources T5 - Fail to plan/make interteam decisions or T - Failure of generate Teamwork commands T6 - Fail to implement decisions/comma nds T7 - Fail to control the implementation 65

Table D.2. IDHEAS-G PIFs PIF Category PIF pE1 - accessibility/habitability of workplace including travel paths pE2 - workplace visibility environment- and pE3 - noise in workplace and communication pathways situation-related pE4 - cold/heat/humidity pE5 - resistance to physical movement pS1 - system and I&C transparency to personnel system-related pS2 - human-system interface (HSI) pS3 - equipment and tools pP1 - staffing pP1 - procedures, guidance, and instructions personnel-related pP2 - training pP3 - teamwork and organizational factors pP4 - work processes pT1 - information availability and reliability pT1 - scenario familiarity pT2 - multitasking, interruptions, and distractions task-related pT3 - task complexity pT4 - mental fatigue pT5 - time pressure and stress pT6 - physical demands 66

APPENDIX E - HEAF EVENTS This appendix provides a listing of U.S. HEAF events, including author judgments as to whether the event cause is potentially relevant to seismic PRA, and whether the cause would have been detectable by a typical seismic PRA walkdown.

67

E.1 Events Detectable Seismic LER/Event HEAF During Date Plant Root Cause / Discussion Implica- Room Notification Bina Visual tions?

Walkdown?

The root cause of this event was fault condition at busway Browns joint. The apparent cause of the failure was a loose busway Switchgear 04/15/1980 2591980031 16.1 Yes No Ferry 1 bolt. Bolted connections which have relaxed or loosened can room be exacerbated by ground shake events.

The root cause of the occurrence has been attributed to above normal electrical resistance in the main disconnecting contacts of the breaker. The resistance caused the fault when the contacts were called upon to carry the starting current of No, unless Yankee- the LPSI pump motor. As seen in past seismic events, Switchgear 08/02/1984 0291984013 16.a Yes thermography Rowe ground shake can damage or effect the alignment between room included the stabs in the cubicle and the breaker. This misalignment can affect the connection and misalignment can make the connection worse which could aggravate the underlying deficiency which could lead to an arcing event.

The apparent cause of the event has been determined to be moisture intrusion into one of the bus ducts during recent temperature inversions coupled with the cycling of the UAT (during unit startups and shutdowns) over the same period.

The moisture intrusion could have had the compounding effect of leaving contaminants on the bus bars and insulators which over a period of time could have contributed to the 03/19/1987 La Salle 1 3731987014 16.1 Unknown No Switchyard cause of the fault. The destructive nature of the fault hampered the investigation process, and it is not known on which bus duct (4.1 or 6.9 KV) the fault occurred. There is little information to indicate this event could have occurred due to a seismic event unless potential sources of seismic related flooding are investigated. The level of contamination overtime was unknown.

68

Detectable Seismic LER/Event HEAF During Date Plant Root Cause / Discussion Implica- Room Notification Bina Visual tions?

Walkdown?

The root cause of the event was an insulation failure on the Bus Bar compounded by accumulation of particulate debris.

The Bus Bar runs perpendicular to Turbine Building Ventilation Fans mounted in the Building exterior wall. The fan's suction pulled dust filled air through the section of the Bus Bar. Dust and metallic powder debris collected on the No (unless Switchgear 07/10/1987 Kewaunee 3051987009 16.1 outside of the Bus Bar insulation. The insulation failure Yes bus way was room combined with the accumulated dirt provided a tracking path opened) from phase to ground. The phase to ground fault progressed to a phase to phase fault which accounted for the extensive bus damage. FME and the buildup or aggravation of FME during a ground shake event could have led to an arcing event.

The root cause of the event was an insulation failure on the Bus Bar at the Bus Bar support combined with the accumulation of debris and water. The Bus Bar runs horizontally into the Auxiliary Building underneath various areas where debris can fall into the bus work. Above the No (unless faulted section of bus bar, a plastic hose which was designed Switchgear 03/02/1988 Kewaunee 3051988001 16.1 Yes bus way was to empty into a floor drain, was emptying on the floor and it is room opened) suspected that water may have dripped onto the bus work.

The insulation failure combined with the accumulated dirt and water provided a tracking path for the fault. FME and the buildup or aggravation of FME during a ground shake event could have led to an arcing event.

The initial fault current path was from the "B" phase bus across the support bar to ground, which initiated a three-phase fault to ground. Although this is indicated by information obtained from the Digital Fault recorder, there No, unless Palo Switchgear 07/06/1988 5281988010 16.b was too much damage from the second fault to positively Yes cubicle was Verde 1 room identify this. There was evidence of a buildup of dirt on the opened floor of the "B" cubicle and potential arc tracking conditions.

FME and the buildup or aggravation of this dirt during a ground shake event could have led to an arcing event.

69

Detectable Seismic LER/Event HEAF During Date Plant Root Cause / Discussion Implica- Room Notification Bina Visual tions?

Walkdown?

The root cause was theorized to have been switchgear failure due to arcing at "plug-in" connections which resulted in cross phase arcing, or a fire in the DC control circuitry cabling which caused cross phase arcing. However it was not possible to determine the cause with any certainty due to the 2691989002 level of damage. If the "plug-in" connections were the cause (not of the arc then ground shake could have damaged or effected Switchgear 01/03/1989 Oconee 1 electronically 16.b Unknown Unknown the alignment between the connections in cubicle and the room available on breaker. The misalignment could have affected the ADAMS) connection and misalignment can make the connection worse which could aggravate the underlying deficiency which could lead to an arcing event. If a fire in the DC control circuitry was the cause it is uncertain if seismic activity would have led to this event.

These ground faults were apparently caused by aluminum debris carried down the bus duct by the forced air cooling system. The aluminum debris entered the bus duct as a result of previous damper failures in the bus duct cooling system. These failures occurred on February 27, 1988, and in the summer of 1989. Arcing between the conductor and the 4001989017 enclosure occurred over a fifty (50) foot length of the "A" (not phase bus immediately upstream of the "B" main power No (unless Turbine 10/09/1989 Harris electronically 16.2 transformer. Ionization from this arcing reduced the dielectric Yes bus way was building available on strength of the cooling air which was carried into the bushing opened)

ADAMS) box of the "B" main power transformer. This caused an "A" phase to ground flashover in the bushing box, which immediately propagated to the "B" phase bushing. The fault cracked both low voltage bushings, causing oil to leak from the bushings, and ignited the leaking oil. FME and the buildup or aggravation of FME during a ground shake event could have led to an arcing event.

70

Detectable Seismic LER/Event HEAF During Date Plant Root Cause / Discussion Implica- Room Notification Bina Visual tions?

Walkdown?

The root cause of this event was the failure of a lightning arrester with a combination of a failure of a breaker. This led Waterford to a non-vital switchgear failure and fire in the breaker cubicle Switchgear 06/10/1995 3821995002 16.b for the startup transformer. The lightning strike was the No No 3 room underlying cause of the event.

The root cause is believed to be associated with long-term Diablo degradation, and/or inadequate preventive maintenance (PM) Switchgear 05/15/2000 2752000004 16.1 Yes Unknown Canyon 1 exacerbated by a marginal design. room Long term degradation issues could potentially be exacerbated during seismic events.

San Switchgear 02/03/2001 3622001001 16.b The root cause of the event could not be determined due to Unknown Unknown Onofre 2/3 room the extensive damage.

71

Detectable Seismic LER/Event HEAF During Date Plant Root Cause / Discussion Implica- Room Notification Bina Visual tions?

Walkdown?

The root cause of this event was poor electrical connection between the Breaker phase primary disconnect assembly (PDA) and the bus stab, which led to overheating of the PDA, which in turn led to a failure of the PDA one or two seconds after the breaker was closed. The failure of the PDA led to a C-phase to ground arcing event, which quickly involved all phases. The arcing led to actuation of the protective relaying, which resulted in a turbine/reactor trip.

The poor electrical connection was caused by poor 2822001005 conductive surfaces. A thinned silver coating on the No, unless Prairie Switchgear 08/03/2001 16.b connections exposed copper oxides in the conductors. Yes thermography Island 1 2822001006 room Because copper oxide has resistance that is orders of included magnitude higher than copper, silver, or silver oxide, this led to a high resistance connection, and overheating. The silver layer was most likely thinned by environmental and operating conditions and/or maintenance practices.

As seen in past seismic events, ground shake can damage or effect the alignment between the stabs in the cubicle and the breaker. This misalignment can affect the connection and misalignment can make the connection worse which could aggravate the underlying deficiency which could lead to an arcing event.

Browns Cooling 07/27/2008 EN-44367 16.1 Unknown Unknown Unknown Ferry 2 Towers The most probable cause of the bus failure is a relaxation of bolted connections on the center phase flexible link(s) caused by repeated thermal cycles over time. The root cause Columbia identified for this event was the nonperformance of Turbine 08/05/2009 3972009004 16.1 Yes No 2 preventative maintenance (PM) tasks for torque checks of the building non-segregated bus links. Bolted connections which have relaxed or loosened can be exacerbated by ground shake events.

72

Detectable Seismic LER/Event HEAF During Date Plant Root Cause / Discussion Implica- Room Notification Bina Visual tions?

Walkdown?

The root cause of this event was a combination of water intrusion and the likely degradation of Noryl insulation resulting in a ground fault on phase A, which then ionized the Palo air inside the bus duct, resulting in a phase A to B fault that 03/07/2010 5282010001 16.1 No No Switchyard Verde 1 was then interrupted by bus protective relays. There is little indication to indicate this event could have occurred due to a seismic event unless potential sources of seismic related flooding are investigated.

The cause of the fault was overheating of the center bus bar at the flex connection. This overheating may have resulted from repeated deferrals of portions of the preventive No, unless Robinson Turbine 03/28/2010 2612010002 16.b maintenance tasks that deal with the inspection of the flexible Yes thermography 2 building link bolt torque over an eight-year period. Long term included degradation issues could potentially be exacerbated during seismic events.

Due to the extensive damage to the transformer bus duct, it was not possible to determine the definite cause of the bus fault. The most probable cause of the bus duct fault was loosening of the bus joint connector bolt due to relaxation of the torque at the connection joint caused by heating cycles.

As the bolt torque reduced, the looseness in the connection of the joint created a hot spot. The excess heat damaged the insulating components between the bus duct phases in the joint. The damage to the insulation increased until a fault occurred between the phases. The bus duct in question is No, unless River No public non-segregated and the bus phases are on top of each other Cooling 02/12/2011 16.a Yes thermography Bend reference only separated by the insulating components. Once the Tower included insulation between phases was damaged to the point that it could not separate 480 volts of potential, the degradation would have progressed rapidly.

Failure of a bus duct due to connection joint loosening and localized heating is a failure mode that can be seen in past external operating experience. Between the times that the connector bolt torque is checked, a yearly thermography PM is in place so connection joint localized heating can be caught before it becomes excessive. Long term degradation issues could potentially be exacerbated during seismic events.

73

Detectable Seismic LER/Event HEAF During Date Plant Root Cause / Discussion Implica- Room Notification Bina Visual tions?

Walkdown?

The most probable cause of the fault was a high resistance connection on the line side of the 1B4A cubicle. As seen in past seismic events, ground shake can damage or effect the No, unless Fort Switchgear 06/07/2011 2852011010 16.a alignment between the stabs in the cubicle and the breaker. Yes thermography Calhoun room This misalignment can affect the connection and included misalignment can make the connection worse which could aggravate the underlying deficiency which could lead to an arcing event.

The root cause of this event was FME in the form of a shield No, unless Palo wire which made contact with the A phase bus bar. FME Turbine 07/03/2013 EN-49169 16.b Yes enclosure Verde 1 effects or aggravation of FME during a ground shake event Building was opened could have led to an arcing event.

The root cause of this event was FME. FME effects or No, unless Turbine 07/26/2013 Callaway 4832013008 16.2 aggravation of FME during a ground shake event could have Yes busway was Building led to an arcing event. opened Yes, portions of the root cause could The most Probable Root Cause to the bus faults is improper be inspected installation of the 6900V flexible links inside the Turbine through visual Building which allowed degradation of the flex link walkdown connections. however it is Contrary to Tech Manual instructions, the bolting around the noted that Arkansas 'A' and 'B' phase flex links portions of Switchgear 12/09/2013 3682013004 16.1 Yes 2 contained little if any putty or Duxseal around the bolt heads. the necessary room Also, there was a layer of what appeared to be light grey inspections Scotch 70 Self Fusing Silicone Rubber Electrical Tape over would be the bolted joints and bolt heads. Long term degradation intrusive and issues could potentially be exacerbated during seismic not possible events. or recommende d during inspection Brunswick Switchgear 02/07/2016 3252016001 16.b Unknown Unknown Unknown 1 room 74

Detectable Seismic LER/Event HEAF During Date Plant Root Cause / Discussion Implica- Room Notification Bina Visual tions?

Walkdown?

Inspection The root cause of this event was corona tracking and Report potential long term degradation within the bus duct. Long 01/17/2017 Cooper 16.1 Yes No Switchyard 05000298/20 term degradation issues could potentially be exacerbated 17011 during seismic events.

The root cause of this event was FME. FME effects or No, unless Turkey Switchgear 03/18/2017 2502017001 16.b aggravation of FME during a ground shake event could have Yes enclosure Point 3 room led to an arcing event. was opened a

HEAF bins:

16.a Plant-Wide Components HEAF for low-voltage electrical cabinet (480-1000 V) 16.b Plant-Wide Components HEAF for medium-voltage electrical cabinet (>1000 V) 16.1 Plant-Wide Components HEAF for segmented bus duct 16.2 Plant-Wide Components HEAF for iso-phase bus duct 75

E.2 References

[1] NRC Information Notice 89-64, "Electrical Bus Bar Failures," September 7, 1989.

[2] IEEE Standard 142-1982, "Recommended Practice for Grounding of Industrial and Commercial Power Systems," 1982.

[3] IEEE, "The Reality of High Resistance Grounding," IEEE Transactions of Industry Applications, 1A-13, No. 5, pages 469-475, September/October 1977.

76

APPENDIX F - U.S. SEISMIC PRA PERSPECTIVES F.1 Results of Seismic PRAs Seismic events have long been recognized as potentially important contributors to nuclear power plant risk. Figure F.1 shows the CDF results reported by the 1982 utility-sponsored Indian Point Probabilistic Safety Study [1]; Figure F.2 shows the CDF results reported by the NRCs NUREG-1150 study in 1990 [2]. 36 These figures also illustrate the large uncertainties associated with the CDF estimates.

The understanding that seismic events can be important to risk has continued to today.

Figures F.3-F.4 provide various views on seismic CDF produced by industry analyses as part of:

a) the Individual Plant Examination of External Events (IPEEE) program of the late 1990s [3];

and b) more recent environmental impact statements supporting license renewal applications.

The latter require cost-benefit analyses of Severe Accident Mitigation Alternatives (SAMAs), and these generally employ the results of PRAs. The NRC staffs evaluation of the submittals are documented in plant-specific supplements to NUREG-1437 [4].

The most recent publicly available, industry-developed seismic PRA results are provided in industry responses to NRCs March 12, 2012 request for information associated with recommendation 2.1 of the Fukushima Near-Term Task Force (NTTF) [5]. These analyses show that for the plants performing detailed analysis, seismic events can be significant or even dominant contributors to total CDF. They can also be important contributors to large early release frequency (LERF). 37 Figures F.6 and F.7 how the seismic CDFs and conditional core damage probabilities (CCDP) vary with PGA at a number of plants. 38,39 Figures F.8 and F.9 present similar information for LERF. It can be seen that the recent analyses consider much higher PGAs than addressed in NUREG-1150. It can also be seen that there is considerable variation across plants. Even for the same plant (Peach Bottom), there are considerable differences between the NUREG-1150 and current analyses. Without more detailed investigation, we do not know to what degree the differences are due to fundamental changes in current state of knowledge (e.g., about Central-Eastern United States - CEUS - seismic hazard) versus different modeling choices. More investigation would also be needed to understand the underlying reasons for the different shapes shown for Diablo Canyon (a Western United States - WUS - plant) and for the CEUS plants.

36 The NUREG-1150 results shown are based on the EPRI hazard curves. Results based on hazard curves developed by Lawrence Livermore National Laboratory (LLNL) would indicate higher CDFs.

37 Note that the Oconee plant has committed to performing modifications to reduce the seismic contribution to LERF at all three units [6].

38 The data are from licensee submittals [7-13]. Results from NUREG-1150 are provided for comparison.

39 The CCDPs are the conditional probabilities of core damage, given a seismic event with the specified PGA.

77

F.2 Seismic PRA Maturity - Views Within Seismic PRA Community The large uncertainties shown in Figures F.1 and F.2 illustrate the more general point that seismic risk estimates are subject to large uncertainties, with much of the uncertainty being attributed to seismic hazard estimates for severe earthquakes [14]. Despite these large uncertainties, there seems to be little concern within the seismic PRA community regarding the maturity of seismic PRA as a tool for practical decision support. Ref. 15 provides a recent affirmation in this regard. 40 F.3 References

[1] B.J. Garrick, Accelerating implementation of contemporary nuclear safety assessment, Keynote Presentation, U.S.-Japan Probabilistic Risk Assessment Roundtable, Tokyo, Japan, February 20-21, 2014.

[2] U.S. Nuclear Regulatory Commission, Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, NUREG-1150, December 1990.

[3] U.S. Nuclear Regulatory Commission, Perspectives Gained from the Individual Plant Examination of External Events (IPEEE) Program, NUREG-1742, April 2002.

[4] U.S. Nuclear Regulatory Commission, Generic Environmental Impact Statement for License Renewal of Nuclear Plants, NUREG-1437, Rev. 1, June 2013.

[5] U.S. Nuclear Regulatory Commission, Request for Information Pursuant to 10 CFR 50.54(f) Regarding Recommendations 2.1, 2.3, and 9.3 of the NTTF Review of Insights from the Fukushima Daiichi Accident, March 12, 2012. (ML12053A340)

[6] U.S. Nuclear Regulatory Commission, Oconee Nuclear Station, Units 1, 2, and 3 - Staff Review of Seismic Probabilistic Risk Assessment Associated with Reevaluated Seismic Hazard Implementation of the Near-Term Task Force Recommendation 2.1: Seismic (EPID NO. L-2018-JLD-0173), November 29, 2019. (ML19267A022)

[7] Southern Nuclear, Vogtle Electric Generating Plant Units 1 and 2, Fukushima Near-Term Task Force Recommendation 2.1: Seismic, Seismic Probabilistic Risk Assessment, March 27, 2017. (ML17088A130)

[8] Tennessee Valley Authority, Seismic Probabilistic Risk Assessment for Watts Bar Nuclear Plant, Units 1 and 2 - Response to NRC Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(f) Regarding Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Daiichi Accident, June 30, 2017. (ML17181A485)

[9] Virginia Electric and Power Company, Virginia Electric and Power Company North Anna Power Station Units 1 and 2 Response to March 12, 2012 Information Request, Seismic Probabilistic Risk Assessment for Recommendation 2.1, March 28, 2018.

(ML18093A445)

[10] Tennessee Valley Authority, Tennessee Valley Authority (TVA) - Watts Bar Nuclear Plant Seismic Probabilistic Risk Assessment Supplemental Information, April 10, 2018.

(ML18100A966) 40 It should be recognized that there are also naysayers. See, for example, Ref. 16. However, such views seem to be in a small minority, at least within the seismic PRA community.

78

[11] Pacific Gas and Electric Company, Seismic Probabilistic Risk Assessment for the Diablo Canyon Power Plant, Units 1 and 2 - Response to NRC Request for Information Pursuant to 10 CFR 50.54(f) Regarding Recommendation 2.1: Seismic of the Near-Term Task Force Review of Insights from the Fukushima Dai-lchi Accident, April 24, 2018.

(ML18120A201)

[12] Exelon Corporation, Seismic Probabilistic Risk Assessment Report, Response to NRC Request for Information Pursuant to 1 O CFR 50.54(f) Regarding Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Daiichi Accident, August 28, 2018. (ML18240A065)

[13] South Carolina Electric and Gas Co., Virgil C. Summer Nuclear Station (VCSNS), Unit 1, Docket No. 50-395, Operating License No. Npf-12, Fukushima Near-Term Task Force Recommendation 2.1: Seismic, Seismic Probabilistic Risk Assessment, September 28, 2018. (ML18271A109)

[13] American Society for Mechanical Engineers and American Nuclear Society, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sb-2013, Addendum B to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, 2013.

[14] Seismic Probabilistic Risk Assessment Implementation Guide, Electric Power Research Institute, Palo Alto, CA, 2013: 3002000709.

[15] M.K. Ravindra, Alls Well in SPRA Land!, Pre-PSAM 14 workshop on Which way SPRA? Los Angeles, CA, 2018.

[16] F. Mulargia, P.B. Stark, R.J., Geller, Why is Probabilistic Seismic Hazard Analysis (PSHA) Still Used? Physics of the Earth and Planetary Interiors, 2016.0 doi:

http://dx.doi.org/10.1016/j.pepi.2016.12.002 Figure F.1. CDF Contributors - Indian Point Probabilistic Safety Study [1] 41 41 Some graphical elements have been enhanced for improved visibility.

79

Figure F.2. CDF Contributors - NUREG-1150 (based on [2])

Figure F.3. Seismic CDFs - IPEEE and SAMA Analyses Figure F.4. Seismic CDF Contribution - IPEEE and SAMA Analyses 80

Figure F.6. Seismic CDF by PGA - NUREG-1150 to NTTF 2.1 Figure F.7. Seismic CCDP by PGA - NUREG-1150 to NTTF 2.1 81

Figure F.8. Seismic LERF by PGA - NTTF 2.1 Figure F.9. Seismic CLERP by PGA - NTTF 2.1 82