ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
American Nuclear Society
Categorization of Nuclear Facility
Structures, Systems and Components
For Seismic Design
an American National Standard
published by the
American Nuclear Society
555 North Kensington Avenue
La Grange Park, Illinois 60525 USA
1
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
Foreword
(This foreword is not part of American National Standard Categorization of
Nuclear Facility Structures, Systems and Components for Seismic Design,
ANSI/ANS 2.26-2004.)
This standard has been developed based on methods used by the U.S. Department
of Energy (DOE) for performance categorizing and designing structures, systems
and components (SSCs) in nuclear facilities to withstand the effects of natural
phenomena (DOE-STD 1021-93, Natural Phenomena Hazards Performance
Categorization Guidelines for Structures, System, and Components, July 1993,
Reaffirmed 2002; DOE-STD-1020-2002, Natural Phenomena Hazards Design
and Evaluation Criteria for Department of Energy Facilities, January 2002;
DOE-STD-1022-94, Natural Phenomena Hazards Site Characterization Criteria,
March 1994, Reaffirmed 2002; DOE-STD-1023-95, Natural Phenomena
Assessment Criteria, May 1995, Reaffirmed 2002).
The standard provides criteria and guidance for selecting a seismic design
category (SDC) and Limit State for the SSCs with a safety function in a nuclear
facility, other than commercial power reactors whose seismic design requirements
are established by other standards and regulations. The SDC and Limit State are
to be used in conjunction with standards ANS 2.27, “Guidelines for Investigations
of Nuclear Facility Sites for Seismic Hazard Analysis”, ANS 2.29 “Probabilistic
Seismic Hazards Analysis”, and ASCE xxx, “Seismic Design Criteria for
Structures, Systems and Components in Nuclear Facilities”. These standards
together establish the design response spectra and the design and construction
practices to be applied to the SSCs in the facility, dependent on which SDC and
2
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
Limit State the is assigned to the SSC. The objective is to achieve a risk-informed
design that protects the public, the environment and workers from potential
consequences of earthquakes.
Application of this group of standards will
produce: (i) the design response spectra; (ii) SSC Limit State necessary to achieve
adequate safety performance during and following earthquakes; and (iii) SSC
designs that achieve the desired Limit State. The referenced standards and their
procedural relationship to this standard are discussed in Appendix A of this
standard.
Working Group ANS 2.26 of the Standards Committee of the American Nuclear Society had the
following membership at the time of approval of this standard and indeed was stable throughout
the development of the standard:
Neil W. Brown, Chair, Lawrence Livermore National Laboratory
Steve Additon, Rocky Flats Environmental Technology Site
Harish Chander, U.S. Department of Energy
Dan Guzy, U.S. Department of Energy
Asa Hadjian, Defense Nuclear Facilities Safety Board
Quazi Hossain, Lawrence Livermore National Laboratory
George B. Inch, Niagara Mohawk
Calvin Morrell, Stone a& Webster
Andrew Persinko, U.S. Nuclear Regulatory Commission
Howard C. Shaffer, Consultant
John Stevenson, Consultant
Charles M. Vaughan, Global Nuclear Fuel
3
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
The standard was processed and approved for submittal to ANSI by the Nuclear Facilities
Standards Committee (NSFC) of the American Nuclear Society on ANSI/ANS 2.26
Categorization of Nuclear Facilities Structures, Systems and Components for Seismic Design.
Committee approval of the standard does not necessarily imply that all members voted for
approval. At the time it approved this standard the NFSC had the following membership:
Donald Spellman, Chair, Oak Ridge National Laboratory
J. Thomas Luke, Vice-chair, Exelon Nuclear
C. K. Brown, Southern Nuclear Operating Company
R. H. Bryan,Jr., Tennessee Valley Authority
Harish Chander, Department of Energy
Joseph Cohen, Consultant
Michael T. Cross, Westinghouse Electric Corporation
Donald R. Eggett, AES Engineering
Rick A. Hill, GE Nuclear Energy
N. Prasad Kadambi, Nuclear Regulatory Commission
Jesse E. Love, Bechtel Power Corporation
James F. Mallay, Framatome ANP
Robert McFetridge, Westinghouse Electric Corporation
Charles H. Moseley, Jr., BWXT Y-12
W. N. Pillman, Framatome ANP
William B. Reuland, Electric Power Research Institute
Michael Ruby, Rochester Gas & Elecric Company
James Saldarini, Foster Wheeler Environmental Corporation
Robert E. Scott, Scott Enterprises
Steve L. Stamm, Stone & Webster, Inc.
John D, Stevenson, J. D. Stevenson Consultants
C. D. Thomas, Jr., Consultant
J. Andy Wehrenberg, Southern Company Services
George P. Wagner, Consultant
Michael J. Wright, Grand Gulf Nuclear Station
4
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
Contents
FOREWORD ...............................................................................................................................................................2
LIST OF ACRONYMS ...............................................................................................................................................6
1.
SCOPE ................................................................................................................................................................8
2.
DEFINITIONS ...................................................................................................................................................8
3.
APPLICABILITY ..............................................................................................................................................9
4.
DETERMINATION OF SSC SEISMIC CATEGORIES............................................................................. 10
4.1
INTRODUCTION ....................................................................................................................................... 10
4.2
CATEGORIZATION PROCESS .............................................................................................................. 10
4.2
RULES OF APPLICATION ..................................................................................................................... 11
5.
DETERMINATION OF LIMIT STATES ..................................................................................................... 13
6.
ANALYSES TO SUPPORT SELECTION OF SDC AND LIMIT STATES.............................................. 15
6.1
GENERAL REQUIREMENTS ................................................................................................................. 15
6.2
UNMITIGATED CONSEQUENCE ANALYSIS ..................................................................................... 15
6.3
DATA COMPILATION ............................................................................................................................. 18
APPENDIX A
RISK-INFORMED BASIS FOR SEISMIC DESIGN CATEGORIZATION AND
ASSOCIATED TARGET PERFORMANCE GOALS .......................................................................................... 22
APPENDIX B
EXAMPLES OF APPLICATION OF LIMIT STATES TO SSCS...................................... 30
APPENDIX C:
GUIDANCE ON A STRUCTURED APPROACH TO SUPPORT MAKING THE
JUDGMENTS REQUIRED IN SECTION 6.2 OF THIS STANDARD ............................................................... 35
REFERENCES .......................................................................................................................................................... 43
5
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
List of Acronyms
AEGL Acute Exposure Guideline Level
ANS
American Nuclear Society
ANSI
American National Standards Institute
ASCE American Society of Civil Engineers
ASME American Society of Mechanical Engineers
DBE
Design Basis Earthquake
DOE
Department of Energy
DRS
Design Response Spectra
ERPG Emergency Response Planning Guide
HEPA High Efficiency Particulate
HVAC Heating Ventilating and Air Conditioning
IBC
International Building Code
NRC
Nuclear Regulatory Commission
PSHA Probabilistic Seismic Hazard Analysis
SDB
Seismic Design Basis
SDC
Seismic Design Category
SSC
Structures, Systems and Components
TEDE Total Effective Dose Equivalent
6
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
USGS United States Geological Survey
UHRS Uniform Hazard Response Spectra
7
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
1. Scope
This standard provides: (i) criteria for selecting the Seismic Design Category1 (SDC) for nuclear
facility structures, systems, and components (SSCs) to achieve earthquake safety and (ii) criteria
and guidelines for selecting Limit States for these SSCs to govern their seismic design. The
Limit States are selected to ensure the desired safety performance in an earthquake
2. Definitions
Common Cause failure: Multiple failures of SSCs as the result of a single phenomenon.
Engineered Mitigating Feature: An SSC that is relied upon during and following an accident to
mitigate the consequences of releases of energy, radioactive or toxic material.
Failure Consequence: A measure of the radiological and toxicological consequences of exposure
to the public, the environment and workers that may result from failure of a SSC by itself or in
combination with other SSCs.
Graded Approach: The process of assuring that the level of analysis, documentation and actions
used to comply with requirements in this standard are commensurate with: (1) The relative
importance to safety, safeguards and security; (2) The magnitude of any hazard involved: (3) The
life cycle stage of the facility; (4) The programmatic mission of a facility; (5) The particular
characteristics of the facility; (6) The relative importance of the radiological and non-radiological
hazards; and (7) any other relevant factor.
Limit State: The limiting acceptable deformation, displacement or stress that an SSC may
experience during or following an earthquake and still perform its safety function. Four Limits
States are identified and used by this standard and ASCE xxx.
1
The Seismic Design Categories (SDCs) used in this standard are not the same as the SDCs referred to in the
International Building Code (IBC).
8
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
Seismic Design Category: One of five categories used in this standard and the accompanying
three standards identified in Appendix A that are used to establish seismic hazards evaluations
and SSC seismic design requirements.
Total Effective Dose Equivalent (TEDE): The sum of the deep-dose equivalent (for external
exposure) and the committed effective dose equivalent (for the internal exposure).
Target Performance Goal: Target annual frequency of an SSC exceeding its specified Limit
State. Target Performance Goals of 1x10-4, 4x10-5 and 1x10-5 per annum are used in ASCE xxx.
The importance of Target Performance Goals in this standard is discussed in Appendix A.
Unmitigated Consequences: The product of a specific type of consequence analysis used for the
selection of the Seismic Design Category for a SSC. Unmitigated Consequence Analysis is
described in Section 6.1.
3. Applicability
This standard is applicable to the design of SSCs of nuclear facilities. For purpose of this
standard a nuclear facility is a facility that stores, processes, tests, or fabricates radioactive
materials in such form and quantity that a nuclear risk to the workers, to the offsite public, or to
the environment may exist. These include but are not limited to nuclear fuel manufacturing
facilities; nuclear material waste processing, storage, fabrication, and reprocessing facilities;
enrichment facilities; tritium facilities; radioactive materials laboratories; and nuclear reactors
other than commercial power reactors. (Commercial power reactors are excluded because their
seismic design requirements are specified by other American Nuclear Society standards.)
The SSC seismic design categories that this standard establishes shall be used by the facility
owner and the facility designer, in conjunction with ANS 2.27, “Guidelines for Investigations of
Nuclear Facility Sites for Seismic Hazard Analysis”, ANS 2.29 “Probabilistic Seismic Hazards
Analysis”, and American Society of Civil Engineers standard ASCE xxx, “Seismic Design
Criteria for Structures, Systems and Components in Nuclear Facilities”.
9
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
4. Determination of SSC Seismic Categories
4.1
Introduction
SSCs that have been determined to have a safety function shall be assigned one of five SDCs. An
SSC shall be considered to perform a safety function if its failure, by itself or in combination
with other SSCs, could result in any of the consequence levels identified in Table 1 being
exceeded. Also, an SSC, the failure of which may impair or adversely effect an operator action
that is required for restoring another SSC safety function or for preventing or mitigating the
consequences of a design basis earthquake (DBE) during and following the event shall be
considered to have a safety function. The identification of SSCs with safety functions is the
product of the safety analyses required to support application of this standard. Section 6.outlines
the scope of the safety analysis required. The scope and comprehensiveness of the safety analysis
will vary with the complexity of the facility, operations and the contained hazard.
The assignment of a Seismic Design Category (SDC) to an SSC determined to have a safety
function is based on the objective of achieving acceptable risk to the public, the environment and
workers resulting from the consequences of failure of the SSC (See Appendix A for additional
discussion). Each SDC has a defined consequence severity level that shall not be exceeded.
Proper assignment of SDCs to the SSCs and constructing2 the SSCs in accordance with the IBC
or ASCE xxx as required will provide an acceptably low risk to the public, the environment and
workers from seismic induced SSC failures.
4.2
Categorization Process
(a)
An SDC shall be assigned one of the SSCs listed in Table 1 based on the unmitigated
consequences that may result from the failure of the SSC by itself or in combination with
other SSCs. If the SSC failure consequences are equal to or less than the guidance listed
in Table 1 for a given SDC, the SSC shall be placed in that SDC. The consequences shall
be equal to or less for all three types of consequences listed in the table, i.e.,
“Constructing” includes design, fabrication, erection, excavation, material selection, material qualification
inspection, testing, administrative control, documentation, and quality assurance.
2
10
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
consequences to the public, the environment and workers, and the SSC shall be placed
highest SDC determined under by the consequence type. Section 6 provides guidance on
performing unmitigated consequence evaluations.
(b)
SDC 1 and 2 in conjunction with the IBC and SDC 3 through 5 in conjunction with ANS
2.27, ANS 2.29 and ASCE xxx establish the Design Response Spectra (DRS) and SSC
design and analysis requirements. For SDC-3, 4 and 5 the DRS are specified as the
product of the of the Uniform Hazard Response Spectra (UHRS) obtained using ANS
2.27 and ANS 2.29, and a design factor specified in ASCE xxx. The DRS for SDC-1 and
SDC-2 are specified in the IBC.
(c)
Based on the information or data obtained from the safety analyses outlined in Section 6
and the guidance provided here, SSCs assigned SDC-3, SDC-4 or SDC-5 shall also be
assigned one of four Limit States identified in Section 5. Appendix B provides examples
of how this determination may be made. The set of requirements identified by the SDC
and Limit State are called Seismic Design Basis (SDB) used by ASCE xxx. No Limit
State identification is required for SDC-1 and SDC-2 whose design requirements are
identified in the IBC.
4.2
Rules of Application
(a) SSCs assigned SDC-1 with Limit States A, B, and C shall be designed to the IBC
Seismic Use Group (SG I, SGII and SG III, respectively) as recommended in ASCE xxx.
(b) SSCs assigned SDC 2 with Limit States A and B shall be designed to the IBC Seismic
Use Group (SG II, and SG III, respectively) as recommended in ASCE xxx.
(c) SSCs assigned SDC-3, SDC-4, and SDC-5 shall be designed to the requirements of
ASCE xxx and ANS 2.29.
11
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
(d) SSCs in a facility with a human occupancy rate of more than 72 person hours per 24 hour period shall be placed, as a minimum, in SDC-1. SSC failures that result in no
consequence to the public or environment and present only a physical threat to the
workers and therefore placed in SDC-1, shall be designed to the IBC using Group I.
Table 1
Seismic Design Categories Based on the Unmitigated Consequences of SSC Failure
Category
SDC-1
Unmitigated Consequence of SSC Failure
Worker
Public
Environment
No Radiological/toxicological release
consequences but failure of SSCs
may place facility workers at risk of
physical injury.
No Radiological/toxicological
release consequences.
No radiological or chemical
release consequences.
SDC-2
Radiological/toxicological exposures
to workers will have no permanent
health effects, will place more facility
workers at risk of physical injury, or
place emergency facility operations at
risk.
Radiological/toxicological
exposures of public areas are
small enough to require no
public warnings concerning
health effects.
No radiological or chemical
release consequences.
SDC-3
Radiological/toxicological releases
that may place facility workers longterm health in question.
Radiological/toxicological
exposures may require off-site
emergency preparedness plans
to be established to protect the
public.
No long term environmental
consequences are expected but
environmental monitoring may
be required for a period of time.
SDC-4
Radiological/toxicological effects that
may cause long-term health problems
and possible loss of life for a worker
in proximity of the source of
hazardous material, or place workers
in nearby on-site facilities at risk.
Radiological /toxicological
effects that may cause longterm health problems to an
individual at the exclusion
area boundary for 2 hours or
more.
Environmental monitoring
required and potential
temporary exclusion from
selected areas for contamination
removal.
SDC-5
Radiological/toxicological effects that
may cause loss of life of workers in
the facility.
Radiological/toxicological
effects that may possibly
cause loss of life to an
individual at the exclusion
area boundary for an
exposure of 2 hours or more.
Environmental monitoring
required and potentially
permanent exclusion from
selected areas of contamination.
12
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
5. Determination of Limit States
Limit State A: An SSC designed to this Limit State may sustain large permanent distortion short
of collapse and instability (i.e., uncontrolled deformation under minimal incremental load), but
shall still perform its safety function and not impact the safety performance of other SSCs.
Examples of SSCs that may be designed to this Limit State are:

Building structure that must function to permit occupants escape to safety
following and earthquake.

Systems and components designed to be pressure retaining but may perform their
safety function even after developing some significant leaks following an
earthquake.
Limit State B: An SSC designed to this Limit State may sustain moderate permanent distortion
but shall still perform its safety function. The safety function may include both structural and
leak tight integrity of an SSC designed to retain fluids under pressure.
Examples of SSC that may be designed to this Limit State are:

Building structures that that are required to perform a passive system or
component support functions.

Systems and components designed to be pressure retaining but may perform their
safety function even after developing some minor leaks following an earthquake
(i.e. they either do not contain hazardous material or the leakage rates associated
with minor leaks do not exceed consequence level of assigned SDC).
Limit State C: An SSC designed to this Limit State may sustain minor permanent distortion but
shall still perform its safety function. An SSC, that is expected to undergo minimal damage
during and following an earthquake such that no post-earthquake repair is necessary, may be
assigned this Limit State. An SSC in this Limit State may perform its confinement function for
liquids during and following an earthquake.
Examples of SSCs that may be designed to this Limit State are:
13
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004

glove boxes containing hazardous material;

other confinement barriers for radioactive or toxic materials;

HVAC systems that service equipment or building space containing hazardous
material.

Active components that may have to move or change state following the earthquake.
Limit State D: An SSC designed to this Limit State shall maintain its elastic behavior. An SSC
in this Limit State shall perform its safety function during and following an earthquake. Gaseous,
particulate and liquid confinement by SSCs is maintained. The component sustains essentially no
damage.
Examples of SSCs that may be designed to this Limit State are:

containments for large inventories of radioactive or toxic materials;

components that are designed to prevent accidental nuclear criticality;

safety functions that may be impaired due to permanent deformation (e.g., valve
operators, control rod drives, HEPA filter housings, turbine or pump shafts, etc.).

safety functions that require the SSC to remain elastic or rigid so that it retains its
original strength and stiffness during and following a design basis earthquake to
satisfy its safety, mission, or operational requirements (e.g., relays, switches, valve
operators, control rod drives, HEPA filter housings, turbine or pump, etc.).
The combination of Seismic Design Category ( 3, 4, or 5 only) and Limit State (A, B, C, or D)
that determines the Design Basis Earthquake and acceptance criteria for designing the SSCs in
accordance with ASCE xxx. For example, Seismic Design Basis 3C uses criteria given in this
Standard for Seismic Design Category 3 and Limit State C.
14
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
6. Analyses to Support Selection of SDC and Limit States
6.1 General Requirements
(a) Following determination of the regulatory requirements applicable to the project or to the
facility a safety analysis or integrated safety assessment shall be performed using the
requirements and guidelines provided in this standard and other applicable standards such as [9].
In the context of this standard, the safety analyses shall provide the basis for assigning an SSC to
one of the SDCs and selecting its Limit State. The scope and comprehensiveness of the safety
analysis will vary with the complexity of the facility, operations and the contained hazard.
Facilities containing SSCs assigned SDC-1 or SDC-2 only should have less extensive safety
analyses requirements. The safety analysis shall include the unmitigated consequences associated
with failure of the SSC being categorized and described in Section 6.2. Qualitative and
quantitative values of the critical design parameter(s) at which the SSC safety function fails shall
be identified, along with the unmitigated radiological, toxicological and environmental
consequences of the failure. The unmitigated consequence analysis is essential to this standard.
(b) The analyses necessary to support identification of SSC that will be assigned SDCs 3, 4, and
5 should be more substantive than that needed for SSCs assigned SDC-1 and SDC-2. The level
of peer and regulatory review of the analysis, judgments and decisions concerning categorization
may also be more substantive for SSCs assigned SDC-3, SDC-4 and SDC-5.
(c) To achieve the objectives of this standard, the safety analyses shall quantify and consider the
uncertainties with determining failure and the consequences of failure. The depth and
documentation of the uncertainty analyses should be sufficient to support the judgment that
categorization based on Table 1 and the design requirements in ASCE xxx produces a facility
that is safe from earthquakes.
6.2 Unmitigated Consequence Analysis
(a) An unmitigated consequences analysis of the hazards in a facility and the function of the
items relied on for safety shall be completed to support SSC seismic categorization. The basic
15
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
data and analysis identified in section 6.3 shall be used to support the unmitigated consequence
analysis. The unmitigated consequence analysis shall be performed considering only the inherent
physical or chemical characteristics of the hazardous material and the energy sources for
dispersing the material [8, 9].
(b) The SSC being evaluated shall have one or more safety functions identified by the facility
safety analysis required in Section 6.1 and related to preventing accidents, such as nuclear
criticality, or mitigating the consequences from accidental release of a specified inventory of
hazardous material.
(c) The SSC and all other relevant engineered mitigating features shall be assumed not to
function unless the robustness of each mitigating feature can be clearly demonstrated to service
the postulated event. Redundancy may also be used as a mitigating feature providing the
independence of redundant features shall be clearly demonstrated, such that there is a very low
probability of an earthquake caused common cause failure.
(d) ANS 5.10, “Airborne Release Fractions at Nonreactor Nuclear Facilities” [10] provides
guidance concerning mechanisms for release of the hazardous material into the air or water and
shall be used to support similar calculations required by this standard.
(e) Consistent with risk-informed process for selecting the earthquake level, the unmitigated
consequence analysis should strive to use mean values for the parameters related to material
release, dispersal, and health consequences. In many instances the data available to support these
analyses are not prototypic of the situation being analyzed, or there is large and poorly
characterized uncertainty. Hence, judgment must be used to select a mean value for the
parameter of concern. The desire to use mean values is not intended to demand many data points
and statistical computation of the mean. It is intended that the parameters used in the evaluation
be judged to be the most likely to occur given the physical and chemical conditions involved
with the failure. These judgments should be made on the basis that they may be reviewed and
found acceptable by a regulator or the public. One should be especially aware of this when
16
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
applying the guidance in Table A-3. Supplementary regulatory guidance may need to be
considered.
(f) The computed dose consequences shall be the total effective dose equivalent (TEDE), and the
dose to the public shall be based on the maximally exposed individual off-site. The air and water
transport mechanisms should be modeled using mean values for model parameters and
associated uncertainties estimated.
(g) The unmitigated consequence of an SSC’s failure by itself may not lead to an unacceptable
release of hazardous material (i.e. requiring the SSC to be assigned to SDC 3, 4, or 5). If the
SSC’s failure in conjunction with other failures results in an unacceptable release of hazardous
material then it shall be placed in SDC 3, 4 or 5. For example, failure of a relay required to start
an emergency air cleaning system may not lead to an unmitigated release unless there is a
coincident failure of other SSCs that results in release of hazardous material to the space serviced
by the air cleaning system. In this case it may be necessary to place the relay in SDC-3, 4 or 5
depending on the unmitigated consequences.
(h) When assigning SDCs in cases of common cause failure of redundant SSCs, it will be
necessary to exercise judgment about the relative contribution that each SSC’s postulated to
failure makes to the unmitigated release.
(i) In some instances it may be possible to justify an SSC as having not failed when evaluating
another SSC. In general, this is discouraged as a complicating factor that may be difficult to
support. In these cases the SSC being assumed to have not failed should be at least one SDC
higher than the SSC being evaluated. Section 6.4 and 6.7 respectively discuss the bases for using
the characteristic of redundancy and “robustness” to support such a judgment.
(j) The information database and unmitigated consequence analysis must be comprehensive
enough to support discrimination between the qualitative criteria in Table 1. Both the analysis
and the assignment of SSCs to SDCs are likely to be simpler and more obvious for the low
consequence categories. Supporting decisions between SDC-3 and SDC-4, and between SDC-4
and SDC-5 may be expected to be more difficult. The quantitative guidelines discussed in
17
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
Appendix A may be used to guide the decision process related to the more difficult decisions on
assigning an SDC to an SSC.
6.3 Data Compilation
(a) Facility Review
A systematic review of the facility’s mission, usage, process, operation, and its inventory of
radioactive and chemically hazardous materials shall be performed to obtain the following
minimum data/information necessary for determining the SDC and Limit States:

Quantity, type (e.g., radioactive, chemical, biological, etc,), and nature (gaseous, liquid,
powder, solid, etc.) of the hazardous material inventory.

Normal and emergency (if any) functions of the SSC during a seismic and other design
basis events.

Number of workers in the facility and at the site who may be adversely affected during or
following an earthquake and its consequences.

Proximity of the site boundary from the facility and proximity of population centers from
the site.

Regulatory and Project requirements and commitments regarding safety.

Design specifications for the SSCs, including applicable industry codes and standards.
These may vary in level of detail depending on the status of design (conceptual,
preliminary or final), but the seismic classification should be included at each stage of
design commensurate with the level of detail available at each stage..
(b) Facilities with SSCs assigned SDC-3, SDC-4 and SDC-5
The safety analyses required in Section 6.1 shall be performed based on the following principles,
concepts, and considerations:

The principle of defense-in-depth
18
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004

Redundancy considerations

Common-Cause Failure considerations

System Interaction considerations

Robustness considerations
These are described as follows:
(1) Defense-in-depth
Defense-in-depth is a safety philosophy in which a system or a facility is designed with layers of
defense against adverse SSC failure consequences such that no one layer by itself, no matter how
robustly designed, is solely relied upon either to prevent the failure or to mitigate the
consequences. For nuclear facilities, compliance with defense-in-depth philosophy typically
requires: (i) safety consideration in site selection; (ii) minimization of material at risk; (iii)
conservative design margins and a formal quality assurance program; (iv) successive physical
barriers and/or administrative controls for protection against radioactivity releases to the
environment and significant public exposure to radioactivity; (v) provision of multiple means to
ensure the safety functions needed to control the processes and to maintain them in a safe state;
(vi)equipment and administrative controls restricting deviations from normal operations and
providing for recovery from accidents; (vii) means to monitor accidental releases; and (viii)
emergency plans for minimizing the effects of an accident.
(2) Redundancy
In the context of safety analysis, redundancy refers either to the redundancy of an SSC or to the
redundancy of a particular SSC safety function. An SSC is said to be redundant when it is one of
two or more SSCs in the facility that have similar configuration and perform identical functions
and only one SSC must function. An SSC function is redundant if another SSC is available to
perform the same function or an administrative measure or control may be put in place that may
substitute for the SSC function with the same or higher degree of assurance. Redundancy may be
introduced either as an element of “defense-in-depth” philosophy (see Section 6.4) to provide
19
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
multi-layered protection against adverse effects of the DBE or as a design feature to support
meeting the desired failure probability. The treatment of redundant SSCs provided from
Defense-in-depth considerations has been addressed above in Section 6.4. For the later case,
when redundancy is introduced as a design feature to achieve the desired failure probability the
additive effect of the mitigating functions of all redundant SSCs may be considered. However,
the possibility and effects of common-cause failure (see Section 6.6, below) of redundant SSCs
shall also be considered in seismic safety analysis.
(3) Common-Cause Failure
The failure of multiple SSCs as a result of a given postulated event is called common-cause
failure. This phenomenon of exceeding a given criterion due to a common-cause failure shall be
considered in performing the facility seismic safety analysis. However, the SSC seismic
categorization described in Sections 4 above shall be performed assuming common-cause failure
has occurred unless an SSC(s) qualifies as robust or incorporates redundancy with low
probability of common cause failure during the earthquake under the guidance provided in
Sections 6.2, 6.3(b)(3) and 6.3(b)(5)
(4) System Interaction
In some instances an SSC may not perform a safety function by itself, but its failure may
adversely affect the safety function of another SSC. This phenomenon, commonly referred to as
system interaction or “two-over-one phenomenon”, shall be considered in the facility safety
analyses and SSC seismic categorization. Earthquake caused fire, flooding and impact from
movement or collapse of nearby objects are recognized sources for producing these potential
failure sequences. System interaction considerations shall also include the adverse effects of
failure of a lower category (SDC or Limit State) SSC (i.e., the Source SSC) on the safety
function of a higher category SSC (i.e., the Target SSC). The Target SSC is to withstand the
imposed loading.
System interaction effects may be addressed in one of the following four ways:
20
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004

By upgrading the non-safety or lower SDC or Limit State SSC ( i.e., the Source SSC) to
the extent necessary to preclude its adverse interaction with the affected or Target SSC.

By placing the source SSC in the same SDC or higher, and by modifying its Limit State,
if necessary, so that no interaction with the Target SSC occurs.

By configuring the facility layout or SSC design to preclude adverse interaction between
the Source and the Target. Examples of such modifications are: creating sufficient
physical separation, installing barriers, adding automatic control systems, etc.

By designing the Target SSC to withstand the imposed interaction load.
(5) Robustness
As discussed in Section 6.2(i), for an SSC’s mitigating effects to be considered in the
unmitigated accident consequence analysis the SSC must be identified as robust and be given
special attention in its construction. Assured margins shall be provided, typically at limit state C
or D levels, in its seismic capability. When evaluating SSCs for placement in SDC-3 or SDC-4 it
may be permissible to take credit for the consequence mitigation benefit of another SSC in SDC5. For this application to be acceptable, it must be shown that the SSC has substantial seismic
margin to failure modes that may cause interaction with the SSC being evaluated. In this special
case, substantial seismic margin is a judgment that must be supported by design and by the
attention given to the SSC throughout its entire life cycle (design, procurement, construction,
operation and maintenance). An example of this situation is a building that is designed with a
containment function at SDC-5 that contains glove boxes whose unmitigated failure may cause
them to be placed in SDC-5. If it is demonstrated that the building has substantial seismic margin
against collapse that may cause glove box failures, then it may be acceptable to take credit for
the building mitigation of releases from glove boxes to support placement of the glove boxes into
a lower level SDC (i.e. SDC-3 or SDC-4).
21
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
Appendix A Risk-informed Basis for Seismic Design Categorization and Associated
Target Performance Goals
The objective of ANS 2.26, in conjunction with its three accompanying standards, ANS2.27,
ANS 2.29 and ASCE xxx, [5, 6, 7] is to produce a consistent risk-informed design of a nuclear
facility that protects the public, the environment and workers from the effects of earthquakes.
This Appendix discusses the rational for the requirements in this standard and the interface
between this standard and the accompanying standards. Key parameters in the procedure are the
unmitigated consequence levels used to assign SSCs to SDCs and the Target Performance Goals
used in ASCE xxx to establish design criteria. This appendix discusses first the basis for the
Target Performance Goals and then the basis for the consequence levels in Table 1 of this
standard. Although the standard has a risk-informed basis and some applications may benefit
from completing a seismic risk assessment, there is generally no need to apply ANS 58.21,
“External-Events PRA Methodology”.
Figure A-1 shows the interfaces between this standard and the three accompanying standards and
their procedural relationship. All four standards are needed to design facilities that contain SSCs
in SDC 3, 4,and 5. Iterative interactions during application of the standards that are not
illustrated in Figure A-1 should be anticipated.
22
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
ANS 2.26 provides criteria for
selecting a Seismic Design
Category (SDC) for the SSCs
in a nuclear facility and
provides guidance for
selecting the Limit States for
the SSC. It also identifies
Target Performance Goals for
SDC-3, 4 and 5 that are used
in developing ASCE xxx
design provisions
ASCE xxx specifies seismic
design criteria and analysis
methods for SDC-3, 4 and 5,
and identifies the use of IBC
for SDC-1and SDC-2. It also
establishes design criteria and
deformations limits
corresponding to the Limit
States identified in ANS 2.26.
ANS 2.29 specifies For SDC3, 4 and 5 how to develop the
site-specific seismic hazard
curve and the uniform hazard
response spectra that are used
in ASCE xxx for developing
the design basis seismic
response spectra for SDC-3,
SDC-4 and SDC-5.
ANS 2.27 provides guidance for
the geotechnical investigation
necessary to provide information
to support development of the
site- specific seismic hazard
curve and uniform hazard
response spectra.
Information flow when applying the standards
Figure A-1
Schematic Showing the Relationships of the Seismic Standards
23
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
Considerable progress has been made over the past 20 years towards the development of
probabilistic based seismic design criteria and methods that achieve approximately a riskinformed seismic design. Experience gained from seismic design and probabilistic seismic risk
assessments of nuclear power plants and other high hazard nuclear facilities has been a major
contributor to this progress. That experience was used to develop a probabilistic performance
goal based design method to protect against natural phenomena hazards (NPH) described in four
DOE technical standards [1, 2, 3, 4]. The DOE standards are intended to achieve approximately a
consistent risk-informed design [11]. The introduction of Seismic Use Groups in the IBC also
indicates industry’s direction towards risk-informed and graded methods of seismic design.
These DOE standards and the IBC provide much of the basis for the risk-informed and graded
method of seismic design that this standard and its accompanying standards intend to achieve.
A risk-informed design method has an objective of achieving an acceptable and balanced risk to
the workers and public over a wide range of hazardous facilities and operations. This is achieved
by applying increasingly stringent seismic design requirements commensurate with the severity
of consequences from SSC failure. A key part of the method is the use of quantitative Target
Performance Goals that correspond to an estimate of the mean probability of failure of the SSC
to perform its safety function. These probabilistic goals are used to support selecting the return
period for the DBE or the probability of exceeding the DBE and to develop a rational gradation
in the design criteria and methods in ASCE xxx. They are based on extensive experience in
seismic design and results from seismic risk assessments of commercial nuclear power plants.
However, there is no requirement to perform a probabilistic risk assessment in order to apply
these standards.
The SSC Target Performance Goals are given in Table A-1. These goals and the SSC failure
consequence criteria in Table 1 of this standard have been selected to support development of
seismic design loads and SSC design criteria that will protect the public, environment and the
worker from hazards resulting from damages that might occur in nuclear facilities during
24
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
earthquakes. The Target Performance Goals are used in ASCE xxx to establish the design criteria
as a function of the SDC level for SDC-3, 4 and 5. The mean seismic failure probability of
building structures designed to the IBC is estimated to be less than 1x10-3 per year. The design
requirements in ASCE xxx for SDC-3 through SDC-5 have been selected to be more demanding
than the building codes. The objective is for SSCs designed to SDC-3 criteria to have the
probability of failing to perform their safety function be less than 1x10-4 per year. It has been
judged that avoiding SDC-3 unmitigated consequences, at this probability, achieves
approximately a balanced risk relative to the other SDC levels.
Seismic probabilistic risk
assessments of a large number of commercial nuclear power plants in the United States indicate
that the mean seismic core damage frequency in nuclear power plants is about 1x10-5 per year
[12]. Although unmitigated consequences of SSC failures in the facilities addressed by this
standard are expected to be much less than those in nuclear power plants, the unmitigated
consequences in category SDC-5 are severe enough that it is reasonable for SSCs placed in this
category to have a Target Performance Goal of 1x10-5 per year. The log-linear uniform mid-point
between 1x10-4 per year and 1x10-5 per year is 3.16 x10-5 per year and could have been selected
as the Target Performance Goal for SDC-4. However, a value of 4 x10-5 per year was selected in
recognition of the approximate nature of the Target Performance Goals and to achieve some
simplification in the ASCE-xxx design methods.
Table A-1
Target Performance Goals used in ASCE-xxx
Seismic Design Category
Target Performance Goals
SDC-3
-4
10 /year
SDC-4
-5
4x10 /year
SDC-5
-5
10 /year
25
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
Seismic risk assessments of facilities with SSCs designed using the methods in Reference 2
(similar to those specified in ASCE xxx) for earthquake levels associated with earthquakes
having a 10,000 year mean return period (mean frequency of 1x10-4 per year) support that SSCs
designed to the most stringent level are expected to perform their safety functions at the SDC-5
Target Performance Goal. The design methods in ASCE xxx have been graded so that at an
earthquake frequency of 4x10-4 per year (mean) SSCs designed for SDC 3 and SDC 4 are
expected to achieve the Target Performance Goals identified in Table A-1.
For nuclear facilities that contain small or no hazardous inventory the risks are dominated by
damage to the facility and occupants and it is appropriate to apply the IBC design methods.
Table A-2 summarizes the design basis earthquake frequencies and referenced methods for
developing the design response spectra.
The other key factor in the procedure is the assignment of an SDC to an SSC based on the
consequences of the unmitigated failure of the SSC. Unmitigated consequence analysis is a
procedure that has been used by the Department of Energy for the purpose of incorporating
safety in design and operation of their nuclear facilities [8, 9]. The concept is also used in
10CFR70, the U.S Nuclear Regulatory Commission’s regulation that applies to fuel cycle
facilities [13] and the associated Standard Review Plan (NUREG 1520[14]). In the latter case the
SSCs or procedural practices are addressed individually and their importance to reducing the
likelihood of unmitigated consequences evaluated. The qualitative criteria in Table 1 for
26
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
Table A-2
Design Basis Earthquake Used with Design Methods in ASCE xxx
Category
Frequency of Design Basis Earthquake
SDC-1
U.S. Geological Service (USGS) 2500 year return period
map and the IBC
SDC-2
USGS 2500 year return period map and the IBC
SDC-3
Use ANS 2.29 and select Uniform Hazard Response
Spectrum(UHRS) at 4x10-4 per year (mean), per ASCE
xxx
SDC-4
Use ANS 2.29 and select UHRS at 4x10-4 per year
(mean), per ASCE xxx
SDC-5
Use ANS 2.29 and select UHRS at 10-4 per year (mean),
per ASCE xxx
unmitigated consequence analysis were selected based on experience in accident analysis and
criteria developed for NRC regulation of nuclear facilities. The criteria in 10CFR70 for guiding
license applications for Special Nuclear Material were also used to develop Table 1. Quantitative
consequence values very similar to the NRC guidance and consistent with the qualitative criteria
in Table 1 are provided in Table A-3 for SDC –3, SDC-4 and SDC-5.3 These values combined
with the Target Performance Goals were used to judge the balance in risk over the range of
design categories and may also be used to support making judgments concerning SSC
categorization.
These consequence values should not be considered as mandatory requirements but may be used
judiciously as guidelines for assigning SDC to an SSC. Many analytical steps and assumptions
must be completed to obtain the numerical dose consequence values and the analyses frequently
3
The NRC consequences values and associated target performance goal that correspond to SDC 4 are more
conservative than the values used in this standard.
27
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
have a high degree of uncertainty. Selecting quantitative consequence thresholds for the SDC
categories implies a precision in the accident consequence analysis that is not warranted. The
qualitative criteria in this standard are intended to encourage the use of experienced judgment in
making assignment of the SDCs to SSCs, with quantitative accident consequence analysis
providing guidance.
Table A-3
Guidance for Seismic Design Categories
Based on Unmitigated Consequences of SSC Failures
Category
SDC-1
Unmitigated Consequence of SSC Failure
Worker
Public
No radiological or chemical release
consequences but failure of SSCs may
place facility workers at risk of physical
injury.
No consequences
SDC-2
Lesser radiological or chemical
exposures to workers than those in
SDC-3 below in this column as well as
placing more workers at risk. This
corresponds to the criterion in Table 1
that workers will experience no
permanent health effects.
Lesser radiological and chemical
exposures to the public than those
in SDC-3 below in this column,
supporting that there are
essentially no off-site
consequences as stated in Table 1.
SDC-3
.25 Sv (25rem) < dose <1 Sv (100rem)
AEGL2, ERPG2 <concentration
<AEGL3, ERPG3. Concentrations may
place emergency facility operations at
risk, or place several hundred workers
at risk.
0.05 Sv (5rem) < dose <0.25 Sv
(25rem)
AEGL2, ERPG2 <concentration <
AEGL3, ERPG 3
SDC-4
1Sv (100rem) <dose < 5Sv (500rem)
concentration >AEGL3, ERPG3.
0.25 Sv (25 rem) <dose<1Sv
(100rem), > 300mg sol U intake,
concentration >AEGL3, ERPG3
SDC-5
Radiological or toxicological effects
may be likely to cause loss of facility
worker life.
1Sv (100rem)< dose,
concentration >AEGL3, ERPG3
28
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
As stated in Section 6.1 the consequence analysis should strive to obtain the most likely
environmental and health consequences, consistent with the risk-informed objective and the
approach for developing the seismic loads and conservatism in the design methods. This does not
mean that every parameter must be supported with a statistical calculation of the mean value.
Many of the parameters must be based on experience that is characteristic of the physical
and chemical environment involved in the failure scenarios postulated. These judgments will be
reviewed by regulatory organizations and because of this there will be conservatism introduced.
It is desirable to reduce any tendency toward over conservatism in order to achieve the risk
informed balance in the design of the SSCs.
29
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
Appendix B
Examples of Application of Limit States to SSCs
This appendix provides guidance for proper selection of a Limit State through use of examples.
The examples should not be interpreted as requirements. The selection of the Limit State should
be based on the specific safety analysis and the safety function of the SSC.
SSC Type
Generic
Building
Structural
Components
Limit State A
Limit State B
Limit State C
Limit State D
Refer to Section 5 for the definitions of the four limit states addressed in this table.
.
Substantial loss of SSC
stiffness and some strength
loss may occur, but
retaining some margin
against collapse so that
egress is not impaired;
building needs major
repair, and may not be safe
for occupancy until
repaired.
Some loss of SSC
stiffness and strength may
occur, but SSC retains
substantial margin against
collapse; building may
need some repair for
operations and occupancy
to continue.
30
The SSC retains
nearly full stiffness
and retains full
strength, and the
passive equipment
it is supporting will
perform its normal
and safety
functions during
and following an
earthquake.
SSC damage is
negligible; structure
retains full strength,
and stiffness
capacities; building is
safe to occupy and
retains normal
function.
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
SSC Type
Structures or
Vessels for
Containing
Hazardous
Material
Confinement
Barriers and
Systems
Containing
Hazardous
Material (eg.
Glove Boxes,
building
rooms, and
ducts )
Limit State A
Limit State B
Limit State C
Limit State D
Applicable to vessels
and tanks that contain
material that is either not
very hazardous or
leakage is contained or
confined by another SSC
to a local area with no
immediate impact to the
worker. Recovery from a
spill may be completed
with little risk but the
vessel is not likely to be
repairable. Most likely
applicable to vessels
containing low hazard
solids or liquids.
Applicable to vessels
and tanks whose
contents if released
slowly over time
through small cracks
will be either be
contained by another
SSC or acceptably
dispersed with no
consequence to worker,
public or environment.
Cleanup and repair may
be completed
expediently. Most
likely applicable to
moderate hazard liquids
or solids or low hazard
low pressure gases.
Applicable to low
pressure vessels and
tanks with contents
sufficiently hazardous
that release may
potentially injure
workers. Damage will
be sufficiently minor to
usually not require
repair.
Content and location
of item is such that
even the smallest
amount of leakage is
sufficiently
hazardous to workers
or the public that leak
tightness must be
assured. Most likely
applicable to
moderate and highly
hazardous
pressurized gases but
may be required for
high hazard liquids.
Post EQ recovery is
assured.
Barriers could be
designed to this Limit
State if exhaust
equipment is capable of
maintaining negative
pressures with many
small cracks in barriers
and is also designed to
Limit State D for long
term loads. Safety
related electrical power
instrumentation and
control if required must
also be assured
including the loss of
off-site power.
Localized impact and
impulse loads may be
considered in this limit
State.
Barriers could be
designed to this Limit
State if exhaust
equipment is capable of
maintaining negative
pressure with few small
cracks in barriers and is
also designed to Limit
State D for long -term
loads. Safety related
electrical power
instrumentation and
control if required must
also be assured
including the loss of
off-site power.
Adequate confinement
without exhaust
equipment may be
demonstrable for some
for some hazardous
materials.
Systems with barriers
designed to this Limit
State may not require
active exhaust
depending on the
contained hazardous
inventory and the
potential for
development of
positive pressure.
Safety related
electrical power
instrumentation and
control if required
must also be assured
including the loss of
off-site power..
No SSC of this type
should be designed to
this Limit State.
31
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
SSC Type
Equipment
support
structures,
including
support
structures for
pressure vessels
and piping, fire
suppression
systems, cable
trays, HVAC
ducts, battery
racks, etc.)
Mechanical or
Electrical SSCs
Limit StateA
Limit State B
Limit StateC
Limit StateD
The SSC may
undergo substantial
loss of stiffness and
some loss of
strength, and yet the
equipment it is
supporting may
perform its safety
functions (normal
function may be
impaired) following
exposure to
specified seismic
loads; the SSC
retains some margin
against such failures
that may cause
systems interactions.
The SSC may
undergo some loss of
stiffness and strength,
and yet the
equipment it is
supporting may
perform its safety
functions (normal
function may be
impaired) following
exposure to specified
seismic loads; the
SSC retains
substantial margin
against such failures
that cause systems
interactions.
The SSC retains
nearly full stiffness
and retains full
strength, and the
passive equipment it
is supporting may
perform its normal
and safety functions
during and
following exposure
to specified seismic
loads.
No SSC of this type
should be designed
to this Limit State.
The SSC must
maintain its
structural integrity.
It may undergo large
permanent distortion
and yet perform its
safety functions; no
assurance that the
SSC will retain its
normal function or
will remain
repairable.
The SSC must remain
anchored and if
The SSC must
remain anchored
and if designed as
The SSC remains
essentially elastic
and may perform its
normal and safety
functions during and
after exposure to its
specified seismic
loads.
designed as a
pressure retaining
SSC must maintain
its leak tightness
and structural
integrity. It may
undergo moderate
permanent distortion
and yet perform its
safety functions;
there is some
assurance that the
SSC will retain its
normal function and
will remain
repairable.
32
a pressure
retaining SSC it
must maintain its
leak tightness and
structural
integrity. It may
undergo very
limited permanent
distortion and yet
perform its normal
functions (with little
or no repair) and
safety function after
exposure to its
specified seismic
loads.
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
SSC Type
HEPA Filter
Assemblies and
Housings
Cable Trays
Deformation
Sensitive(1) SSCs
Limit State A
Limit State B
Limit State C
Limit State D
Assemblies
designed to this
level should have
no nuclear or toxic
hazard safety
functions.
Assemblies designed
to this level should
have no nuclear or
toxic hazard safety
functions.
This Limit State may
be expected to be
applied to systems
categorized as SDC-4
or lower.
This Limit State
may be expected to
be applied to
systems classified as
SDC-5 and possibly
some in SDC-4.
The trays may
undergo substantial
distortion,
displacement, and
loss of stiffness,
but the connections
(e.g., at the
penetrations or at
the junction boxes)
are very flexible or
are such that the
cables may still
perform their
function during and
following exposure
to specified seismic
loads.
The trays may undergo
some distortion,
displacement, and loss
of stiffness, but the
connections (e.g., at
the penetrations or at
the junction boxes)
have some flexibility
or are such that the
cables may still
perform their function
during and following
exposure to specified
seismic loads.
Cable connections
(e.g., at the
penetrations or at the
junction boxes) are
rigid or brittle or are
such that the trays may
undergo only very
limited distortion,
displacement, and loss
of stiffness during
exposure to specified
seismic loads before
the cable functions are
impaired.
Cable connections
(e.g., at the
penetrations or at
the junction boxes)
are very rigid or
brittle or are such
that the trays may
undergo essentially
no distortion or loss
of stiffness during
exposure to
specified seismic
loads before the
cable functions are
impaired.
This type SSCs
should not be
designed to this
Limit State
This type SSCs should
not be designed to this
Limit State
Functional evaluation
is required when
designing to this Limit
State. Component
testing may be
required.
This type of SSC
should typically be
designed to this
Limit State and
testing may be
required.
Notes: (1) Deformation Sensitive SSCs are defined as those whose safety functions may be impaired if these SSCs
undergo deformations within the elastic limit during an earthquake (e.g., a valve operator, a relay, etc.).
33
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
SSC Type
Limit State A
Anchors and
Anchor Bolts
for
Equipment
and
Equipment
Support
Structures
To ensure that no
system interactions
occur during an
earthquake, no
anchors or anchor
bolts should be
designed to this Limit
State (see Note 2
below).
Tanks, pressure
vessels, and piping
systems that do not
contain or carry any
hazardous fluid, have
no safety functions,
and whose gross
leakage during and
following an
earthquake will not
impact safety. Repair
may require
replacement of vessel
and piping.
Pressure
Vessels and
Piping
Designed to
ASME
code[15]
Limit State B
Limit State C
Limit State D
The anchors or
anchor bolts may
undergo only
moderate permanent
distortion without
impairing the safety
function of the
equipment (normal
function may be
impaired) following
exposure to the
specified seismic
loads.
The anchors or
anchor bolts may
undergo very limited
permanent distortion
without impairing the
normal and safety
functions of the
equipment following
exposure to the
specified seismic
loads.
The anchors or anchor
bolts need to remain
essentially elastic so as
not to impair the
normal and safety
functions of the
equipment during and
following exposure to
the specified seismic
loads.
Tanks, pressure
vessels, and piping
systems that do not
contain or carry any
hazardous fluid, have
no safety functions,
and whose gross
leakage during and
following an
earthquake will not
impact safety. In situ
repair of vessel may
be possible.
Tanks, pressure
vessels, and piping
systems that contain
or carry hazardous
fluids or belong to
essential postearthquake recovery
facilities and may
have no significant
spills and leakage
during and following
an earthquake may be
designed to this Limit
State.
Tanks, pressure
vessels, and piping
systems that contain or
carry hazardous fluids
and may have no spills
and leakage during
and following an
earthquake should be
designed to this Limit
State.
Piping connections
and fittings (e.g.,
elbows, tees, etc.)
and attachments (e.g.,
penetrations) to all
pressure vessels and
tanks should also be
designed to this Limit
State or Limit State
D.
Piping connections
and fittings (e.g.,
elbows, tees, etc.) and
attachments (e.g.,
penetrations) to all
pressure vessels and
tanks should also be
designed to this Limit
State.
Notes: (2) Anchor bolts designed to code allowables generally will exceed this Limit State because of conservatism
inherent in the standard design procedures (e.g. factor of safety of 4 for expansion anchors). This assumes that
appropriate over-strength factors of the attached members are considered.
34
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
Appendix C: Guidance on a Structured Approach to Support Making the Judgments
Required in Section 6.2 of this Standard
Introduction
Together with other Standards cited, the present Standard presents a specific approach to seismic
design. Elements of this approach should benefit from methods summarized in [16], namely,
methods of structured decision analysis. These methods do not eliminate the use of judgment, but
furnish a context for application of judgment that can help to promote acceptance of the
approach. This perspective should serve to improve the implementation of the guidance provided
herein.
In particular, the formulation of Seismic Design Categories is shown to be a specific instance of
application of a “constructed attribute.” Assignment of SDCs to SSCs should be enhanced if the
bases for the SDC assignments are from a more structured perspective. PRA information, if it is
available, may be used to augment the compilation of basic data as well as support the qualitative
judgments required by the Standard. The Standard as a whole is a performance-based standard.
This Appendix offers a technically well-founded basis for documenting the judgments by which
the expected performance will be accomplished. The user choosing to apply the appendix should
record as part of the process of application of this Standard the definition and the scales of the
natural and constructed measures (including binary measures) employed to obtain the benefits of
this Standard. Regardless of the level of methods used in considering the ten factors in Section
6.2 and the factors discussed in Sections 6.4 through 6.8, documentation for specific application
of these factors, whether by the methods in [16] or other methods, ought to be developed and
maintained for transparency and efficiency.
Structured decision analysis methods for safety activities, including regulation and oversight are
applied in [16]. This appendix briefly discusses some of the key ideas from that development,
and relates them to selected elements of the present Standard.
35
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
There are also several questions that may arise when applying this standard: (a) Under what
circumstances could a conclusion be reached that the Standard has been misapplied? (b) If a
misapplication is found how is the significance to be evaluated? and (c) What corrective actions
might restore compliance? This Appendix provides information that may help in addressing
these questions.
Objectives Hierarchy
In order to focus clearly on the properties that need to be addressed in facility design, it is
desirable to proceed by first developing an objectives hierarchy as described in [16]. For
purposes of illustration, Figure C-1 shows a simple hierarchy for objectives focusing on selected
elements of the problem addressed by this Standard. At the top is the overall goal of “safety.”
(There are other goals besides “safety” in constructing a facility, and it is appropriate to reflect
these in the full objectives hierarchy; the focus on “safety” reflects the scope of the present
Standard.) Immediately below the goal, the three fundamental objectives at the top are displayed:
worker safety, public safety, and environmental protection.
Below the fundamental objectives are the means objectives. These are not ends in themselves,
but are achieved in order to serve the fundamental objectives. A hierarchy as shown in Figure C1 promotes completeness of the development (somewhat analogously to fault tree development)
and it helps decide on the level in the hierarchy at which details of implementation can most
appropriately be considered.
The Standard covers a spectrum of consequence types, including release of radioactive materials,
release of non-radioactive but toxic materials, and ordinary life safety; specific aspects of public
safety, worker safety, and environmental protection are considered in the formulation of the
safety functions. The fidelity of the as-built design to the fundamental objectives depends on the
care with which this step is taken.
Note that although the Standard does not mandate the performance of a PRA, or even the
development of a qualitative logic model, its thought process requires consideration of a set of
36
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
scenarios that need to be mitigated or prevented. Operationally, performance of the safety
functions means mitigation or prevention of these scenarios. Hence, PRA information, if it is
available, may be used to augment the compilation of basic data as well as support the qualitative
judgments required by the Standard.
Safety
Goal
Fundamental
Objectives
Worker Safety
Means Objectives
Overall Seismic
Safety
Performance
Functional
Safety
Performance
Measures &
Criteria
Defense in
Depth
•
•
•
•
•
•
•
•
Site
Material
Margin
QA
Barriers
Redundancy
Controls
Monitoring
Binary
Measures
Public Safety
Redundancy
Environmental
Protection
CCF
SI
• Two or more SSCs with
identical function
• Function performed by
different set of SSCs
• Substitution of SSC
with assured
administrative measure
or control
CCF occurs
unless
prevented by
redundancy or
robustness or
diversity
Source SSC
failure from
• Fire
• Flood
• Movement or
Collapse
Binary
Measures
Binary
Measures
Constructed
Measures
Constructed
Measures
Robustness
• Substantial
Seismic
Margin
• Redundancy
with
independence
• QA
Binary
Measures
Constructed
Measure
Figure C-1
Objectives Hierarchy
Allocation and Implementation of Performance Requirements
Quite generally, in formulating an approach to prevention, two aspects need to be addressed: the
allocation of performance over SSCs, and the implementation of that allocation. The Standard
focuses on allocation, with a view towards simplifying implementation.
37
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
Allocation refers to deciding what levels of SSC performance are needed in order to address the
target performance objectives associated with higher levels of the hierarchy. In many cases, there
may be many different ways to satisfy fundamental objectives by preventing scenarios. One
example considered in the main body relates to the case of nested barriers, where different
allocations over the two barriers can achieve nominally equivalent overall performance
(prevention of release of material outside the outer barrier) but with substantially different costs
and operational implications. The Standard allows for relaxing performance of the inner barrier,
provided that performance of the outer barrier is assured.
Implementation refers to the measures taken in order to make sure that the allocated levels of
performance “come true.” These measures may occur during design, construction, or operation.
In the case of seismic performance, the ability to link specific implementation measures to levels
of seismic performance is the result of much work [11] that supports the Standards invoked
(Figure A.1) to implement the allocation developed under this Standard.
A given scenario may affect more than one of the fundamental objectives, and a given SSC may
affect more than one scenario. This means that even in a fairly simple facility, characterizing all
feasible allocations that satisfy the fundamental objectives could be a complicated task. The
present Standard simplifies this task considerably by first focusing only on seismic aspects of
each fundamental objective, and second, by constructing an attribute called “seismic design
category” (SDC), with each SDC being associated with specific implementation measures. SSCs
are assigned to SDCs based on the most limiting of the consequences potentially associated with
SSC failure.
38
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
Seismic Design Category as a Constructed Attribute
Design alternatives differ with respect to their relative fulfillment of a given set of fundamental
objectives. The attributes of a design alternative can be formulated using quantitative and/or
qualitative measures (as described in [16]):

Natural measures, which directly quantify fundamental or other objectives.

Constructed measures, which reflect fundamental and/or means objectives, but do so on
scales of performance that must be developed through application of value judgments.
Constructed measures are generally characterized by descriptive statements of specific
attributes that are presented in a graded manner. A special case of a constructed measure is a
binary measure that represents a “true” or “false” judgment on a hypothesis.

Proxy attributes; which support the fundamental objectives, but typically in some partial or
indirect way. For example, they may correspond directly to means objectives, and thereby
reflect some, but typically not all, of the considerations reflected in the fundamental
objectives.
Natural measures (ones that more or less directly quantify performance with respect to an
objective) are desirable, but in general, can be difficult to find for safety performance with
respect to severe, catastrophic events. As a practical matter, metrics are frequently constructed.
Quite generally, the need in consensus standards for operability and understandability dictates
for the application of constructed and/or proxy attributes whose assessment by qualified persons
will be reasonably unambiguous.
Three fundamental objectives (worker safety, public safety, and environmental protection) are
being addressed in the Standard and it takes the simplifying step of constructing levels of the
SDC attribute, each of which addresses a specific level of performance under one of the
fundamental objectives. A scale from 1 to 5 has been defined; each level corresponds to a
39
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
specific level of performance with respect to each of the fundamental objectives. In order to
establish the absolute scale of significance of the consequences, and the comparability of
designated consequence levels across fundamental objectives, judgmental value tradeoffs have
necessarily been made, as discussed in Ref. 16. For example, SDC-5 is imposed on SSCs whose
unmitigated consequences of failure are any of the following:

unmitigated failure would cause loss of life of workers in the facility

unmitigated failure would possibly cause loss of life to an individual at the exclusion area
boundary for 2 hours or more

unmitigated failure would require potentially permanent exclusion from contaminated areas.
The achievement of consensus on the formulation of the SDCs, and especially on these value
judgments, is the core of the value added by the consensus standard.
Analyses to Support Selection of SDC and Limit States
As stated in Section 6.1, the necessary unmitigated consequence analysis identifies qualitative
and quantitative values of design parameters at which the SSC safety function fails along with
the unmitigated radiological, toxicological and environmental consequences of the failure. Also,
it is expected that uncertainties will be quantified and considered. Section 6.2 describes the
characteristics of the unmitigated consequence analysis. Mitigating features will be assumed not
to function unless redundancy with independence of the redundant features can be shown. If an
SSC is assumed not to fail when another SSC is being evaluated, the former SSC should have an
SDC designation at least one higher than the SSC being evaluated. In general, mean values of
parameters are to be used.
Given that a safety analysis of the facility is being developed to meet oversight/regulatory
requirements, the required information related to the facility design is expected to be available.
The key judgmental aspects of the Standard are associated with performing the unmitigated
40
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
failure analysis required in Section 6.2. There are ten factors in Section 6.2, (a) through (j), that
must be considered in performing this analysis. Some of these are prescriptive while others
require judgments that can be made and verified in a relatively straight forward manner while
still others will benefit from applying the methods in [16]. The following provides an analysis of
each of the items in Section 6.2 to better illustrate the potential applicability of these methods.
Item (a):
This item is relatively unambiguous in that it calls for “...considering only the
inherent physical or chemical characteristics of the hazardous material and the energy sources
for dispersing the material”. This can be viewed as a binary constructed measure with a “Yes”
or “No” answer to the question, “Are the physical or chemical characteristics of the hazardous
material and the energy sources for dispersing the material of sufficient intensity to warrant
consideration in the unmitigated consequence analysis?”
Item (b):
The statement “... the SSC must have a safety function related to preventing
accidents” is similar to Item (a) as a binary measure.
Item (c):
The statement “ ... unless the robustness of each mitigating feature can be clearly
demonstrated. Redundancy can also be used as a mitigating feature providing the independence
of redundant features can be clearly demonstrated, such that there is a very low probability of an
earthquake caused common cause failure” requires judgment to be applied to robustness and
redundancy. Two separate constructed measures may be required.
Item (d):
The statement “ANS 5.10, “Airborne Release Fractions at Nonreactor Nuclear
Facilities [10] provides guidance concerning mechanisms for release of the hazardous material
...” may or may not require judgment pursuant to the application of ANS 5.10. A binary
measure may suffice.
Item (e):
A formal approach using a combination of natural and constructed measures may
be required to address “.... the unmitigated consequence analysis should strive to use mean
values for the parameters related to material release, dispersal, and health consequences.”, and
“In many instances the data available to support these analyses are not prototypic of the situation
41
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
being analyzed, or there is large and poorly characterized uncertainty. Hence, judgment must be
used to select a mean value for the parameter of concern. The desire to use mean values is not
intended to demand many data points and statistical computation of the mean. It is intended that
the parameters used in the evaluation be judged to be the most likely to occur given the physical
and chemical conditions involved with the failure....”.
Item (f):
This item may predominantly employ natural measures to estimate dose
consequences and model parameters.
Item (g):
This item employs substantially quantitative criteria related to acceptability of
potential release of material. Natural measures may suffice, but constructed measures may help
simplify some issues.
Item (h):
The statement “When assigning SDCs in cases of common cause failure of
redundant SSCs it will be necessary to exercise judgment about the relative contribution that
each of the SSCs postulated to fail makes to the unmitigated release.”, calls for judgment and
application of the formal approaches and methods in [16] would be helpful.
Item (i):
This item deals with the complexities of assigning SSC to the SDCs and a binary
or proxy measure may provide the needed decision factors.
Item (j):
This item deals with the complexities of assigning SSC to the SDCs and a binary
or proxy measure may provide the needed decision factors.
The basis for the judgments on the above factors should be documented as required by the
Standard.
42
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
References
1) DOE-STD 1021-93, Natural Phenomena Hazards Performance Categorization Guidelines
for Structures, System, and Components, , July 1993. (Reaffirmed 2002)
2) DOE-STD-1020-2002, Natural Phenomena Hazards Design and Evaluation Criteria for
Department of Energy Facilities, January 2002.
3) DOE-STD-1022-94, Natural Phenomena Hazards Site Characterization Criteria, , March
1994.(Reaffirmed 2002)
4) DOE-STD-1023-95, Natural Phenomena Assessment Criteria, May 1995 (Reaffirmed 2002).
5) ANS 2.27, Guidelines for Investigations of Nuclear Facility Sites for Seismic Hazard
Analysis, (to be published)
6) ANS 2.29, Probabilistic Seismic Hazards Analysis, (to be published)
7) ASCE xxx, Seismic design Criteria for Structures and Seismic Input for Systems and
Components in Nuclear Facilities, (to be published)
8) DOE-STD-1027-92, Hazard Categorization and Accident Analysis Techniques for
Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports, Change Notice
No.1, September 1997.
9) DOE-STD-3009-94, Preparation Guide for U.S.DOE Nonreactor Nuclear Facility Safety
Analysis Reports, Change Notice No. 1, January 2000.
10) ANS 5.10, Airborne Release Fractions for Non-Reactor Nuclear Facilities, 1997.
11) R. C. Kennedy and S. A. Short, Basis for Seismic Provisions of DOE-STD-1020, UCRL-CR111478, April 1994.
43
ANSI/ANS 2.26 Draft 0 Revision #13
March 1, 2004
12) Prassinos, Peter G., Evaluation of External Hazards to Nuclear Power Plants in the United
States: Seismic Hazards, NUREG/CR-5042, Supplement 1, prepared by LLNL for US NRC,
April 1988
13) Title 10, Paragraph 70.61, Code of Federal Regulations, Performance Requirements
14) NUREG-1520, Standard Review Plan for the Review of a License Application for a Fuel
Cycle Facility, March 2002.
15) ASME Boiler and Pressure Vessel Code Section III, Division 1, American Society of
Mechanical Engineers, 2001.
16) NUREG/BR-0303, Guidance on Performance-Based Regulation, published by the USNRC
44