Reliability Engineering and System Safety 79 (2003) 265–279

www.elsevier.com/locate/ress

Development of the DQFM method to consider the effect of correlation of

component failures in seismic PSA of nuclear power plant
Yuichi Watanabea, Tetsukuni Oikawab,1, Ken Muramatsub,*
a
Sheet Products Research Department, Materials and Processing Research Center, NKK Corporation, Koukan-cho, Fukuyama-city,
Hiroshima-ken 721-0931, Japan
b
Safety Analysis Laboratory, Japan Atomic Energy Research Institute, Tokai-mura, Naka-gun, Ibaraki-ken 319-1195, Japan
Received 11 January 2000; accepted 15 April 2002

Abstract
This paper presents a new calculation method for considering the effect of correlation of component failures in seismic probabilistic safety
assessment (PSA) of nuclear power plants (NPPs) by direct quantification of Fault Tree (FT) using the Monte Carlo simulation (DQFM) and
discusses the effect of correlation on core damage frequency (CDF).
In the DQFM method, occurrence probability of a top event is calculated as follows: (1) Response and capacity of each component are
generated according to their probability distribution. In this step, the response and capacity can be made correlated according to a set of
arbitrarily given correlation data. (2) For each component whether the component is failed or not is judged by comparing the response and the
capacity. (3) The status of each component, failure or success, is assigned as either TRUE or FALSE in a Truth Table, which represents the
logical structure of the FT to judge the occurrence of the top event. After this trial is iterated sufficient times, the occurrence probability of
the top event is obtained as the ratio of the occurrence number of the top event to the number of total iterations.
The DQFM method has the following features compared with the minimal cut set (MCS) method used in the well known Seismic Safety
Margins Research Program (SSMRP). While the MCS method gives the upper bound approximation for occurrence probability of an union
of MCSs, the DQFM method gives more exact results than the upper bound approximation. Further, the DQFM method considers the effect
of correlation on the union and intersection of component failures while the MCS method considers only the effect on the latter. The
importance of these features in seismic PSA of NPPs are demonstrated by an example calculation and a calculation of CDF in a seismic PSA.
The effect of correlation on CDF was evaluated by the DQFM method and was compared with that evaluated in the application study of the
SSMRP methodology. In the application study, Bohn et al. showed that correlation had a significant effect on CDF and may vary it by up to an
order. However, in the results calculated by the DQFM method correlation varied CDF by at most 2 or 3 times compared with CDF for a case
where no correlation was assumed. Although some factors should further be examined, this implied that the MCS method may have overestimated
the effect of correlation on CDF and the effect of correlation on CDF may not be so significant as that evaluated in the SSMRP.
q 2002 Published by Elsevier Science Ltd.
Keywords: Seismic probabilistic safety assessment; Nuclear power plant; Fault Tree; Monte Carlo simulation; Core damage frequency; Correlation of failure;
Seismic core melt frequency evaluation-2

1. Introduction Energy Research Institute (JAERI) has developed

Seismic probabilistic safety assessments (PSAs) of
nuclear power plants (NPPs) have been widely conducted
since early 1980s, especially in the USA to evaluate core
damage frequency (CDF) induced by earthquakes and to
identify vulnerability of NPPs to earthquakes. Since many
large earthquakes have occurred in Japan, the Japan Atomic
* Corresponding author. Tel.: þ 81-29-282-5815; fax: þ81-29-282-6147.
E-mail address: muramatu@popsvr.tokai.jaeri.go.jp (K. Muramatsu).
1
Currently on loan to the Office of the Nuclear Safety Commission.
0951-8320/03/$ - see front matter q 2002 Published by Elsevier Science Ltd.
PII: S 0 9 5 1 - 8 3 2 0 ( 0 2 ) 0 0 0 5 3 - 4
a methodology for seismic PSAs of NPPs and applied this
method to a hypothetical BWR plant, which is termed ‘Model
Plant’ [1]. The Model Plant is a 1100MWe BWR/5 plant with
a Mark-II type containment located on an actual site of NPPs
on the Pacific coast of northeastern area in Japan.
It is well known that the results of seismic PSAs have
large uncertainty, especially in seismic hazard curves and
capacity (fragility) data. Budnitz pointed out in his review
paper [2] that the numerical uncertainties can be certainly
large, dominantly caused by the uncertainty in the seismic
hazard evaluation and that the uncertainties in the fragility
266 Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279
estimates per se make smaller but important contributors to
the overall uncertainty. He also pointed out that the
correlations among failures are not understood well and
the differences between assuming full correlation and zero
correlation can also amount to an order of magnitude
difference in CDF in some cases. Ravindra [3] selected the
question of correlation between seismic failures as one of
the issues that are not fully addressed in the current seismic
PSAs.
The significance of the effect of correlation in seismic
PSAs have been recognized and studied in some papers
[4 –10]. Ravindra [6] discussed the effect of correlation
and showed that correlation between component failures
may have large effect on CDF when an extreme
assumption of full dependence due to correlation was
assumed although a realistic consideration of dependencies
would result in much lower effect. Based on his sensitivity
analysis, Fleming [10] also pointed out that the correlation
may have significant effect on failure probability of a
system.
If identical two components are located side by side in a
building, there is high response dependency and the
responses of these components are correlated. Similarly, it
is thought that the capacities of identical two components
are correlated. Here, the former is called the correlation of
response and the latter is called the correlation of capacity.
If one component fails, it is likely that the other component
will also fail when responses and/or capacities of com-
ponents are correlated. When the degree of correlation
increases, the probability of simultaneous failure of multiple
components (intersection of component failures) increases
and the occurrence probability of union of component
failures decreases. An NPP consists of redundant systems,
which have a large number of components, and the failures
of the systems and core damage are usually represented by
an union of many intersections of component failures.
Therefore, correlation might significantly influence con-
ditional failure probabilities of systems, conditional core
damage probability (CDP) and CDF. The significance of the
effect of correlation in seismic PSAs has been recognized.
In the phase-1 of the Seismic Safety Margins Research
Program (SSMRP) [11], analysis procedures were devel-
oped to estimate the risk of an earthquake-caused radio-
active release from a commercial NPP. A system analysis
code, SEISIM (Systematic Evaluation of Important Safety
Improvement Measures), was developed to evaluate occur-
rence probabilities of accident sequences and CDF with
consideration of the effect of correlation. The SEISIM code
computes the accident sequence probability as upper bound
of occurrence probability of the sequence (upper bound
approximation) represented by an union of minimal cut sets
(MCSs). In this MCS method, the effect of correlation on
occurrence probability of an intersection of component
failures is considered and the effect of correlation on that of
an union of component failures is ignored since it is thought
that the effect on the intersection is much more significant
than the effect on the union.
In ‘Application of the SSMRP Methodology to the
Seismic Risk at the Zion Nuclear Power Plant’ [4] (hereafter
called the application study of the SSMRP), Bohn et al.
concluded that correlation had a significant effect on CDF
and may vary it by up to an order. However, ignoring the
effect of correlation on the occurrence probability of union
and the use of upper bound approximation might cause
overestimation of CDF.
The present authors developed a new calculation method
to consider the effect of correlation on the occurrence
probability of both union and intersection of component
failures and to obtain more exact results than the upper
bound approximation. This new method directly quantifies
Fault Tree (FT) using the Monte Carlo simulation and
calculates the occurrence probability of a top event as
follows: (1) Response and capacity of each component are
generated according to their probability distribution. (2) For
each component whether the component is failed or not is
judged by comparing the response and the capacity. (3) The
status of each component, failure or success, is assigned as
either TRUE or FALSE in a Truth Table, which represents
the logical structure of FT to judge the occurrence of the top
event. After this trial is iterated sufficient times, the
occurrence probability of the top event is obtained as the
ratio of the occurrence number of the top event to
the number of total iterations. In the second step, the effect
of correlation of response was considered by correlating the
compositions of variabilities of responses that are caused by
a common source; this method is described in Refs. [12,13].
However, it is difficult to treat arbitrarily given correlation
coefficient data since the degree of correlation is discretely
varied in this manner. Then, a mathematical technique was
applied to make responses correlated according to the
arbitrarily given correlation coefficient data; this method is
described in Ref. [12]. The correlation of capacity as well as
response can be considered by the same ways. The
developed calculation method was named the DQFM
(direct quantification of Fault Tree using the Monte Carlo
simulation) method.
The feasibility of the DQFM method was confirmed by
calculation of failure probability of a system [12,13] and the
DQFM method was incorporated into the SECOM (seismic
core melt frequency evaluation)-2 code, which is a systems
reliability analysis code for seismic PSAs developed by
JAERI [14].
First, this paper reviews treatment of correlation in
existing works and their limitations and then introduces
calculation method of the DQFM method. Next, this paper
shows effect of correlation on occurrence probability of an
union of component failures and intersection of component
failures. Further, CDFs calculated by the DQFM method
and the MCS method were compared to evaluate the effect
of correlation on CDF.
 Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279
2. Definition and nature of correlation in seismic PSAs
In a seismic PSA, responses and capacities of
components are usually treated as random variables and
correlation of response and capacity of component is an
essential issue when one considers the simultaneous failure
probability of multiple components. Reed et al. [5] defined
and explained the correlation of component failures as
follows (their explanation has been rearranged by the
present authors):
“Physically, dependencies exist due to similarities in
both response and capacity parameters. For example, if two
components are located side by side in a building, there is
high response dependency. The structural capacities of two
identical pumps are highly correlated. Then, if one pump
fails due to an earthquake, it is likely that the other pump
will also fail.”
In this paper, the correlation of failure is defined as any
dependency among failures of components that arise from
common sources of variability of their responses and
capacities. For example, common source of the variability
of response of two pumps of similar design on the same
floor include the uncertainties in the seismic motion, soil
amplification of the seismic wave and the building
response. The common sources of the variability of
capacity of the two pumps include the similarity in
material properties and design of weakest parts. The
strength of correlation of capacity would depend on the
degree of similarity in design and the method of capacity
evaluation. Here, the dependency of response means the
correlation of response; the dependency of capacity means
the correlation of capacity.
Correlation influences the occurrence probabilities of not
only the intersection but also the union of multiple
component failures. In case of no correlation, the occurrence
probability of intersection of component failures is the
product of the failure probabilities of the components. When
the degree of correlation among the component failures
increases, the occurrence probability of intersection of
component failures increases and the occurrence probability
of union of component failures decreases.
The variability of response or capacity of a component is
usually treated as a combination of the uncertainty due to
lack of knowledge and the uncertainty due to randomness.
The former is some times called epistemic uncertainty and
the latter is called aleatory uncertainty. In this paper,
however, this separation is not performed although it is
theoretically possible and will be necessary for conducting
an uncertainty analysis.
Mathematically, the strength of correlation between two
random variables Xi and Xj is expressed by a correlation
coefficient ðrÞ defined by the following equation
CovðXi ; Xj Þ
r ¼ pffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi ; ð1Þ
VarðXi ÞVarðXj Þ
267
where CovðXi ; Xj Þ is covariance coefficient between Xi and
Xj, VarðXi Þ is variance of Xi defined by the following
equations
 
VarðXi Þ ¼ E ðXi Þ2 2 ðEðXi ÞÞ2 ; ð2Þ
CovðXi ; Xj Þ ¼ EðXi Xj Þ 2 EðXi ÞEðXj Þ; ð3Þ
where EðXi Þ and EðXi Xj Þ are defined by the following
equations using probability density function f ðXi Þ and
f ðXi ; Xj Þ:
ð1
EðXi Þ ¼ Xi f ðXi ÞdXi ; ð4Þ
21
ð1 ð1
EðXi Xj Þ ¼ Xi Xj f ðXi ; Xj ÞdXi dXj : ð5Þ
21 21
3. Consideration of effect of correlation
in the existing works
3.1. Treatment of correlation in the SSMRP, NUREG-1150
and other works
3.1.1. Evaluation of responses and correlation
In the phase-1 of the SSMRP, the SMACS (seismic
methodology analysis chain statistics) code was developed
to probabilistically calculate the seismic responses of
structures, systems and components. In the application
study of the SSMRP, a large number of multiple time
history analyses of responses were performed by the
SMACS code. Correlation and variability of responses
were determined from the results of those response analyses.
Finally, the occurrence probabilities of accident sequences
and CDF were calculated by the SEISIM code using these
values.
In the risk assessments for the Surry and Peach Bottom
NPPs of the NUREG-1150 risk assessments (hereafter
called NUREG-1150), a set of rules were formulated as
shown in Table 1, which predicted the ‘exact’ correlation
with adequate accuracy [8,9,15]. These rules were based on
the examination of a large number of responses in the
application study of the SSMRP, which showed a distinct
pattern to the values of correlation that existed between the
various types of responses.
On the other hand, the effect of correlation of capacities
was examined by a sensitivity analysis, assuming that the
capacities of components were perfectly correlated or
independent because of the lack of data for the correlation
of capacities in the application study of the SSMRP [4]. In
NUREG-1150, the capacities of components were assumed
to be independent [8,9].
According to the concept suggested by Reed et al. [5]
correlation of responses and/or capacities of components
can be determined by the following way. The variabilities of
responses and/or capacities of the components can be
decomposed on the basis of source of variabilities and
268 Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279

Table 1
Rules for assigning response correlation for NUREG-1150

1. Components on the same floor slab, and sensitive to the same spectral frequency range (i.e. zero period acceleration (ZPA), 5–10 Hz, or 10–15 Hz) will be
assigned response correlation ¼ 1.0
2. Components on the same floor slab, sensitive to different ranges of spectral acceleration will be assigned response correlation ¼ 0.5
3. Components on different floor slabs (but in the same building) and sensitive to the same spectral frequency range (ZPA, 5 –10 Hz or 10– 15 Hz) will be
assigned response correlation ¼ 0.75
4. Components on the ground surface (outside tanks, etc.) shall be treated as if they were on the grade floor of an adjacent building
5. ‘Ganged’ valve configurations (either parallel or series) will have response correlation ¼ 1.0
6. All other configurations will have response correlation equal to zero

correlation is expressed as the fraction of the variabilities
caused by the common sources in the total of the
variabilities. On the basis of their concept, correlation of
response can be determined without the time history
analyses of responses.
3.1.2. Calculation of occurrence probabilities of accident
sequences taking account of correlation
In the SEISIM code, the occurrence probabilities of
MCSs that contained correlated component failures were
calculated and incorporated in the calculation of occurrence
probabilities of accident sequences and CDF.
In this method, correlation of component failures was
treated as follows: if the correlation between the responses
and the correlation between the fragilities (the fragility in
Ref. [4] means the capacity in this paper) are known for two
components, then the coefficient of correlation between the
failures of these two components (‘correlation of com-
ponent failures’) was defined by Eq. (6) [4,15]
bR1 bR2
rC ¼ qffiffiffiffiffiffiffiffiffiffiffiffi
ffiqffiffiffiffiffiffiffiffiffiffiffiffiffi rR1R2
bR1 þ b2F1 b2R2 þ b2F2
2 when cut set probabilities are high. Eq. (10), which is based
bF1 bF2
þ qffiffiffiffiffiffiffiffiffiffiffiffi
ffiqffiffiffiffiffiffiffiffiffiffiffiffiffi rF1F2 ;
bR1 þ b2F1 b2R2 þ b2F2
2
where rC is a correlation coefficient between the component
failures 1 and 2, bR1 and bR2 standard deviations of the
logarithms of the responses of components 1 and 2, bF1 and
bF2 standard deviations of the logarithms of the fragilities of
components 1 and 2, rR1R2 a correlation coefficient between
responses of components 1 and 2, and rF1F2 is a correlation
coefficient between the fragilities of components 1 and 2.
The correlation coefficient defined by Eq. (6) was the
correlation coefficient between logarithms of ratios of
responses to capacities for components 1 and 2 since
responses and capacities of components were treated as
random numbers that were subject to the lognormal
distribution.
The occurrence probability of an accident sequence
ðPðACC SEQÞÞ that leads to core damage was expressed by
the following expression:
PðACC SEQÞ ¼ PðMCS1 < MCS2 < · · · < MCSn Þ:
The SEISIM code can use the following three upper bounds:
Y
PðACC SEQÞ ¼ 1 2 ½1 2 PðMCSi Þ; ð8Þ
i
X
n
PðACC SEQÞ ¼ PðMCSi Þ; ð9Þ
i
X
n X
PðACC SEQÞ ¼ PðMCSi Þ 2 PðMCSi > MCSj Þ;
i ði;jÞ[t
ð10Þ
where PðMCSi Þ is the occurrence probability of the ith
MCS, t is the set of all MCSs that lead to core damage and n
is the number of MCSs in t.
Eq. (8), gives the exact occurrence probability of an
union of MCSs only when the component failures among
MCSs are independent of one another, otherwise it gives an
approximation to upper bound of the occurrence probability
of an union of MCSs. Eq. (9) is an upper bound on the
probability of an union. It does not account for interactions
between cut sets and is, therefore, not an accurate bound
on Hunter [16] and is called Hunter’s upper bound in this
paper, is an improvement on Eq. (9) because it is obtained
ð6Þ by subtracting the probabilities of certain pairs of cut sets
from the sum, thereby taking some interaction between cut
sets into account.
Since Eq. (8) seems to have been used most widely, we
assume that Eq. (8) is used for the MCS method.
The occurrence probability of an MCS in the equation
was obtained by n-dimensional numerical integration of a
multivariate lognormal distribution with correlation coeffi-
cients for all pairs of component failures in the MCS, which
were defined by Eq. (6).
3.1.3. Limitations of treatment of correlation in the SSMRP
and NUREG-1150
In the SSMRP and NUREG-1150 method, since the
occurrence probability of accident sequence is calculated by
Eq. (8), only the effect of correlation on occurrence
probability of the intersection of component failures can
be considered and the effect of correlation on that of the
union of component failures is ignored. Therefore, failure
probabilities of systems, CDP and CDF with consideration
ð7Þ of correlation of component failures are always larger than
 Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279
those without consideration of correlation in the MCS
method. Justification for this simplification is that the
correlation of component failures strongly influences the
occurrence probability of intersection of component
failures and the effect of the correlation on occurrence
probability of union of component failures is much smaller
[4]. Further, ignoring the effect on union gives conservative
results.
If a system consists of components in parallel, failure of
the system is expressed as the component failures combined
by AND-gates in FT (intersection of component failures).
On the other hand, if a system consists of components in
series, failure of the system is expressed as the component
failures combined by OR-gates in FT (union of component
failures).
Since FTs for safety systems of an NPP normally contain
many component failures combined by OR-gates, the
correlation among them might significantly influence the
failure probabilities of the systems. However, it is difficult
for the MCS-based methods to analyze this effect.
3.1.4. Effect of correlation on CDF evaluated in the
application of the SSMRP to the Zion plant
In the application study of the SSMRP, Bohn et al.
concluded that effect of correlation on a risk analysis that
was dominated by single failures, especially structural
failures, were relatively minor. For the cases where the
dominant risk contributors were pairs of component
failures, such as electrical components, correlation had a
significant effect on CDF and may vary it by up to an order
[4]. However, they noted that the effect of correlation on
CDF might be overestimated because of the upper bound
approximation.
3.2. Consideration of correlation in the JAERI method
3.2.1. Seismic PSA procedures at JAERI
The seismic PSA procedures developed at JAERI have
the following three steps [17]: evaluation of seismic hazard,
evaluation of responses and capacities of components in
systems and evaluation of failure probabilities of systems,
CDP and CDF.
The responses of components are evaluated by a response
factor method, which is one of the characteristic features in
the seismic PSA method of JAERI [18]. The response factor
for each building or component (structure, piping and other
equipment) in an NPP accounts for the difference between
the response and the response evaluated in design, which is
generally conservative. The response factor is defined as the
ratio of design responses to actual responses of component,
building, etc. and is treated as random variable that is
subject to the lognormal distribution. The variances and
median of response factors were determined by comparison
between design calculation and detailed analysis and by
engineering judgment using available data.
269
In the JAERI method, failure probabilities of systems,
CDP and CDF are calculated by the SECOM-2 code. They
can be calculated by the following three methods:
1. the Boolean Arithmetic Model (BAM) method [19],
which gives an exact numerical result
2. the MCS method used in the SSMRP method that
gives a result of upper bound approximation using Eq.
(8), and
3. the DQFM method, which is described in Section 4.
3.2.2. Calculation of failure probability of a system taking
account of correlation in the response factor method
Abe [7] examined the effect of correlation of responses
on failure probability of a system by using the Monte Carlo
simulation as the first step on this issue at JAERI. In their
method, the response factor of each component was
sampled for each trial in the Monte Carlo simulation to
determine the response of the component on condition that
response factors of all components were fully correlated.
Since the response of a component is calculated by dividing
its design response by its response factor, the sampling of
the response factor is equivalent to the sampling of
response. The failure probability of the component was
calculated from the capacity of the component and the
sampled response. The failure probabilities of all com-
ponents were assigned into FT and the failure probability of
a system was calculated by using the BAM method at this
trial. This procedure was iterated sufficient times and the
distribution of failure probabilities of a system was
obtained. Mean value of the distribution was calculated as
the failure probability of the system. By this method, the
effect of correlation of responses on component failures
combined by AND-gates and OR-gates can be considered.
However, this method can consider the effect of correlation
only when responses or capacities are fully correlated since
it uses the BAM method. Considering the effect of
correlation, they calculated a failure probability of a small
system and concluded that correlation did not affect the
results of seismic PSAs.
4. Calculation method of DQFM method taking account
of correlation
4.1. Calculation flow of the DQFM method
The calculation flow of the DQFM method to calculate
the occurrence probability of a top event such as system
failure and core damage consists of the following seven
steps as is shown in Fig. 1. First, FT structure, capacity data
and response data of each component in the FT are given as
input (step 1). In each trial of the Monte Carlo simulation,
the values of response and capacity of a component are
sampled according to their probability distributions (step 2).
Whether the component is failed or not is judged by
270 Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279

Fig. 1. Flow chart of DQFM method.

comparing the values of response and capacity of the
component (step 3). The steps 2 and 3 are repeated for every
component (step 4). Here, arbitrarily given correlation of
responses and capacities of the components are considered
in the manner as described in Section 4.2. The failure or
success of each component is assigned as either TRUE or
FALSE to a Truth Table, which represents the logical
structure of the FT to judge the occurrence of top event. This
trial is iterated sufficient times and occurrence number of the
top event is counted (step 5). The occurrence probability of
the top event is obtained by dividing the number of
occurrences of the top event by the number of total iterations in
the simulation (step 6). The calculation steps 1 –6 are
repeated to calculate the occurrence probability of the top
event at every seismic motion level (step 7).
If CDP is obtained as occurrence probability of a top
event, CDF is obtained by integrating the product of CDP
and occurrence frequency of earthquake with respect to
seismic motion level.
This method has the following advantages:
1. This method can treat an arbitrarily given correlation of
response and capacity.
2. This method can consider the effect of correlation on the
occurrence probability of the union of component
failures as well as the intersection of component failures.
3. Further, this method can provide a more exact result than
the result of the upper bound approximation, if the Monte
Carlo simulation is performed by sufficient iteration.
 Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279
4.2. Consideration of correlation by the DQFM method
As described in Section 3.1.1, correlation coefficients
between responses of components can be determined by the
time history analyses of response or the concept suggested
by Reed et al. [5]. In order to calculate failure probabilities
of systems, CDP and CDF with consideration of the
obtained correlation coefficients, responses of components
has to be made correlated according to the obtained
correlation coefficients in the Monte Carlo simulation.
First, this section describes the method making random
numbers correlated and the method making responses
correlated in the Monte Carlo simulation.
Correlation among many random numbers can be
expressed by the following correlation matrix (V), which
shows correlation of every pair of random variables
2 3
1 rðx2 ;x1 Þ · · · rðxn ;x1 Þ
6 7
6 rðx ;x Þ 1 7
6 2 1 7 determined, the SECOM-2 code can also treat correlation of
6 7
V¼6 . 7; ð11Þ
6 . .. 7
6 . . 7
4 5
rðxn ;x1 Þ rðxn ;x2 Þ 1
where xi is random variable and rðxi ; xj Þ the correlation
coefficient between xi and xj defined by Eq. (1). The random
numbers that are subject to the normal standard distribution
and are correlated according to the correlation matrix (V)
can be obtained by transforming independent random
numbers of normal standard distribution with the following
equation
2 3 2 3
y1 x1
6 7 6 7
6y 7 6x 7
6 27 6 27
6 7 6 7
6 . 7 ¼ M 6 . 7; ð12Þ
6 . 7 6 . 7
6 . 7 6 . 7
4 5 4 5
yn xn
where xi is the independent random number and yi is the
correlated random number and M is a lower triangular
matrix that holds for Eq. (13).
V ¼ MMt ;
t
where M is the transposed matrix of M. The element of M
must be real number in this case. The matrix (M) can be
obtained by decomposing the correlation matrix V into M
and M t with the use of Cholesky decomposition [20].
As described in Section 3.1, the correlation coefficients
between responses of components at a given seismic motion
level are usually defined by the correlation coefficients
between logarithms of responses of components since the
responses are treated as random variables of the lognormal
distribution. If the correlation matrix for the logarithms of
responses of components is obtained, the responses are
generated in the Monte Carlo simulation as follows. The
correlated random numbers of the normal standard
distribution (yi) that is subject to the obtained correlation
271
matrix is generated as shown above and the correlated
response of component ðiÞ; which is subject to the lognormal
distribution, is determined by the following equation
Ri ¼ Rim expðbi yi Þ; ð14Þ
where Ri is the response of component ðiÞ; Rim the median of
Ri, bi the standard deviation of logarithm of Ri. With this
technique, logarithms of the responses can be made
correlated in accordance with the correlation coefficients
in the correlation matrix V.
In the case where responses of some components are
fully correlated, these components can be grouped into ‘a
response group’ and correlation coefficients among the
response groups are assigned into the correlation matrix. By
grouping, the dimensions of correlation matrix can be
reduced to make calculation more efficient.
If correlation coefficient of capacities of components is
obtained and the correlation matrix for capacity can be
capacity by the way described above. However, because of
lack of correlation data for capacity as mentioned in Section
3 the effect of correlation of capacity can merely be
evaluated by a sensitivity analysis under the present
conditions.
Furthermore, if sources of uncertainty were separated
into randomness (aleatory) and lack of knowledge or
modeling (epistemic) uncertainty and their respective data
for distribution parameters of correlation coefficients were
obtained, we believe that it is possible to expand the DQFM
method to perform uncertainty analysis by adding another
loop of Monte Carlo iteration.
5. Discussion of effect of correlation on failure
probability of system
This section demonstrates the effect of correlation on
occurrence probability of an union of many component
failures and that of an union of many intersections of
component failures using a sample problem.
ð13Þ
5.1. Sample problem
5.1.1. Sample system
To show the effect of correlation on occurrence
probability of an union of many component failures and
that of an union of many intersections of component
failures, a multiple train system whose train contains
sufficient number of components in series, is suitable for a
sample system.
The residual heat removal (RHR) system was chosen as
the sample system in our study. The RHR system, which
originally consisted of three trains, was simplified to a two
train system in the Model Plant PSA. The sub FT for the
train A of the RHR system, which shows a part of the FT
for the whole RHR system, (hereafter called sub FT for
272 Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279

Fig. 2. Sub FT of train A of RHR system.

 Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279
the train) is shown in Fig. 2. This FT also includes the
support system for the train A of the RHR system. In the sub
FT for the train, there were 26 seismically induced
component failures and seven non-seismic (random) fail-
ures. Most of the component failures were combined by OR-
gates except two pairs of pumps, which were combined by
AND-gates in the sub FT for the train. In the FT of RHR
system, sub FTs for the trains A and B were combined by
AND-gates [1]. Thus, the failure of RHR train was basically
represented by an union of many component failures and the
failure of the RHR system was represented by an union of
many intersections of component failures.
Components in the system were installed on the ground
or in the following three buildings: reactor building, control
building, sea water heat exchanger building.
5.1.2. Calculation condition
The failure probability of the RHR system and that of a
train of the RHR system were calculated for the following
four conditions. The capacity data used here was prepared
from the data for the Model Plant PSA at JAERI (base data)
[21] and are shown in Table 2.
(A) Independent case. The responses and capacities of
components were assumed to be completely independent.
(B) Partially correlated response case. The components
were grouped into 27 response groups on the basis of
installation locations and natural frequencies of components
and the responses were made fully correlated for the
components in the same response group.
The correlation coefficients among the 27 response
groups were determined according to the NUREG-1150
Fig. 3. Correlation matrix for partially correlated response case.
273
rules shown in Table 1 and were assigned into the
correlation matrix (V). In this case some elements in the
matrix M, which is obtained by decomposing the matrix V,
were complex numbers since some correlation existed
among the response groups that were on different floors in
the same building and were different natural frequencies
although these response groups had to be independent of one
another on the rules. This result implied that the rules used
in NUREG-1150 are not mathematically consistent in a
rigorous sense. Then, small correlation coefficient 0.3 was
assigned into the elements for those response groups in the
correlation matrix V to make the elements in the matrix M
be real numbers. Fig. 3 shows the correlation matrix used for
the calculation of the partially correlated case.
In this case, the responses of many components were
assumed to be partially correlated. The standard deviation of
logarithm of the response ðbi Þ in Eq. (14) was assumed to be
equal to that of the response factor for each component.
(C) Fully correlated response case. The responses of the
components in the same building were assumed to be fully
correlated regardless of installation locations or natural
frequencies of components.
(D) Fully correlated response and capacity case. In the
Model Plant PSA, all components were grouped into generic
categories similarly to NUREG-1150. For example, all
motor operated valves located on piping with different
diameters were placed into a single generic category, and
similarly, all motor control centers were placed into another
generic category.
The components in the same generic category can be
found in the same train and in different trains. For example,
274 Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279

Table 2
Seismic capacity data used in JAERI’s seismic PSA

Capacity evaluation Component class Median (Gals) Uncertainty

br bu

Evaluation by JAERI based on Startup transformer with ceramic tube 650 0.25 0.25
specific component design (A) Emergency diesel generator (EDG) 2156 0.25 0.31
Condensate storage tank 813 0.25 0.29

Estimation from proving tests (B) Vertical pump 2225 0.22 0.32
LPCS pump 2225 0.22 0.32
RHR pump 2225 0.22 0.32
CCW pump 2225 0.22 0.32
Horizontal pump SLC pump 3920 0.25 0.27
RCIC pump 3920 0.25 0.27
EECW pump 3920 0.25 0.27
Motor operated valve 6468 0.26 0.60
Check valve 6468 0.20 0.35
RCIC turbine 2587 0.25 0.27
Instrumentation rack 10 241 0.48 0.74
Switchgear/power center 8085 0.29 0.66
Logic panel/instrumentation panel 10 241 0.48 0.74
Control panel/motor control center 5929 0.48 0.74
Control rod drive housing 4722 0.20 0.35

Scaling based on evaluation by JAERI (C) EDG day tank 1716 0.15 0.20
EDG fuel tank 3324 0.25 0.45
SLC tank 3324 0.25 0.45
RHR heat exchanger 2638 0.20 0.35
EECW heat exchanger 5420 0.30 0.53
EECW heat exchanger (HPCS) 5420 0.30 0.53

Use of US generic data (D) Battery 2244 0.31

Transformer 8624 0.28
Piping 3.24 £ 102t-m 0.18

Special treatments for initiating events Loss of offsite power (A) 650 0.25 0.25
based on analysis at JAERI Large LOCA (D) 3067 0.35 0.40
or use of values from Medium LOCA (C) 2699 0.47 0.30
seismic PSAs in US Small LOCA (C) 1729 0.50 0.30
Reactor vessel rupture (D) 10 270 0.26 0.28

components such as RHR heat exchangers A1, A2, B1 and
B2 were in the same generic category and the RHR heat
exchangers A1 and A2 were installed in the same train A
and the RHR heat exchangers A1, B1 were installed in
different trains A and B.
The capacities of the components in the same generic
category were assumed to be fully correlated and the
responses of components were assumed to be correlated
similarly to the fully correlated response case.
Since the conditions (B), (C) and (D) assumed some
correlation in response and/or capacity of component, these
were called ‘correlated cases’ and since the conditions (B) and
(C) assumed correlation only in response, these were called
‘correlated response cases’ in the following descriptions.
The responses of components were correlated in the train
and correlated among trains for the correlated cases.
Moreover, the capacities of components were correlated in
the train and correlated among trains when the capacities of
the components in the same generic category were
correlated.
5.2. Calculation results
Figs. 4 and 5 show failure probabilities of the RHR train
A and the failure probabilities of the RHR system calculated
by the DQFM method and the BAM method for the
independent case. In the DQFM method, the Monte Carlo
simulation was performed by 100 000 iterations at each
seismic motion level. As shown in these figures, the failure
probabilities of the RHR train A and the RHR system
calculated by the DQFM method agreed with those
 Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279
Fig. 4. Conditional failure probability of train A of RHR system calculated
for independent and correlated cases.
calculated by the BAM method for the independent case;
these results showed that the DQFM method can accurately
calculate failure probabilities of the train and the system
[12,13].
Fig. 5. Conditional failure probability of RHR system calculated for
independent case correlated cases.
275
(A) Effect of correlation on occurrence probability of an
union of component failures. Fig. 4 shows the calculated
failure probabilities of RHR train A for the correlated
response cases comparing with the independent case. The
failure probabilities for the correlated response cases were
much smaller than the failure probability for the indepen-
dent case. The failure probability for the fully correlated
response case was smaller than that for the partially
correlated response case since the degree of correlation of
component failures for the fully correlated case was larger
than that for the partially correlated case in the train. The
failure probability for the fully correlated response and
capacity case was smaller than that for the fully correlated
response case since the correlation of capacities of the
component in the same generic category as well as the
correlation of response decreased occurrence probability of
an union of component failures. The same tendency of the
calculation results was also seen on the RHR train B. Since
the failure of RHR train was represented by an union of
many component failures, these results showed that
correlation of component failures considerably decreased
the occurrence probability of an union of many component
failures.
(B) Effect of correlation on occurrence probability of an
union of many intersections of component failures. Fig. 5
shows the calculated failure probabilities of the RHR system
for the correlated response cases comparing with the
independent case. The failure probabilities for the correlated
response cases were larger than the failure probability for
the independent case at low seismic, motion levels (below
about 700 Gals). At higher seismic motion levels (above
about 700 Gals), however, the failure probabilities for these
correlated cases were smaller than the failure probability for
the independent case. Generally, correlation of component
failures raises the occurrence probabilities of intersections
of component failures while it lowers the occurrence
probability of an union of component failures. The former
effect was more significant at the low seismic motion levels
and was less significant at the high seismic motion levels in
these cases.
The failure probability for the fully correlated response
and capacity case was much larger than that for the fully
correlated response case at all the seismic motion levels; this
result showed the correlation of capacity of the components
in the same generic category that increased occurrence
probability of intersections of component failures had
dominant effect.
Since the failure of the RHR system was represented by
an union of many intersections of component failures, these
results showed that correlation of component failures
increased occurrence probability of an union of many
intersections of component failures in some conditions and
considerably decreased it in other conditions compared with
the independent case. This implies that the effect of
correlation on occurrence probability of union of com-
ponent failures should not be ignored when one takes
276 Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279
account of effect of correlation of component failures. The
next section discusses the effect of correlation on CDF.
6. Discussion of effect of correlation on CDF
CDFs of the Model Plant calculated by the MCS method
and the DQFM method were compared to evaluate the effect
of correlation on CDF. Here we use Eq. (8) as the MCS
method for comparison purpose, because Eq. (8) is most
widely used for calculating CDFs and the SECOM-2 code is
not capable of using other equations. Thus, if Eq. (9) or (10)
is used, the comparison results may be slightly different.
6.1. Calculation condition
For performing CDF calculation, an integrated FT is
adopted as a system model in the Model Plant PSA at
JAERI. A simplified illustration of an integrated FT is
shown in Fig. 6. In this study the seismically induced core
damage that was caused by loss of off-site power (LOSP)
was considered since the CDF caused by the LOSP
dominated over 60% of total CDF. The LOSP was assumed
to be caused by the failure of a startup transformer with
ceramic insulator tubes since the failure probability of
Fig. 6. Simplified illustration of an integrated FT.
startup transformer was much larger than the other
components causing LOSP on the basis of the base data.
The core damage caused by the LOSP was represented
by about 120 basic events such as component failures and
non-seismic failures. The components were installed in the
reactor building, the control building, the sea water heat
exchanger building and on the ground as the components in
the RHR system were installed. The startup transformer,
which was assumed to cause the LOSP, was installed on the
ground and the failure of that was assumed to be
independent of the failures of components in safety
functions.
In the Monte Carlo simulation, CDP was obtained by
100 000 iterations at every seismic motion level on the basis
of the base data [21]. Responses and capacities of
components were assumed to be correlated according to
the four cases including the independent case in Section 5
similarly to the calculation of failure probabilities of the
RHR system.
6.2. Effect of correlation on CDF evaluated by the DQFM
method and the MCS method
Fig. 7 shows calculated CDPs obtained by the DQFM
method, the MCS method and the BAM method. For the
independent case, the CDP calculated by the DQFM method
agreed with that calculated by the BAM method; this result
showed the DQFM method can accurately calculate CDP as
well as failure probability of a system.
In the results of the DQFM method, the CDPs for the
partially correlated response case and the fully correlated
Fig. 7. Conditional CDP calculated by DQFM, MCS and BAM methods.
 Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279 277

response case were larger than the CDP for the independent
case at low seismic motion levels (below about 700 Gals).
However, at high seismic motion levels (above about
700 Gals) the CDPs for these cases were smaller than the
CDP for the independent case. The CDP for the fully
correlated response and capacity case was larger than that
for the fully correlated response case at all the seismic
motion levels. Since the core damage was represented by an
union of many intersections of component failures as well as
the failure of RHR system, these results showed the
similar tendency as the results of the RHR system shown
in Section 5.
For the independent case, the CDP calculated by the
MCS method was larger than that calculated by the BAM
method since the CDP calculated by the MCS method is the
upper bound approximation. Further, in the results of the
MCS method, CDP increased when degree of correlation
increased since the CDP is calculated with consideration of
effect of correlation only on the intersection of component
failures. In summary, CDP calculated by the MCS method
was much larger than that calculated by the DQFM method
especially when correlation was considered.
Fig. 8 shows CDF per unit acceleration, which is the
product of CDP and occurrence frequency of earthquake per
unit acceleration, as a function of acceleration level. In the
figure, CDF per unit acceleration was normalized by the Fig. 8. CDF per unit acceleration calculated by DQFM, MCS and BAM
peak value calculated by the DQFM method for methods.
the independent case. CDF per unit acceleration is
significantly varied by the change of CDP at low seismic CDF was varied by about 2.5 times in the results of the
motion levels, since the occurrence frequency of earthquake DQFM method and was varied by about 6 times, at
is large at those levels. Thus, CDF per unit acceleration maximum, in the results of the MCS method compared with
calculated by the MCS method was larger than that the independent case. Table 4 shows the ratio of CDF
calculated by the DQFM method for each of correlated calculated by the MCS method to that calculated by the
cases. DQFM method; the ratio shows degree of overestimation of
At the low seismic motion levels small fluctuation of CDF caused by the MCS method. The ratio was 3.3 for the
CDP, which was caused by insufficient iteration in the fully correlated response and capacity case while it was at
DQFM method, made the CDF per unit acceleration most 1.3 for the independent case.
fluctuated. Although CDF is obtained by integrating CDF Although Bohn et al. concluded that correlation had a
per unit acceleration with respect to seismic motion level, significant effect on CDF and may vary it by up to an order
the fluctuation did not considerably influence CDF. CDF per in the application study of the SSMRP, the results of the
unit acceleration calculated by the DQFM method present study showed that the MCS method overestimated
agreed with that calculated by the BAM method for CDF especially when correlation was considered and
the independent case as shown in Fig. 8 and this result implied that the effect of correlation on CDF would not be
showed that the DQFM method could accurately so significant as that evaluated in the SSMRP.
calculate CDF. Since the effect of correlation on CDF values depend on
Table 3 shows the ratios of the CDFs for the correlated various conditions, the present authors are evaluating the
cases to the CDF for the independent case. By correlation, influence of the following factors. However, they expect

Table 3
Ratio of the CDFs for the correlated cases to the CDF for the independent case

DQFM method MCS method

Independent case 1.0 1.0

Partially correlated response case 1.3 2.1
Fully correlated response case 1.3 2.7
Fully correlated response and capacity case 2.4 6.2
278 Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279
Table 4
Ratio of the CDF calculated by the MCS method to the CDF calculated by the DQFM method
Independent case
Partially correlated response case
Fully correlated response case
Fully correlated response and capacity case
that qualitative results obtained in this study will not depend
on these factors.
(a) In this study, initiating event LOSP was assumed to be
caused by a single failure of component, which was
independent of the component failures in safety
functions as mentioned in Section 6.1. If the initiating
event is caused by multiple components failures, which
are correlated with one another, and are correlated with
the component failures in safety functions, correlation
may considerably vary CDF.
(b) The number of seismically induced component failures
in the system model for this study was much smaller
than that in the SSMRP. The effect of correlation on
CDF might be varied by the number of component
failures.
(c) The correlation coefficient of component failures is
determined by Eq. (6) and this relation shows that the
correlation coefficient of component failures depends
not only on the correlation coefficients between
respective responses and capacities, but also on the
variances in these responses and capacities. The
variances in responses of components in the Model
Plant PSA at JAERI are comparatively larger than
those in the SSMRP. Thus, the effect of correlation on
CDF might be varied by variances in responses and
capacities.
7. Conclusion
The authors developed a new method for considering
the effect of correlation of component failures in seismic
PSA by DQFM. In the DQFM method, occurrence
probability of a top event is calculated as follows: (1)
Response and capacity of each component are generated
according to their probability distribution. In this step, the
response and capacity can be made correlated according to
a set of arbitrarily given correlation data. (2) For each
component whether the component is failed or not is
judged by comparing the response and capacity. (3) The
status of each component, failure or success, is assigned as
either TRUE or FALSE in a Truth Table, which represents
the logical structure of FT to judge the occurrence of the
top event. After this trial is iterated sufficient times,
the occurrence probability of the top event is obtained as
CDF(MCS method)/CDF(DQFM method)
1.3
2.1
2.8
3.3
the ratio of the occurrence number of the top event to the
number of total iterations.
The DQFM method has the following features compared
with the MCS method used in the well known SSMRP. The
DQFM method gives more exact results than the upper
bound approximation that the MCS method provides.
Further, this method considers the effect of correlation on
the union and intersection of component failures while the
MCS method only considers the latter.
The comparison between CDF calculated by the DQFM
method and that calculated by the MCS method for the case
of the Model Plant showed that CDF can be overestimated
by the MCS method especially when correlation was
considered. Moreover, the effect of correlation on CDF
evaluated by the DQFM method may not be so significant as
that evaluated in the SSMRP because of the effect of the
consideration of correlation of failures which reduces the
probability of union of components and was not easy for
MCS-based FT quantification methods.
References
[1] Risk Analysis Laboratory. Summary report of seismic PSA of BWR
Model Plant. JAERI-Research 99-035; 1999 (in Japanese).
[2] Budnitz RJ. Current status of methodologies for seismic probabilistic
safety analysis. Reliab Engng Syst Safety 1998;62:71–88.
[3] Ravindra MK. Seismic PSAs—issues, resolutions and insights.
Proceedings of the OECD/NEA Workshop on Seismic Risk, 10 –12
August 1999, Tokyo, Japan, NEA/CSNI/R8(99)28; November 2000.
p. 431–41.
[4] Bohn MP Shieh LC, Wells JE, Cover LC, Bernreuter DL, Chen JC,
Johnson JJ, Bumps SE, Mensing RW, O’Connell WJ, Lappa DA.
Application of the SSMRP methodology to the seismic risk at the Zion
Nuclear Power Plant, NUREG/CR-3428; 1983.
[5] Reed JW, McCann Jr. MW, Iihara J, Hadidi-Tamjed H. Analytical
techniques for performing probabilistic seismic risk assessment of
Nuclear Power Plants. Proceedings of Fourth International Con-
ference on Structural Safety and Reliability (ICOSSAR’85); 1985.
[6] Ravindra MK, Johnson JJ. Seismically induced common cause
failures in PSA of nuclear power plants. Transactions of the 11th
International Conference on Structural Mechanics in Reactor
Technology (SMiRT-11), vol. M04/1; 1991.
[7] Abe K, Inui E, Tanaka T, Kato Y. Development and application of
computer codes to quantify the effect of correlation of responses on
the system reliability. Transactions of the 11th International
Conference on Structural Mechanics in Reactor Technology
(SMiRT 11), vol. 03/1; 1991.
[8] Lambright JA, Bohn MP, Daniel SL, Johnson JJ, Ravindra MK,
Hashimoto PO, Mraz MJ, Tong WH, Brosseau DA. Analysis of core
 Y. Watanabe et al. / Reliability Engineering and System Safety 79 (2003) 265–279
damage frequency: Peach Bottom Unit 2 external event, NUREG/CR-
4550; 1989(Peach Bottom Unit 2 is the name of a plant).
[9] Bohn MP, Lambright JA. Procedures for the external event core
damage frequency analyses for NUREG-1150, NUREG/CR-4840;
1990.
[10] Fleming KN, Mikschl TJ. Technical issues in the treatment of
dependence in seismic risk analysis. Proceedings of the OECD/NEA
Workshop on Seismic Risk, August 1999, Tokyo, Japan, NEA/CSNI/
R(99)28; November 2000. p. 253 –68.
[11] Wells JW, George LL, Cummings GE. Seismic safety margins
research program, Phase I final report—systems analysis (Project
VII), NUREG/CR-2015, vol. 8; 1984.
[12] Watanabe Y, Oikawa T, Muramatsu K. An analysis of correlation of
response in the system reliability analysis in a seismic PSA of a
Nuclear Power Plant. Proceedings of the 20th CNS Nuclear
Simulation Symposium; 1997.
[13] Oikawa T, Kondo M, Mizuno Y, Watanabe Y, Fukuoka H,
Muramatsu K. Development of systems reliability analysis code
SECOM-2 for seismic PSA. Reliab Engng Syst Safety 1998;62:
251 –71.
[14] Muramatsu K, Ebisawa K, Matsumoto K, Oikawa T, Kondo M,
Fukuoka H. Development of seismic PSA methodology at JAERI.
279
Proceedings of the Third International Conference on Nuclear
Engineering (ICONE-3); 1995. p. 1333–40.
[15] Bohn MP, Lambright JA, Daniel SL, Johnson JJ, Ravindra MK,
Hashimoto PO, Mraz MJ, Tong WH. Analysis of core damage
frequency: Surry Power Station Unit 1 external events, NUREG/CR-
4550; 1989.
[16] Hunter D. An upper bound for the probability of a union. J Appl Prob
1976;13:597 –603.
[17] Sobajima M, Muramatsu K, Ebisawa K. Seismic probabilistic safety
assessment methodology development and application to a Model
Plant. Proceedings of the 10th Pacific Basin Nuclear Conference;
1996. p. 629–36.
[18] Ebisawa K, Abe K, Muramatsu K, Itoh M, Kohno K, Tanaka T.
Evaluation of response factors for seismic probabilistic safety assess-
ment of nuclear power plants. Nucl Engng Des 1994;147:197 –210.
[19] Leverentz FL, Kirch H. User’s guide for the WAM–BAM computer
code, EPRI 217-2-5; 1976.
[20] Bodewig E, Matrix calculus, Amsterdam: North-Holland; 1959.
[21] Oikawa T, Kondo M, Watanabe Y, Shiraishi I, Hirose J, Muramatsu
K. Insights from the Seismic PSA of the BWR Model Plant at JAERI.
International Topical Meeting on Probabilistic Safety Assessment
(PSA’99), Washington, DC; 1999. p. 77–84.