Sensitivity Study on the Correlation Level of Seismic Failures in Seismic Probabilistic Safety Assessments

: It is popular that correlated seismic failures spread over the fault tree of a seismic probabilistic safety assessment (PSA) for a nuclear power plant (NPP). To avoid the calculational difﬁculty of core damage frequency (CDF), the fault tree has been simpliﬁed by replacing correlated seismic failures with one typical seismic failure by assuming a full correlation among the correlated seismic failures. Then, the approximate seismic CDF of a seismic single-unit PSA (SUPSA) has been calculated for decades with this simpliﬁed SUPSA fault tree. Furthermore, current seismic multi-unit PSAs (MUPSAs) have been performed with imperfect seismic MUPSA models that were generated by combining such imperfect seismic SUPSA fault trees. The authors of this study recently developed a method that can calculate an accurate seismic CDF by converting correlated seismic failures into seismic common cause failures (CCFs). In this study, accurate and imperfect MUPSA models were created and their seismic CDFs were compared. The results of this study show that the seismic CDFs in SUPSA and MUPSA are drastically distorted and safety margins are accordingly distorted when the full correlation assumption is employed. Thus, this study shows that very careful attention should be paid to calculating and interpreting seismic CDFs for the single-unit and multi-unit regulations.

The typical safety goals for single-unit NPPs are specified in terms of early and latent cancer fatalities, which are usually expressed as quantitative health objectives (QHOs). However, since calculating the QHOs is difficult, surrogate safety goals such as core damage frequency (CDF) and large early release frequency (LERF) are being widely used in many countries. The CDF and LERF are calculated through probabilistic safety assessments (PSAs). It has been noted that the best-estimate risks should be modeled and calculated to show that they meet the safety goals. Furthermore, emergency operating procedures (EOPs) and accident management plans (AMPs) should be designed on the basis of the best-estimate risks.
The Korean AMP law that was enacted in 2016 after the Fukushima Daiichi NPP accident mandated that Korea Hydraulic and Nuclear Power (KHNP) develop an AMP

Correlated Seismic Failures and Seismic Common Cause Failures
The seismic SUPSA method was initiated by the WASH-1400 study [1], and the procedure for the seismic SUPSA has been well established by the following studies [14][15][16][17]. The importance of the correlated seismic failures was addressed in the Seismic Safety Margins Research Program (SSMRP) study [18]. However, the correlation among the seismic failures has been assumed as a zero or full correlation to avoid the difficulties for determining the level of the correlation and calculating seismic CDF from the fault tree that has correlated seismic failures [19]. The following studies [20][21][22] were performed to determine the correlation level among correlated seismic failures.
Various methods that can calculate seismic CDF from the fault tree that has correlated seismic failures are summarized in the NUREG 7237 report [19]. However, these methods are limited to the case when the correlated seismic failures exist under the single logical gate. The COREX study [23] made it possible to calculate seismic CDF when the seismic failures spread over a fault tree.
When the full correlation assumption is not employed, the logical gate probability that has correlated seismic failures can be implicitly calculated by multivariate normal (MVN) integration [23]. However, it is impossible to calculate any specific gate probability by this method when the correlated seismic failures are separately located under many gates.
To calculate seismic risks with the real correlation level among seismic failures of redundant/identical components, a new method was developed to convert correlated seismic failures into seismic common cause failures (CCFs) [23]. This method can be used to calculate best-estimate seismic risks, such as the single-unit CDF (SUCDF), multi-unit CDF (MUCDF), and site (SCDF) (see Section 3.1).
Here, multi-unit CCDP is the conditional probability that at least two NPPs are in a core damage state after an initiating event. Site CCDP represents the conditional probability that at least one NPP is in a core damage state following an initiating event. The normal gates U1 and U2 represent NPPs in a core damage state, and the complemented gates /U1 and /U2 represent NPPs in a non-core damage state. The SCDF and MUCDF are calculated by multiplying the seismic initiating event frequency and CCDPs in Equations (1) and (2), respectively.

Original Seismic MUPSA Model (Model A)
In this study, two seismic SUPSA fault trees are connected by an AND gate and an OR gate to calculate the MUCDF and SCDF, respectively. Each seismic SUPSA fault tree in Figure 1 has four correlated seismic failures of redundant/identical components (X1 to X4 for U1 and X5 to X8 for U2), which exist under the two AND gates. The seismic MUPSA fault tree in Figure 2 has eight correlated seismic failures (X1 to X8). Since there is no fault tree simplification in Figures 1 and 2 by the assumption of the full correlation among seismic failures, best-estimate SUCDF and MUCDF are calculated by the fault trees in Figures 1 and 2 following the calculation procedure in Section 3.

Original Seismic MUPSA Model (Model A)
In this study, two seismic SUPSA fault trees are connected by an AND gate and an OR gate to calculate the MUCDF and SCDF, respectively. Each seismic SUPSA fault tree in Figure 1 has four correlated seismic failures of redundant/identical components (X1 to X4 for U1 and X5 to X8 for U2), which exist under the two AND gates. The seismic MUPSA fault tree in Figure 2 has eight correlated seismic failures (X1 to X8). Since there is no fault tree simplification in Figures 1 and 2 by the assumption of the full correlation among seismic failures, best-estimate SUCDF and MUCDF are calculated by the fault trees in Figures  1 and 2 following the calculation procedure in Section 3.       calculated by multiplying the seismic initiating event frequency and CCDPs in Equations (1) and (2), respectively. In a usual MUPSA [10], CCDP single−unit was defined as p(U1/U2) + p(/U1U2). However, CCDP single−unit is defined as p(U1) = p(U1/U2) + p(U1U2) or p(U2) = p(/ U1U2) + p(U1U2) for the streamlined explanation of SUPSA in this study. That is, SUCDF denotes the multiplication of seismic initiating event frequency and p(U1) or p(U2) in this study.

Original Seismic MUPSA Model (Model A)
In this study, two seismic SUPSA fault trees are connected by an AND gate and an OR gate to calculate the MUCDF and SCDF, respectively. Each seismic SUPSA fault tree in Figure 1 has four correlated seismic failures of redundant/identical components (X1 to X4 for U1 and X5 to X8 for U2), which exist under the two AND gates. The seismic MUPSA fault tree in Figure 2 has eight correlated seismic failures (X1 to X8). Since there is no fault tree simplification in Figures 1 and 2 by the assumption of the full correlation among seismic failures, best-estimate SUCDF and MUCDF are calculated by the fault trees in Figures  1 and 2 following the calculation procedure in Section 3.

Simplified Seismic MUPSA Model (Model B)
The combination probabilities of correlated seismic failures such as P 1...n (a) and P 1+...+n (a) are calculated using MVN integration, as shown in Equations (3) and (4) [18,23]. If the correlated seismic failures of redundant/identical components are assumed to have a full correlation, the MVN integration is simplified to a single-variable normal (SVN) integration, as shown on the right-hand side of Equations (3) and (4).
Here, A im is the seismic capacity, β i is the composite beta of β 2 iR + β 2 iU , and z t is an integration vector that can be represented as z 1 z 2 · · · z n . The matrix Σ ρ is a symmetric correlation matrix, and Σ ρ is the determinant of Σ ρ . The correlation matrix is given by Equation (5) below, where ρ ij is the correlation between the seismic failures i and j.
Since the inverse matrix Σ −1 ρ does not exist for the full correlation ρ ij = 1, the MVN integrations in Equations (3) and (4) are impossible. In this case, the SVN integrations on the right-hand should be employed. As an alternative approximation, ρ ij = 0.999 instead of 1 can be used for MVN integrations.
In Model B, all correlated seismic failures of redundant/identical components in a single nuclear unit are replaced with one typical seismic failure with the full correlation assumption. The four correlated seismic failures that are under the two AND gates in Figure 1 are simplified to one seismic failure in Figure 3 by applying the full correlation assumption. As shown in Equation (3), this simplification guarantees a conservative SUCDF. The combination probabilities of correlated seismic failures such as 1… ( ) and 1+⋯+ ( ) are calculated using MVN integration, as shown in Equations (3) and (4) [18,23]. If the correlated seismic failures of redundant/identical components are assumed to have a full correlation, the MVN integration is simplified to a single-variable normal (SVN) integration, as shown on the right-hand side of Equations (3) and (4).
Here, is the seismic capacity, is the composite beta of √ 2 + 2 , and is an integration vector that can be represented as [ 1 2 ⋯ ]. The matrix is a symmetric correlation matrix, and | | is the determinant of . The correlation matrix is given by Equation (5)   Simplified fault trees such as that in Figure 3 are combined into SCDF and MUCDF fault trees in Figure 4. As shown in Equation (3), if the full correlation assumption is applied to correlated seismic failures that are under an AND gate, the AND gate probability is maximized. As shown in Figure 4, the seismic events X1 and X5 are combined with an AND gate at the top level for MUCDF. If the full correlation assumption is applied to X1  Simplified fault trees such as that in Figure 3 are combined into SCDF and MUCDF fault trees in Figure 4. As shown in Equation (3), if the full correlation assumption is applied to correlated seismic failures that are under an AND gate, the AND gate probability is maximized. As shown in Figure 4, the seismic events X1 and X5 are combined with an AND gate at the top level for MUCDF. If the full correlation assumption is applied to X1 and X5, the conservative MUCDF can be calculated if the full correlation assumption is applied to X1 and X5. and X5, the conservative MUCDF can be calculated if the full correlation assumption is applied to X1 and X5.
As shown in Equation (4), if the full correlation assumption is applied to correlated seismic failures that are under an OR gate, the OR gate probability is minimized. As shown in Figure 4, the seismic events X1 and X5 are combined with an OR gate at the top level for SCDF. If the full correlation assumption is applied to X1 and X5, the SCDF will be non-conservative, and therefore, it will not be allowed in the NPP regulation.

Objectives of This Study
NPP regulation does not allow any non-conservative seismic risks for the SUCDF, MUCDF, or SCDF. Hence, the objective of this study was to perform a sensitivity calculation of these seismic CDFs by varying the seismic correlation level of redundant/identical component failures in seismic SUPSA and MUPSA in order to (1) investigate whether seismic risks can be conservatively calculated under the full correlation assumption, (2) determine the level of overestimation of seismic risks when this assumption is applied to redundant/identical components, and (3) identify the type of the seismic PSA model appropriate for NPP regulation for SUCDF, MUCDF, and SCDF.
The objectives were very difficult to achieve since the seismic MUPSA fault tree has both intra-unit and inter-unit correlated seismic failures of redundant/identical components. Furthermore, MVN integration is impossible when correlated seismic failures are located under different logical gates in the SUPSA or MUPSA fault tree. Therefore, the correlated seismic failures were converted into seismic CCFs using the COREX tool [23], as explained in Section 3.1. The correlated seismic failures in Figures 2 and 4 were converted into seismic CCFs in Figures 5 and 6, respectively. The SUCDF, SCDF, and MUCDF could then be easily calculated using the same techniques and tools used in the internal PSA.  (4), if the full correlation assumption is applied to correlated seismic failures that are under an OR gate, the OR gate probability is minimized. As shown in Figure 4, the seismic events X1 and X5 are combined with an OR gate at the top level for SCDF. If the full correlation assumption is applied to X1 and X5, the SCDF will be non-conservative, and therefore, it will not be allowed in the NPP regulation.

Objectives of This Study
NPP regulation does not allow any non-conservative seismic risks for the SUCDF, MUCDF, or SCDF. Hence, the objective of this study was to perform a sensitivity calculation of these seismic CDFs by varying the seismic correlation level of redundant/identical component failures in seismic SUPSA and MUPSA in order to (1) investigate whether seismic risks can be conservatively calculated under the full correlation assumption, (2) determine the level of overestimation of seismic risks when this assumption is applied to redundant/identical components, and (3) identify the type of the seismic PSA model appropriate for NPP regulation for SUCDF, MUCDF, and SCDF.
The objectives were very difficult to achieve since the seismic MUPSA fault tree has both intra-unit and inter-unit correlated seismic failures of redundant/identical components. Furthermore, MVN integration is impossible when correlated seismic failures are located under different logical gates in the SUPSA or MUPSA fault tree. Therefore, the correlated seismic failures were converted into seismic CCFs using the COREX tool [23], as explained in Section 3.1. The correlated seismic failures in Figures 2 and 4 were converted into seismic CCFs in Figures 5 and 6, respectively. The SUCDF, SCDF, and MUCDF could then be easily calculated using the same techniques and tools used in the internal PSA. Table 1 has a summary of Section 1. In the traditional seismic SUPSA, a seismic CDF calculation was impossible when correlated seismic failures spread over a fault tree. To avoid this problem, the correlated seismic failures were replaced with one seismic failure by assuming a full correlation among the seismic failures. Fortunately, the recent COREX method [23] made it possible to calculate accurate seismic CDF by converting correlated seismic failures into seismic CCFs. This study is the first application of the COREX method. Model A in Figure 5 is a complete COREX method application to seismic SUPSA and MUPSA, and Model B in Figure 6 is a hybrid of a full correlation assumption and the COREX method application.    Table 1 has a summary of Section 1. In the traditional seismic SUPSA, a seismic CDF calculation was impossible when correlated seismic failures spread over a fault tree. To avoid this problem, the correlated seismic failures were replaced with one seismic failure by assuming a full correlation among the seismic failures. Fortunately, the recent COREX method [23] made it possible to calculate accurate seismic CDF by converting correlated seismic failures into seismic CCFs. This study is the first application of the COREX method. Model A in Figure 5 is a complete COREX method application to seismic SUPSA and MUPSA, and Model B in Figure 6 is a hybrid of a full correlation assumption and the COREX method application.      Table 1 has a summary of Section 1. In the traditional seismic SUPSA, a seis calculation was impossible when correlated seismic failures spread over a faul avoid this problem, the correlated seismic failures were replaced with one seism by assuming a full correlation among the seismic failures. Fortunately, the recen method [23] made it possible to calculate accurate seismic CDF by converting c seismic failures into seismic CCFs. This study is the first application of the COREX Model A in Figure 5 is a complete COREX method application to seismic SU MUPSA, and Model B in Figure 6 is a hybrid of a full correlation assumption COREX method application.    Figure 3).

Approximate
COREX method [23] COREX method is always applicable even when correlated seismic failures spread over a fault tree.
Correlated seismic failures are converted into seismic CCFs without any assumption.

Best estimate
Energies 2021, 14, 2955 7 of 20 Seismic SUPSAs have been performed for decades with simplified seismic SUPSA models assuming a full correlation among the correlated seismic failures. In recent seismic MUPSAs, these imperfect SUPSA models have been combined into a seismic MUPSA model that is similar to Model B. Current seismic MUPSAs have been performed with this imperfect seismic MUPSA model forgetting the full correlation assumption and without awareness of the possibility of the seismic CDF distortion that can result from the full correlation assumption. There has been no study to confirm the seismic CDF distortion from the full correlation assumption. In this study, an accurate seismic MUPSA model (Model A) and an imperfect seismic MUPSA model (Model B) were created and their seismic risks were compared to provide PSA industry and regulators with proper insights regarding this seismic CDF distortion. Figure 7 shows the event tree of OPR1000 NPPs used for the seismic SUPSA in this study. The event tree has four accident sequence headings that cause core damage. Loss of essential power system (LOEPS) denotes failure of the 480-V alternating current (AC) and 125-V direct current (DC), and small loss-of-coolant accident (SLOCA) causes core damage owing to the failure of instrument piping. Furthermore, large loss-of-coolant accident (LLOCA) indicates large coolant loss owing to the failure of safety injection tanks, and loss of process control system (LOPCS) implies the failure of power to operate the components used for safety functions. These accident sequence headings were separated into Trains A and B (see Figure 8). The numbers of basic events for the fault trees of the accident sequence headings are listed in Table 2.

SUCDF Fault Trees
spread over a fault tree. Seismic SUPSAs have been performed for decades with simplified seismic SUPSA models assuming a full correlation among the correlated seismic failures. In recent seismic MUPSAs, these imperfect SUPSA models have been combined into a seismic MUPSA model that is similar to Model B. Current seismic MUPSAs have been performed with this imperfect seismic MUPSA model forgetting the full correlation assumption and without awareness of the possibility of the seismic CDF distortion that can result from the full correlation assumption. There has been no study to confirm the seismic CDF distortion from the full correlation assumption. In this study, an accurate seismic MUPSA model (Model A) and an imperfect seismic MUPSA model (Model B) were created and their seismic risks were compared to provide PSA industry and regulators with proper insights regarding this seismic CDF distortion. Figure 7 shows the event tree of OPR1000 NPPs used for the seismic SUPSA in this study. The event tree has four accident sequence headings that cause core damage. Loss of essential power system (LOEPS) denotes failure of the 480-V alternating current (AC) and 125-V direct current (DC), and small loss-of-coolant accident (SLOCA) causes core damage owing to the failure of instrument piping. Furthermore, large loss-of-coolant accident (LLOCA) indicates large coolant loss owing to the failure of safety injection tanks, and loss of process control system (LOPCS) implies the failure of power to operate the components used for safety functions. These accident sequence headings were separated into Trains A and B (see Figure 8). The numbers of basic events for the fault trees of the accident sequence headings are listed in Table 2.    Figures 8 and 9 show SUPSA fault trees for the seismic event tree in Figure 7. The seismic failures of redundant/identical components can be simplified to one seismic failure by applying the full correlation assumption to the correlated seismic failures of redundant/identical components. For example, the four seismic failures SITSF_A, SITSF_B, SITSF_C, and SITSF_D in Figure 8 can be simplified to one seismic failure, namely SITSF, in Figure 9 by this full correlation assumption. As listed in Table 3 Figure 10 can be simplified to one seismic failure in Figure 11 by applying the full correlation assumption to correlated seismic failures of redundant/identical components. For example, the four seismic failures U1-SITSF_A, U1-SITSF_B, U1-SITSF_C, and U1-SITSF_D in Figure 10 can be simplified to one seismic failure, namely U1-SITSF, in Figure 11 by this full correlation assumption. Similarly, the four seismic failures U2-SITSF_A, U2-SITSF_B, U2-SITSF_C, and U2-SITSF_D can be simplified to one seismic failure, U2-SITSF. As listed in Table 4, 11 groups of correlated seismic failures in Model A were simplified to 11 seismic failures for each NPP in Model B.

SCDF Fault Trees
If the AND logic at the top level of the MUCDF fault trees in Figures 10 and 11 is replaced with OR logic, the trees become SCDF fault trees for Models A and B, respectively.

Seismic Data
The ground acceleration was divided into seven intervals, as shown in Table 5, and the mean ground acceleration in each interval was used for calculating the seismic SUCDF, MUCDF, and SCDF. The seismic data in Table 5 was used for calculating the probability of seismic failures in Tables 3 and 4. failures U1-SITSF_A, U1-SITSF_B, U1-SITSF_C, and U1-SITSF_D in Figure 10 can be simplified to one seismic failure, namely U1-SITSF, in Figure 11 by this full correlation assumption. Similarly, the four seismic failures U2-SITSF_A, U2-SITSF_B, U2-SITSF_C, and U2-SITSF_D can be simplified to one seismic failure, U2-SITSF. As listed in Table 4, 11 groups of correlated seismic failures in Model A were simplified to 11 seismic failures for each NPP in Model B.

SCDF Fault Trees
If the AND logic at the top level of the MUCDF fault trees in Figures 10 and 11 is replaced with OR logic, the trees become SCDF fault trees for Models A and B, respectively.

Conversion of Correlated Seismic Failures into Seismic CCFs
The combination probability of correlated seismic failures can be calculated through MVN integration using Equations (3) or (4) if they are located under the same logical gate in a fault tree. However, the correlated seismic failures of redundant/identical components are separately located under several logical gates in a fault tree that has correlated seismic failures. In short, the gate probability cannot be calculated by MVN integration.
In the previous study [23], a method to convert correlated seismic failures into seismic CCFs was developed to overcome this problem. If the correlated seismic failures of redundant/identical components that are separately located under several logical gates can be converted into seismic CCFs, the seismic SUCDF, MUCDF, and SCDF can be calculated with the same techniques and tools used for the internal PSA.
Then, as explained in Figures 5 and 6, the n seismic failures (X 1 , X 2 , . . . , X n ) are converted into OR gates that have corresponding seismic CCFs (C i , C ij , C ijk , . . . ), as shown in Equation (7). In other words, all the correlated seismic failures in the fault trees of Figures 8-11 are converted into OR gates that have corresponding seismic CCFs.

Seismic Risk Calculation
As explained in Sections 1.6 and 3.1, the correlated seismic failures were converted into seismic CCFs using the COREX tool [23]. Subsequently, minimal cut sets (MCSs) for single-unit conditional core damage probability (SUCCDP), multi-unit conditional core damage probability (MUCCDP), and site conditional core damage probability (SCCDP) were calculated using the same techniques and tools used in the internal PSA. Additionally, the MCSs were converted into a binary decision diagram (BDD) for calculating the SUCCDP, MUCCDP, and SCCDP more accurately. The SUCDF, MUCDF, or SCDF was then calculated using the following equation, which is similar to the equation used for the seismic PSA for the Surry NPP [17]: where a i is the ground acceleration at the center of the ith interval, CCDP(a i ) is the seismic CCDP at a i , and H(a i ) is the mean seismic frequency in Table 5.

Calculation Results for SUCCDP and SUCDF
As shown in Figures 12 and 13, SUCDF and SUCCDPs of Model A were calculated by varying both the ground acceleration in Table 5 and the correlation level of redundant/identical components in Table 3. The SUCCDPs of Model B could not be calculated for the partial correlation since one NPP had only one representative seismic failure of redundant/identical components.
Energies 2021, 14, x FOR PEER REVIEW probabilities, and then these OR combination probabilities are converted into CCFs in Equation (6). On the other hand, SVN integration is employed for the fu lation calculation of Model B. So, there are minor differences in the SUCCDPs fo correlation calculations between Models A and B. Figure 12 was calculated by multiplying the SUCCDPs in Figure 13 and th seismic frequencies in Table 5 and summing the products. Since the AND com probability increased with the correlation, as explained in Equation (3), the SU Model A increased with the correlation level. As shown in Figure 12, Models yielded conservative SUCDFs for the full correlation assumption.
If there is no sufficient safety margin for the corresponding NPP safety g SUCDF of Model A with the real correlation is recommended instead of SUCDF o B which is calculated under the full correlation assumption.

Calculation Results for MUCCDP and MUCDF
As shown in Figures 14 and 15, MUCDF and MUCCDPs of Models A and B were compared by varying the ground acceleration in Table 5 and the correlation level of intraunit and inter-unit redundant/identical components in Table 4.
In Model A, all correlated seismic failures of intra-unit and inter-unit redundant/identical components are converted into seismic failures. In Model B, all correlated seismic failures of intra-unit redundant/identical components are replaced with one typi- In order to avoid singular Σ ρ for the full correlation calculation of Model A, MVN integration with ρ ij = 0.999 instead of 1.0 is used for calculating the OR combination probabilities, and then these OR combination probabilities are converted into seismic CCFs in Equation (6). On the other hand, SVN integration is employed for the full correlation calculation of Model B. So, there are minor differences in the SUCCDPs for the full correlation calculations between Models A and B. Figure 12 was calculated by multiplying the SUCCDPs in Figure 13 and the mean seismic frequencies in Table 5 and summing the products. Since the AND combination probability increased with the correlation, as explained in Equation (3), the SUCDF of Model A increased with the correlation level. As shown in Figure 12, Models A and B yielded conservative SUCDFs for the full correlation assumption.
If there is no sufficient safety margin for the corresponding NPP safety goals, the SUCDF of Model A with the real correlation is recommended instead of SUCDF of Model B which is calculated under the full correlation assumption.

Calculation Results for MUCCDP and MUCDF
As shown in Figures 14 and 15, MUCDF and MUCCDPs of Models A and B were compared by varying the ground acceleration in Table 5 and the correlation level of intraunit and inter-unit redundant/identical components in Table 4. As shown in Figure 15, Models A and B had the highest MUCCDP at the full correlation. The MUCCDPs of both models increased with the ground acceleration. The MUCCDP of Model A for 0.85 g showed a rapid jump in correlation level from 0 to 0.2, and it was almost constant for the other correlation values. This means that all the components failed even at low correlation levels. In Model A, all correlated seismic failures of intra-unit and inter-unit redundant/identical components are converted into seismic failures. In Model B, all correlated seismic failures of intra-unit redundant/identical components are replaced with one typical seismic failure with the full correlation assumption, and then the correlated seismic failures of inter-unit redundant/identical components are converted into seismic CCFs.
The MUCDFs in Figure 14 were calculated by multiplying the MUCCDPs in Figure 15 and the mean seismic frequencies in Table 5 and summing the products. The MUCDFs of both Models A and B increased with the correlation level among the seismic failures of redundant/identical components, and the MUCDFs of both models were redundant/identical in the case of full correlation. The full correlation assumption resulted in conservative MUCDFs of Models A and B. However, Model A is recommended for the best-estimate calculation of MUCDF in all correlation ranges.

Calculation Results for SCCDP and SCDF
As shown in Figures 16 and 17, the SCDF and SCCDPs of Models A and B for all ground accelerations in Table 5 are compared. The SCDF and SCCDPs are calculated by increasing the correlation level among intra-unit and inter-unit seismic failures of redun- As shown in Figure 15, Models A and B had the highest MUCCDP at the full correlation. The MUCCDPs of both models increased with the ground acceleration. The MUCCDP of Model A for 0.85 g showed a rapid jump in correlation level from 0 to 0.2, and it was almost constant for the other correlation values. This means that all the components failed even at low correlation levels.

Calculation Results for SCCDP and SCDF
As shown in Figures 16 and 17, the SCDF and SCCDPs of Models A and B for all ground accelerations in Table 5 are compared. The SCDF and SCCDPs are calculated by increasing the correlation level among intra-unit and inter-unit seismic failures of redundant/identical components in Table 4.  Figure 16 shows SCDFs of Models A and B that are calculated by multiplying the seismic initiator frequencies in Table 4 by the SCCDPs in Figure 17 and summing the products. It can be seen that the SCDF of Model B is unacceptably overestimated in all correlation ranges. The SCDFs of Models A and B are redundant/identical for the full correlation. The SCDF of Model B is so highly overestimated in the low correlation level that it cannot be used for NPP regulation purposes. It is recommended that the SCDF of Model A be used for NPP regulation purposes, since it is the best-estimate SCDF.
In Figure 17, the SCCDPs of Model B globally decrease over the seismic correlation level, although the SCCDPs of Model B below 0.225 g slightly increase and then decrease when the seismic correlation increases.
The SCCDP of Model A increases as the correlation level increases when the ground acceleration is less than 0.5 g. However, it decreases as the correlation level increases when the ground acceleration is greater than 0.5 g. This means that the SCCDP changes of Model A depend on the seismic model and seismic data. On the other hand, the SCCDP of Model B generally decreases as the correlation level increases for all ground accelerations.

Conclusions
A sensitivity study was performed by varying the correlation level and ground acceleration pertaining to seismic fault trees of OPR1000 NPPs to understand seismic risk changes. Furthermore, seismic risks calculated from the seismic fault trees of Models A and B were compared. The results of this sensitivity study can be summarized as follows: 1. As the correlation level increased, the seismic risks, i.e., SUCDF, MUCDF, and SCDF, increased for Model A. The seismic risks of Model A were always lower than those

Conclusions
A sensitivity study was performed by varying the correlation level and ground acceleration pertaining to seismic fault trees of OPR1000 NPPs to understand seismic risk changes. Furthermore, seismic risks calculated from the seismic fault trees of Models A and B were compared. The results of this sensitivity study can be summarized as follows:

1.
As the correlation level increased, the seismic risks, i.e., SUCDF, MUCDF, and SCDF, increased for Model A. The seismic risks of Model A were always lower than those of Model B. Therefore, all the seismic risks of Model A can provide a sufficient safety margin for the corresponding safety goals.

2.
As the correlation level increased, the seismic risks SUCDF and MUCDF of Models A and B increased. Arguably, Models A and B appeared to guarantee conservative seismic SUCDF and MUCDF. 3.
The SCDF of Model B was strongly distorted in all correlation ranges compared with that of Model A. Therefore, one should be careful to utilize Model B.
In this paper, Model A is a complete COREX method [23] application to the seismic SUPSA and MUPSA, and Model B is a hybrid of a full correlation assumption and the COREX method application. Current seismic MUPSAs in Korea employ Model B, in which the full correlation assumption is applied to the correlated seismic failures of redundant/identical components in a single nuclear unit and then the remaining correlated seismic failures between nuclear units are converted into seismic CCFs. This resulted in distorted seismic risks. Therefore, one should be very careful to employ Model B if multi-unit safety goals are established and mandated in the future. Therefore, the use of Model A is recommended for calculating accurate seismic CDFs for seismic SUPSA and MUPSA.
Since there had been no method to calculate seismic CDF from the fault tree that has correlated seismic failures in the traditional seismic SUPSA, the fault tree has been simplified by replacing correlated seismic failures with one typical seismic failure by assuming a full correlation among the correlated seismic failures. Then, approximate seismic CDFs have been calculated. The results of this study showed that the seismic CDFs in SUPSA and MUPSA are distorted when the full correlation is employed. Fortunately, the authors of this study recently developed the COREX method [23] that can calculate accurate seismic CDFs by converting correlated seismic failures into seismic CCFs. Therefore, it is recommended that the COREX method to convert correlated seismic failures into seismic CCFs be employed in seismic SUPSA and MUPSA to avoid the distortion of seismic CDFs.
The results of this study show that the seismic CDFs in SUPSA and MUPSA are drastically distorted and safety margins are accordingly distorted when the full correlation assumption is employed. Thus, very careful attention should be paid to calculating and interpreting seismic CDFs for single-unit and multi-unit NPP regulations.