ML113130260

Questions and Comments About the Probabilistic Risk Analysis

ML113130260
Person / Time
Site:	Cook
Issue date:	11/08/2011
From:	Leslie Fields NRC/NRR/DRA/APLA
To:
Tam P
References
TAC ME6629, TAC ME6630
Download: ML113130260 (7)

Text

DC Cook Site Audit (PRA) 1

1) An initial presentation on the mechanics of developing the fire PRA results would be very helpful. That is, examples of internal event trees, internal fault trees and how the models are quantified (e.g., single top event or scenarios). This would be followed by explanations of how the internal events results are manipulated to obtain the fire PRA results. That is, what data files include the component failures, what files include the IE assigned to the ignition sources, and how are the failed events and associated initiating events combined into final results. As part of the presentation include discussion of how the various disciplinary groups (e.g., circuit analysts, fire modelers and human reliability analyst) interfaced, interacted and iterated with the PRA model and modelers to assure the integrity of the PRA.

2) The gap analysis performed in 2004 would only have identified gaps between the RA-Sa-2003 and the original Peer Review in 2001. The Focused scope Peer Review conducted in 2009 seemed to be fully focused on the new system models. This implies that the internal events PRA was never reviewed against RA-Sa-2009 as required to support a claim on compliance with RG 1.200, Revision 2. There were major changes between the internal events SRs between the RA-Sa-2003 and RA-Sb-2005 version of the standard (as endorsed by RG 1.200) but your gap analysis was done prior to these changes. Compliance with RG 1.200 Revision 2 is expected for all LARs submitted after March 2010. The quality of the internal events PRA against the requirements of RG 1.200, Revision 2 needs to be established. How would you propose to accomplish this?

3) In some cases, e.g., FZ-145 in AA50, extensive use of unit 2 equipment is credited to bring unit 1 into a safe and stable state and vice versa. Please describe the reviews that were conducted to ensure that use of unit 2 equipment is properly modeled in unit 1 PRA and vice versa. How symmetrical are the units when one units equipment is used to shut down the other unit (e.g., AA50 and AA51 have similar names but different risk profiles). Was it necessary to make any changes to the Unit 1 and Unit 2 PRAs to properly model all the interactions?

4) Sections 4.7 on Defense-in-depth in the Fire Risk Evaluations (e.g., PRA-FIRE-17663-701-AA50) lay out quantitative criteria for PRA input to defense-in-depth (e.g., CDF>1E-6/yr) and potentially risk significant fire scenarios where echelon 1 or 2 are causing a significant reduction (e.g., CDF between 1E-6/yr and 1E-8/yr). In this example, Table 4-8 identifies a number of fire scenarios that meet the quantitative guidelines for risk significant (e.g., FZ-57) and potentially risk significant (e.g., FZ-144). Table 4-3 of the LAR identifies fire protection systems and features required for for risk significance and DID. We note that in Table 4-3 of the LAR many fire areas are indicated as risk significance while DID credit is not indicated for any fire area. Please describe how this information (i.e., risk significance criteria, DID Echelon levels, and the risk significance indicated in LAR Table 4-3) is combined to demonstrate DID credit for fire protection safety systems and features. In this example, it would appear that zone 144 protection and/or suppression should have a Y for DID requirements but it does not. Clarify how credited DID systems and features are reflected in the FPRA model, and how the

DC Cook Site Audit (PRA) 2 Required for? column in Table 4-3 of the LAR and Section 4.7 of the Fire Risk Evaluations are related.

5) Section 4.2.1.2 defines safe and stable as achieving hot standby using an initial coping time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The last full paragraph on page 21 notes that some operator actions are directed by existing operating procedures and may be required to extend NFPA 805 safe and stable plant operation beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Are all the required actions currently in the plant procedures and the PRA and, if not, which actions are missing and how will these new action be developed and treated. Please evaluate quantative or qualitatively the risk associated with actions necessary to extend safe and stable beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given the post-fire scenarios during which they may be required. The general statement that 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is adequate time to muster personnel and mitigate any fire scenario may not always be sufficient.

6) [Security-related information deleted]

7) [Security-related information deleted]

8) The third bullet on page 25 of 43 PRA-FIRE-17663-701-AA50 In the event of an actual fire with limited damage, any recovery action assigned to this area may have to be performed. Thus, all recovery actions are credited for this area. However, depending on the actual circumstances of the fire, it is unlikely that any fire would require all recovery actions. Could you explain these statements?

DC Cook Site Audit (PRA) 3

9) Are there any recovery actions credited for a VFDR, that must be carried out in the area where the fire that causes the VFDR is located? If so, how is the likelihood that the RA succeeds modified to account for the fact that the action must be carried out in the same area that the fire is located?

10) Table V-1 of the LAR addresses 62 of the 177 F&O identified in the WOG Peer Review report (LTR-RAM-II-10-041). This particular subset of F&O ranged from Met to Not Met and from CC-I to CC-II/III, but did encompass all F&O Dispositioned as Not Met and CC-I. Dispositions were provided for all 62 F&O identified in Table V-1 but no rationale was given for the selection of this particular subset of F&Os. In light of this provide an explanation for why this subset (and only this subset) was evaluated for disposition in Table V-1.

11) Propagation of parameter uncertainties through a PRA models can somewhat increase the mean value estimated because some of the input parameters are from the same pool of data (state of knowledge correlations). You have not propagated the parametric uncertainty because you have concluded that they are not important for 805 transition.

Your change in risk estimates of about 9E-5/yr and 6E-7/yr are quite close to the acceptance values n RG 1.174. Propagation of parameter uncertainties may cause these values to exceed the acceptance guidelines. Propagation of parameter uncertainty may be required to determine if the acceptance guidelines are exceeded or not.

12) NFPA 805 Section 2.4.4.1 requires licensees to evaluate the cumulative effect of plant changes (including all previous changes that have increased risk) on overall risk in accordance with Section 3.3.2 of RG 1.174. While the LAR provides the delta core damage frequency (CDF) and large early release frequency (LERF) of the variances from deterministic requirements (VFDRs) for each fire area, the LAR does not describe either generally or specifically how delta CDF or LERF were calculated. Provide a description of how delta CDF and LERF were calculated. Include in the description identification of any modeling development performed after the fire PRA peer review and what modeling manipulations were performed in support of the delta risk calculations.

13) Internal events PRA quality: It appears that many of the internal events F&Os are disposition with the statement, [t]he disposition for the Internal events PRA model brought the affected Supporting Requirement up to at least Capability Category II. Only a new peer review can summarize its conclusions in this manner.

Some specific issue with the internal events PRA that appear to have the potential to noticeably impact the fire change in risk analysis results but which are not obviously closed include:

a) AS-04 indicates that there are logic problems in the AFW functions in the SBO event trees but this is judged unimportant because there is no effect on the internal events

DC Cook Site Audit (PRA) 4 PRA model. Please provide examples of the failure branch probability assignments and associated documentation. Why is this also unimportant in the fire PRA models for which SBO is a more frequent scenario?

b) AS-06 indicates discussion of functional failure criteria for the event trees is lacking.

Please explain how it is assured that the event tree functional failure are properly characterized (e.g., linked to the appropriate fault trees) when there is no documentation.

c) Please explain how AS-07, AS-08, AS-10, AS-11, AS-11 have been resolved.

d) For the F&O AS-A10, AS-B3, and SC-A6 (page U-7), it states that Since, no fire consequentially causes as interfacing Systems LOCA on one of the modified pathways, there is no effect of this F&O on NFPA-805 change evaluation. PRA-RAI-002 Rev 0 Attachment 6C (DC Cook MSO Expert Panel Report) states that the FPRA modeled all four ISLOCA groups in the internal events PRA. What is the effect the modeling incompleteness referred to in these F&O on the CDF and LERF?

e) The F&O (page U-7) that begins with AS-A10, SC-A12, identifies weakness in modeling the failure to refill the condensate storage tank (CST). The resolution is, in part, that fires that preclude refilling the CST are directly addressed in the fire PRA.

Without complete PRA models identifying the SSCs whose failure could preclude refill, how was the effect of all fires evaluated on the refill capability. Conversely, how important is the CST refill function to help mitigate scenarios cause by fires but that do not affect the refill capability.

f) F&O (page U-8) AS-B3, LE-D1, LE-D6 indicates that containment purge can be open 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br /> per year but this containment isolation failure mode is not modeled. The resolution is, in part, that this containment failure is unlikely because in addition to the purge being open, two isolation valves must fail to close - so this failure mode is still not modeled. The probability of failing to close for multiple valves can be 1.0 given a fire. Please evaluate this containment isolation failure scenario for fire.

g) F&O DA-C1, DA-D6-01, and DA-E2-01 are dismissed as a documentation issue or as having small numerical impact in Table U. There is a note in PRA-RAI-002 Rev 0 C (PRA Update Report) that the reviewer had not confirmed that the component boundaries used in the PRA matched those of the data sources. Please confirm that these data boundaries match.

h) F&O (page U-11) indicates that the values selected for unique unavailabilities were not in all cases best estimate or conservative. What are these basic events and what has been done to address this F&O?

DC Cook Site Audit (PRA) 5 i) The disposition for F&O HR-G6-01 (page U-16) indicates that HEP dependency analysis exists but was not provided to the Peer Review team. RAI-002 Rev 0 C (PRA Update Report) indicates that PRA element HR-G6 was not addressed (page 54). Similar discrepancies exist for other F&O such DA-D4-01.

Explain such apparent discrepancies. Also, identify documentation where HEP dependency analysis resides.

j) IE F&O QU-02 (page U-20) states that a house event was used for loss of DC in fault trees CCW and ESW. A house event can not accurately model the impact of fires that can fail cables. The reported resolution is the generic resolution that the SR has been brought up to CC II. Please explain how loss of DC is currently modeled in the internal events PRA.

k) The disposition for F&O IE-C1 (page U-23) states that the impact of increased unavailability is small and that otherwise the modeling is conservative, but does not address the other issue brought up in the F&O. In the original F&O (page B-69 of PRA-RAI-002 Rev 0 Attachment 6A) states that bottled air supply for PORV operation was not confirmed for the required mission (24 hrs). How long is the bottled air supply adequate? How is this limited supply addressed for maintaining the long term safe and stable status, both up to and after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />? Please describe any actions as modeled in the PRA.

l) The summary and disposition for F&O SY-A19 does not appear to be related to the issue cited (environmental effects on supplemental diesel generator) based on page 97 of PRA-RAI-002 Rev 0 Attachment 6C (PRA Update Study Report) page 97.

Explain this apparent discrepancy.

m) The disposition for F&O Th-02 dismisses this F&O based on the fact that fires do not cause large LOCAs. However, the issue discussed in the F&O is broader than the unavailability of MAAP runs for large LOCA as it applies to reviewable documentation supporting all success criteria. Discuss whether and how this issue of reviewable success criteria bases was addressed for the FPRA.

14) Fire PRA Quality: The following issue with the fire PRA appear to have the potential to noticeably impact the fire change in risk analysis results but which are not obviously closed include:

a. Internal Events PRA F&Os IE-02 identifies some cases where more severe initiating events were grouped into less severe initiating event groups and IE-04 indicate that a structured process was not discussed (and therefore perhaps not used). Fire F&O ES-A1-1 states that the fire PRA component selection report simply references the internal events initiating events analysis. Is it possible that more severe fire caused initiating events were grouped into less severe initiating events or that initiating events were missed?

DC Cook Site Audit (PRA) 6

b. In response to FQ-A4-1, Cook states that state-of-knowledge correlations between fire specific event probabilities were identified. Note that state-of-knowledge correlations between parameters can affect the mean value estimates when parameter uncertainty is propagated though the quantification (e.g., the same randomly selected fails-to-open probability is used for all fails-to-open basic events in one monti-carlo sample). The response to UNC-A1-1 states that parametric uncertainties were propagated through the fire models for risk significant fire zones.

This appears to conflict with the response to FSS-E3 and FSS-H5 that state that parametric data uncertainty does not provide meaningful insights and is not applicable to the NFPA-805 submittal.

c. In response to F&Os CS-C3-1, CS-A11-1 Cook stated that, there were no instances where the engineers used engineering judgment in the entire cable route. Please clarify to what extent engineering judgment was used in identifying cable routing and to what extent these judgments could affect the risk evaluations.

d. In response to CS-B1-01 and CS-C4-1, Cook stated that the Technical evaluation report 12.5 identifies power supplies that could have common power supplies and common enclosures, but that a technical evaluation is under way with the expectation that there will be no potential issues. Please provide the results of this evaluation.

e. In response to PRM-B9-1, Cook stated that, adequate justifications were developed for any fire-induced impacts that were not modeled. Please summarize the types of impacts that were not modeled and the justifications.

f. In response to FSS-A2-01 and 02 it states that treatment of fire induced spurious operations was upgraded from considering just one cable to multiple cables. In light of the possible significance of this update discuss what further analysis was needed to accomplish this update, how many concurrent cables are considered, e.g., how was spurious operations considered in the example provided in the F&O on page 61 of the WOG Peer Review report (LTR-RAM-II-10-041)

g. In response to FSS-C5-1, it states that the FPRA has been updated to include impact of thermoplastic cable installations and to address solid state components.

Clarify whether the effort to determine the cable types in all compartments undergoing detailed fire analysis was completed and that the information is incorporated.

h. In response to FSS-C8-1 it states that documentation has been updated to provide objective evidence that credited wraps are not subject to damage from high hazards sources. Describe briefly the bases for the assumption that there would be no mechanical or flame impingement due to HEAF.

DC Cook Site Audit (PRA) 7

i.

In response to FSS-D7-1 Cook states that Capability Category I is acceptable so that it is acceptable to not evaluate plant specific outlier behavior in the estimated unavailability of fire detection and suppression systems. This conclusion seems inconsistent with the high importance that these detection and suppression systems have on fire risk estimates which would indicate that this should be a Category II or even III SR. Please clarify how important these systems are to fire risk and contrast that with potential changes in unavailability, and how reasonably expected changes might change you change-in-risk estimate results (which currently lie very close to the acceptance guidelines). Include in your clarification discussion of the plant specific outlier behavior tracking project referred to in the F&O and any results from that project.

j.

In response to FSS-G6-1 it states that multi-compartment (MCAs) scenarios were quantified consistent with FQ requirements. Point to evidence that FIRE-PRA-17663 011C Table 5 MCA information has been carried forward to quantification of CDF/LERF.

k. F&O IGN-A7 discusses the special very low weighting factors for maintenance, storage and occupancy. Please confirm that these factors were used before the normalization to the plant wide frequency. In those cases where the total weighting factor for a room ended up less than 1, please discuss the sensitivity of the change in risk results on the accuracy of these factors.

l.

In response to F&O CF-AF-1 it states that the FPRA was reviewed and if appropriate updated based on NUREG/CR-6850 Appendix K. For the eleven suggested modifications listed in the F&O (see page 73 of LTR-RAM-II-10-041) identify those suggestions that were not taken and the accompanying rationale.