Text

PRA Change Summary for Reg Conf Letter 3-22 Final
	ML16092A032
Person / Time
Site:	River Bend
Issue date:	04/01/2016
From:	Cale Young; NRC/RGN-IV/DRP/RPB-C
To:	;
	Young C
References
	Download: ML16092A032 (9)
	v • d • e

PRA Model Changes to Include Control Room Cooling The RBS EOOS tool is used to assess the risk of maintenance in accordance with the Maintenance Rule (10 CFR 50.65 (a)(4)). It quantifies and displays the risk of a specific plant configuration in terms of Plant Safety Index (PSI). PSI is defined as 10 X (log of configuration specific annual CDF) / (log of the Zero Test and Maintenance (ZTM) Baseline CDF). Therefore the PSI of the ZTM configuration is 10. The CDF values calculated by EOOS can also be used to calculate Incremental Condition Core Damage Probability (ICDP), which is equal to the delta CDF (configuration CDF - ZTM CDF) divided by 8760 hours0.101 days 2.433 hours 0.0145 weeks 0.00333 months per year times the number of hours that the specific configuration exists. This is another measure used to determine the risk of maintenance.

EOOS R5 PRA Model During 2014 and until the present the EOOS model has been based on PRA Revision 5 which was peer reviewed in April 2011 against the ASME Standard. This model only considers the impact of HVK/HVC relative to the Control Building Switchgear room (SWGR) cooling and does not explicitly consider Main Control Room (MCR) cooling as a safety function. There were no findings in the Peer Review related to lack of MCR cooling in the PRA. This is consistent with industry practice which considers loss of MCR cooling a low risk contributor due to presence of operators in the MCR who would respond to increasing temperature and take appropriate actions. The low risk associated with loss of control room HVAC has been recognized by the NRC. As an example, per NRC-EPRI presentations at joint NRC-EPRI Fire PRA workshops, the slow effects of a loss of MCR HVAC are easily identified and recoverable before plant operation is adversely affected, making a loss of HVAC an initiator which does not need to be included in PRA models.

This model also did not credit the use of the service water (SWP) to directly cool the Control Building ACUs if HVK was lost even though it was included in the loss of control building ventilation procedure. It is noted that the MCR air conditioning units (HVC-ACU1A(B)) are modeled only for their impact on running chillers, since their failure will trip the chillers through interlocks in the control logic. However, the risk associated with MCR heat-up is highly correlated with the logic for Switchgear Room area heat-up due to commonalities in equipment and the modeling of HVC-ACU1A(B) MCR HVAC units.

R5-RHU Model In response to March 2015 Special Inspection, RBS developed a revised model (PRA R5-RHU), based on newly developed Control Building (CB) heat-up calculations and detailed equipment survivability studies to develop more realistic (versus the conservative design basis) PRA success criteria for cooling of electrical switchgear (SWGR) equipment. The survivability studies demonstrated that the electrical equipment would survive and continue to operate at temperatures higher than their conservative design temperature limits. The heat-up calculations used refined equipment heat loads and more realistic heat sinks along with the survivability temperatures to establish the time from loss of cooling that the most limiting equipment in a specific room would fail. This model addressed dependencies and developed revised human failure estimates for actions needed to ensure SWGR cooling. Specifically, the changes made included:

Added modeling for direct SW cooling to HVC-ACUs as a success path to restore SWGR cooling.

ML16092A032

Added human failure event (HFE) to open Div. 1 and Div. 2 AC switchgear room doors within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (analyses determined 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months were available instead of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months ).

Removed the requirement for portable fans to ensure 24-hour long-term cooling of Div. 1/2 SWGR rooms. The portable fans were not that effective for risk mitigation since they relied on offsite power and were removed from the PRA model because room heat-up analyses determined that opening SWGR doors at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months would ensure success for the mission time without any other action.

Div. 3 AC switchgear room dependency on room cooling removed (analyses determined that equipment in room would survive the expected conditions without restoring cooling or opening doors).

Added event to open Div. 1 and Div. 2 DC switchgear rooms in 30 min (per AOP-0060)

Div. 1 and Div. 2 battery room dependency on room cooling removed (analyses determined that the batteries would survive the expected conditions without restoring cooling or opening doors).

As a result of these changes PRA R5-RHU demonstrated significantly lower risk with a single Division of Chillers (HVK system) out of service due to realistic treatment of equipment survivability and actions to recover switchgear room cooling. A comparison of risk results, quantified at a truncation of 1E-11/yr, for the R5-RHU to those of the R5 EOOS model is provided in Table 1.

R5-RHU-MCR Model As indicated above, neither the RBS R5 EOOS nor the R5-RHU models include modeling of cooling to the MCR. The initial RBS effort to address MCR cooling issues focused on development of realistic GOTHIC heat-up calculations to determine the potential impact of higher temperatures on MCR equipment and, subsequently, operator performance. When it became clear that the NRC was interested in the risk associated with loss of MCR cooling RBS decided to incorporate modeling of MCR cooling into the R5-RHU model in order to assess the risk associated with loss of MCR cooling. This effort was started about the time the NRC closed their inspection activities in early October. The RBS-RHU model was revised to account for the realistic GOTHIC calculations and incorporate actions that were proceduralized prior to March 2015 to provide temporary cooling of the MCR. Most importantly, this model also conservatively accounts for the potential impact on operator MCR actions if cooling was not restored. The revised model, R5-RHU-MCR, was reviewed by a recognized industry expert, Mr. Gareth Parry, who has significant experience in PRA and Human Reliability Analysis. His conclusion was that, while it was not considered industry standard practice to model MCR HVAC in PRA models, the RBS approach was acceptable. Specifically, the changes made included:

Identified existing HFEs potentially impacted by loss of MCR cooling. Impacted HFEs that are those performed in the MCR after 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months following a loss of MCR cooling. This assumption is conservative because not all actions would fail due to high temperature and many of the actions can be performed at local panels.

Added fault tree logic and HFE basic events to account for operator actions to restore cooling.

The human reliability analyses (HRAs) for HFEs used in this model were developed assuming 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months time frame from loss of MCR HVAC to take action. The time frame is based on initial GOTHIC calculations using the design heat loads, and is conservative even for that assumption.

This assumption is very conservative since actual heat loads are less than 60% of the design heat loads and new Gothic calculations indicate that up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is available. Added HFEs include:

o HFE to open MCR cabinet doors in accordance with the Loss of Control Building Ventilation procedure, AOP-0060.

o HFE to remove MCR ceiling tiles during loss of offsite power (LOOP). This action allows hot air to rise into the normally stagnant upper volume of the MCR in accordance with Station Blackout procedure AOP-0050.

o HFE to start the installed MCR smoke removal fan for non-LOOP transient initiators, which along with opening the MCR doors and adjoining doors in the SW stair tower, would allow fresh air into the MCR. This HFE also includes task of removing MCR ceiling tiles.

Added loss of MCR HVAC logic (via OR gate) to impacted HFEs to model failure of the HFE when MCR cooling and cooling recovery actions fail.

As shown in Table 1, quantification of the R5-RHU-MCR model demonstrates that the impact of loss of MCR cooling is relatively insignificant for the cases with a division of HVK/HVC out of service based on the zero maintenance model. The increase in CDF over that of the R5-RHU model is approximately 1E-08/yr for the zero maintenance cases. More realistic modeling of the loss of MCR cooling would result in even lower results.

Table 1 Comparison of R5 EOOS, R5-RHU Model and R5-RHU-MCR Results Configuration*

R5 EOOS Model CDF R5-RHU Model CDF R5-RHU-MCR Model CDF ZTM (No Maintenance) 8.64E-07 7.48E-07 7.59E-07 Delta CDF Increase Over ZTM Div 1 HVK OOS (Trains A and C) 6.45E-06 4.04E-11 3.21E-10 Div 2 HVK OOS (Trains B and D) 6.37E-06 1.40E-10 1.61E-10 Div. 1 HVK & B OOS (Trains A, C & D) 6.84E-06 4.04E-11 3.48E-10 Div. 2 HVK & A OOS (Trains B, D & A) 6.73E-06 1.40E-10 1.88E-10

Quantification preformed assuming normal weather, default system alignments (defined in PSA-RB-01-002S10, Revision 1) and truncation of 1E-11/year.

As indicated above, the added R5-RHU-MCR model HFEs were conservatively assessed assuming one hour was available to perform the actions. However, Gothic calculations utilizing realistic MCR heat loads show that at least 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is available to perform the tasks for controlling MCR temperature. RBS has completed additional engineering evaluations and testing to develop best estimate realistic MCR heat loads. The results indicate that the realistic heat loads are about 56.7% of that based on equipment design heat loads. This lower heat load significantly slows MCR heat-up and delays the peak temperatures before operator action is taken. Refer to the graphs of MCR temperature in calculation ENTR-078-CALC-003 Rev.4 Attachment 5. Consideration of this additional time will significantly reduce the failure probability of the HFEs and therefore, further reduce the significance of loss of MCR room cooling. If this additional time available based on this new information was applied to the R5-RHU-MCR:

The operator actions to restore cooling would be more likely to succeed. It is estimated that with the realistic heat loads the operator time to take action to either align SW and start the ACU or to remove the ceiling tiles and start the smoke removal fan could be increased from 1

hour to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This would significantly reduce the failure probability of these HFEs. For example, the failure probability of aligning SW to the ACUs is 6.3E-02 in R5-RHU-MCR. Using SPAR HRA methodology and assuming only 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months are available, the failure probability would be 7E-04. Accounting for the extra time would significantly reduce the already very low contribution of risk from loss of MCR cooling.

The assumption that the impacted human actions in the MCR would fail after 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months following the loss of MCR cooling can also be extended to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This significantly increases the likelihood that the unit would be in a stable condition when the MCR became uninhabitable since most of the important HFEs would have been performed prior to that time, even if cooling is not restored.

Risk Deficit Calculations for Selected HVK Outages During 2014 The NRC uses the risk deficit parameter to determine the risk of a flawed assessment of maintenance risk performed per Maintenance Rule (MR) (a)(4). IMC0609 Appendix K defines risk deficit (ICDPD) as actual incremental core damage probability (ICDPactual) - the flawed incremental core damage probability (ICDPflawed) where the actual ICDP is the correct risk assessment and the flawed ICDP is incorrect. ICDP is calculated as the product of the incremental CDF (ICDF) of a configuration and the annualized fraction of the duration of the configuration (ICDP = ICDF X duration, hrs / 8760 hrs per reactor year). Incremental core damage frequency (ICDF) is equal to the configuration CDF - zero maintenance CDF. Therefore, ICDPD = ICDPactual - ICDPflawed.

As a result of a Special Inspection performed March 2015, the NRC identified a finding for Failure to Adequately Assess Risk During Chiller Unavailability. The following describes risk deficit calculations performed by RBS to determine the risk deficit of selected HVK divisional outages. (i.e., the longest outage during 2014 for each of the two Divisions).

Risk assessments originally performed for the HVK outages in 2014 were performed using the RBS R5 EOOS model. Since this model does not include MCR cooling and does not explicitly assess risk of loss of MCR cooling, risk assessments of HVK unavailability using the R5 EOOS model are considered flawed assessments per Appendix K. Risk assessments performed with the more realistic R5-RHU model would also be considered flawed as this model does not include MCR cooling. The actual assessment is performed with model RBS R5-RHU-MCR which incorporates MCR cooling. The only difference between the R5-RHU and R5-RHU-MCR models is the modeling of MCR cooling. As previously indicated including MCR cooling in nuclear plant PRA is not standard practice in the industry.

The risk assessments with each model were quantified assuming zero maintenance or only the identified maintenance/work activity in place, normal weather, default system alignments (defined in PRA-RB 002S10, Revision 1) and truncation of 1E-11/year. Note that the values for CDFConfig - CDFZTM used to calculate ICDP below are from Table 1.

Division 1, HVK A/C, Outage 10-23-2014 20:13 to 10-29-2014 9:17 (133hr 4min)

Since both the R5 EOOS and R5-RHU model assessment are considered flawed, ICDPD will be determined for this configuration with the R5-RHU-MCR used to determine the actual ICDP.

EOOS R5 ICDP ICDPEOOS R5 = (CDFConfig - CDFZTM ) X 133.07 / 8760

= (6.45E-06) X 133.07 / 8760

= 9.80E-08 R5-RHU ICDP ICDPR5-RHU = (CDFConfig - CDFZTM ) X 133.07 / 8760

= (4.04E-11) X 133.07 / 8760

= 6.13E-13 R5-RHU-MCR ICDP ICDPR5-RHU-MCR = (CDFConfig - CDFZTM ) X 133.07 / 8760

= (3.21E-10) X 133.07 / 8760

= 4.88E-12 Risk Deficit for R5-RHU-MCR compared to EOOS R5 ICDPDEOOS-R5 = ICDPR5-RHU-MCR - ICDPEOOS R5

= 4.88E 9.8E-08

= -9.8E-08 Risk Deficit for R5-RHU-MCR compared to R5-RHU ICDPDEOOS-R5 = ICDPR5-RHU-MCR - ICDPR5-RHU

= 4.88E 6.13E-13

= 4.26E-12 Division 2, HVK B/D, Outage 04-21-14 1:00 to 04-24-14 4:07 (75hr 7min)

During the HVK B/D outage time frame there was also light switchyard work (EOOS category Switchyard Other) performed from 04-22-14 09:18 to 11:07 (total of 1hr 49min). Because these activities were concurrent for a short period time, the ICDP is calculate separately for each configuration and then added together for the total ICDP for the duration of the HVK B/D outage.

Therefore the total HVK B/D OOS only time is 73hr 18min (75hr 7min - 1hr 49 in) during this period and both HVK B/D and Switchyard Other work occur concurrently for 1hr 49.

EOOS R5 ICDP ICDPEOOS R5 = (CDFHVK A/B - CDFZTM ) X 73.3 / 8760 + (CDFHVK A/B & SW Other - CDFZTM ) X 1.82 / 8760

= (6.37E-06) X 73.3 / 8760 + (3.63E 8.64E-07) X 1.82 / 8760

= 5.33E-08 + 7.34E-9

= 6.07E-08 R5-RHU ICDP ICDPR5-RHU = (CDFHVK A/B - CDFZTM ) X 73.3 / 8760 + (CDFHVK A/B & SW Other - CDFZTM ) X 1.82 / 8760

= (1.40E-10) X 73.3 / 8760 + (3.05E 7.48E-07) X 1.82 / 8760

= 1.17E-12 + 4.775E-10

= 4.787E-10 R5-RHU-MCR ICDP ICDPR5-RHU-MCR = (CDFHVK A/B - CDFZTM ) X 73.3 / 8760 + (CDFHVK A/B & SW Other - CDFZTM ) X 1.82 / 8760

= (1.61E-10) X 73.3 / 8760 + (3.06E 7.59E-07) X 1.82 / 8760

= 1.35E-12 + 4.778E-10

= 4.791E-10 Risk Deficit for R5-RHU-MCR compared to EOOS R5 ICDPDEOOS-R5 = ICDPR5-RHU-MCR - ICDPEOOS R5

= 4.79E 6.07E-08

= -6.02E-08 Risk Deficit for R5-RHU-MCR compared to R5-RHU ICDPDR5-RHU = ICDPR5-RHU-MCR - ICDPR5-RHU

= 4.791E 4.787E-10

= 4.56E-13 A summary of the risk deficit calculation results is provided in Table 2. The use of the more realistic PRA models, R5-RHU and R5-RHU-MCR, result in lower ICDP values for the above plant configurations compared to the RBS R5 EOOS model. As a result, the risk deficit based upon the R5 model in use for (a)(4) Configuration Risk Management during 2014 results in negative risk deficits. The risk deficit from the R5-RHU and R5-RHU-MCR models is entirely due to the risk of MCR cooling and is extremely small.

Table 2 Summary of Risk Deficit Calculations 2014 Outages Risk Deficit R5 vs. R5-RHU-MCR R5-RHU vs. R5-RHU-MCR Division 1 - HVK A/C 10-23-2014 20:13 to 10-29-2014 9:17

-9.8E-08 4.26E-12 Division 2 - HVK B/D 04-21-14 1:00 to 04-24-14 4:07*

-6.02E-08 4.56E-13

This time period also includes concurrent Switchyard work.

Risk Deficit Calculations for All HVK Outages During 2014 While not normal practice for assessing MR(a)(4) risk, the following calculations calculate the ICDPs for all the total time that the following configurations were in place during 2014: HVK A/C OOS, HVK B/D, HVK A/C & D, and HVK B/D & A. This will be used to evaluate the HVK outage configurations (includes same outage times) that were evaluated in the NRC Special Inspection report with each of the PRA models so ICDPD can be calculated. Note that the delta CDF values are from Table 1 Table 3 EOOS R5 ICPD for Combined 2014 HVK Outages HVK Division Configuration Time OOS (hrs)

Delta CDF ICDP Div 1 (HVK-A/C) (excludes below) 343.8 6.45E-06 2.53E-07 Div 2 (HVK-B/D) (excludes below) 135.7 6.37E-06 9.87E-08 Div 1 (HVK-A/C) + HVK-D 18.13 6.84E-06 1.42E-08 Div 2 (HVK-B/D) + HVK-A 94.33 6.73E-06 7.25E-08 EOOS R5 Total 2014 HVK ICDP 4.39E-07

Table 4 R5-RHU ICPD for Combined 2014 HVK Outages HVK Division Configuration Time OOS (hrs)

Delta CDF ICDP Div 1 (HVK-A/C) (excludes below) 343.8 4.04E-11 1.58E-12 Div 2 (HVK-B/D) (excludes below) 135.7 1.40E-10 2.17E-12 Div 1 (HVK-A/C) + HVK-D 18.13 4.04E-11 8.35E-14 Div 2 (HVK-B/D) + HVK-A 94.33 1.40E-10 1.51E-12 R5-RHU Total 2014 HVK ICDP 5.35E-12 Table 5 R5-RHU-MCR ICPD for Combined 2014 HVK Outages HVK Division Configuration Time OOS (hrs)

Delta CDF ICDP Div 1 (HVK-A/C) (excludes below) 343.8 3.21E-10 1.26E-11 Div 2 (HVK-B/D) (excludes below) 135.7 1.61E-10 2.49E-12 Div 1 (HVK-A/C) + HVK-D 18.13 3.48E-10 7.20E-13 Div 2 (HVK-B/D) + HVK-A 94.33 1.88E-10 2.02E-12 R5-RHU-MCR Total 2014 HVK ICDP 1.78E-11 2014 Risk Deficit for R5-RHU-MCR compared to EOOS R5 ICDPD2014 EOOS-R5

= ICDP2014 R5-RHU-MCR - ICDP2014 EOOS R5

= 1.78E 4.39E-07

= -4.39E-07 Risk Deficit for R5-RHU-MCR compared to R5-RHU ICDPD2014 R5-RHU

= ICDP2014 R5-RHU-MCR - ICDP2014 R5-RHU

= 1.78E 5.35E-12

= 1.25E-11 A summary of the risk deficit calculation results for the combined 2014 HVK outages is provided in Table 6. As in the in the previous evaluations, use of the more realistic PRA models, R5-RHU and R5-RHU-MCR, result in lower ICDP values compared to the RBS R5 EOOS model. Therefore, the risk deficit based upon the R5 model for the combined 2014 outages results in a negative risk deficit. The risk deficit from the R5-RHU and R5-RHU-MCR models is entirely due to the risk of MCR cooling and is extremely small.

Table 6 Summary of Risk Deficit Calculations Risk Deficit R5 vs. R5-RHU-MCR R5-RHU vs. R5-RHU-MCR Combined 2014 HVK Outages

-4.39E-07 1.25E-11 RBS Review of the NRCs SPAR Model Based on discussions with the NRC Region IV SRA, RBS understands that the SPAR model was used to calculate annual CDF increases for only the impact on CB SWGR cooling for each configuration of HVK OOS. These annual CDF increase included the chance that operators failed to: opened the SWGR doors,

aligned SW to and restart SWGR air conditioning units (HVC-ACU2A(B) and recovered an HVK chiller.

Then this annual SWGR CDFs were divided by the chance that the operator failed to open the SWGR room doors to estimate the chance that CR cooling would be lost. RBS generated the following summary of NRC Risk assessment associated with the 2014 HVK Divisional Outages, based on information discussed with the SRA.

Based in this input RBS endeavored to use the RBS SPAR model Revision 8.20 and SAPHIRE 8.0.1 to recreate the NRCs cutsets, relative to the impact of Division I and Division II HVK OOS on SWGR cooling.

Model changes were needed to address the power supplies to the HVK/HVC equipment similar to those made by the SRA. Once these results were generated RBS reviewed the dominant core damage sequences and cutsets with the NRC, confirming that they matched the NRCs results. RBS identified the following:

The dominant contributor was a loss of medium voltage bus (LOMVB) 4160 Safety-related Division I bus initiating event.

o The Division 2 OOS configuration were over four times as risk significant as Division 1 OOS configuration. This appeared to be due to how the SPAR model only assumed the loss of the Division I safety related bus as an initiator. Thus it appeared that for the Division 2 HVK OOS configurations the LOMVB initiating event would directly result in a loss of all remaining HVK chillers due to loss of power to the running Division I HVK train.

o If the SPAR model was reconfigured to align the LOMBV initiating event to the Division 2 bus, vice Division I and the Division 1 HVK OOS configuration run the results would be essentially the same for each division.

o The IE-LOMVB frequency was doubled since it was simplistically modeled on only one division.

The other contributors were Transients and Losses of the Condenser heat sink initiating events, with the subsequent failure of an ACU or the loss of the 4160 AC bus over the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period.

o RBS did note that for each of these initiating events there were cutsets that included failures of the ACU to start. This appeared to be an error in NRCs modeling as the

running ACU would continue to run following these initiating events and has been discussed with the NRC.

The LOMVB initiating event is not modeled in the RBS PRA, because a loss of a 4160 volt AC bus will not cause an automatic reactor SCRAM nor will it force the operators into inserting a manual SCRAM rapidly after the loss of the bus.

Summary RBS has expended significant effort in new engineering analyses, research and testing to incorporate more realism into the modeling of control building cooling into the RBS PRA. This effort has demonstrated that the R5 EOOS model currently in use and throughout 2014, is very conservative with regard to control building cooling. Modifications incorporated in the R5-RHU model significantly reduced the contribution of risk from loss of control building cooling to the AC switchgear, DC equipment and battery rooms. The addition of conservative modeling for cooling to the MCR in R5-RHU-MCR resulted in a relatively insignificant increase in CDF compared to the R5-RHU model. A third party review of this model was performed by Dr. Gareth Parry, a recognized expert in the PRA community. The use of the new models also has demonstrated that the risk of HVK outages during 2014 is not significant. Calculated risk deficit against the Revision 5 PRA model in use for Maintenance Rule configuration risk management is -4.39E-07, a negative risk deficit. Using the Revision R5-RHU PRA that accounts for refined control building heat-up calculations and improved electrical equipment survivability studies, the calculated risk deficit is the small value of 1.25E-11. The risk deficits for individual maintenance outages is smaller in magnitude. For the worst case Division 1 HVK outage, the risk deficit is -9.8E-08 using the Rev.5 model and 4.26E-12 using the R5-RHU model. For the worst case Division 2 HVK outage, the risk deficit is -6.02E-08 using the Rev.5 model and 4.56E-13 using the R5-RHU model. These results are consistent with the industry consensus that control room HVAC is a small contributor to risk. RBS has also concluded that risk assessments of HVK outages performed with the R5-EOOS model during 2014 have been demonstrated to be conservative.