Text

Potential Greater than Green (a)(4) Violation
	ML16092A037
Person / Time
Site:	River Bend
Issue date:	04/01/2016
From:	Cale Young; NRC/RGN-IV/DRP/RPB-C
To:	;
	Young C
References
	IR 2015010
	Download: ML16092A037 (9)
	v • d • e

1 Potential Greater Than Green (a)(4) Violation - River Bend The purpose of this paper is to provide a discussion on various aspects of the regulatory risk assessment performed to determine the significance of an (a)(4) performance deficiency at River Bend station. The details of the performance deficiency are documented in NRC Inspection Report 05000458/2015010, dated February 16, 2016.

The specific attributes of the assessment to be discussed below are:

Risk Aggregation Selection of the Exposure time Adequacy of Fire Risk Management Actions (RMAs)

Risk Aggregation The risk assessment prepared for the performance deficiency performs an aggregation of the risk impact from the individual maintenance configurations to develop an overall significance of the violation. This type of aggregation is inappropriate and is not supported by the Significance Determination Process (SDP) developed for (a)(4) violations. Applying the SDP as described in IMC 0609, Appendix K to the specific individual maintenance configurations and using the associated specific configuration unavailability times, results in the significance of each configuration being only a fraction of the improperly aggregated risk.

As stated in IMC 0308, Attachment 3, Appendix K, Technical Basis Document:

Maintenance Risk Assessment and Risk Management Significance Determination Process:

The intent of paragraph (a)(4) is to have licensees appropriately assess the risks of proposed maintenance activities that will (1) directly, or may inadvertently, result in equipment being taken out of service, (2) involve temporary alterations or modifications that could impact structure, system, or component (SSC) operation or performance, (3) be affected by other maintenance activities, plant conditions, or evolutions, and/or (4) be affected by external events, internal flooding, or containment integrity. Paragraph (a)(4) requires management of the resultant risk using insights from the assessment. Therefore, licensee risk assessments should properly determine the risk impact of planned maintenance configurations to allow effective implementation of RMAs to limit any potential risk increase when maintenance activities are actually being performed. Although the level of complexity in an assessment would be expected to differ from plant to plant, as well as from configuration to configuration within a given plant, it is expected that licensee risk assessments would provide insights for identifying risk-significant activities and minimizing their durations. (emphasis added)

For any performance deficiency associated with paragraph (a)(4), the determination of the significance is aligned to a specific configuration. In particular, the evaluations that ML16092A037

2 are performed to develop the significance of (a)(4) performance deficiencies use the Zero-Maintenance PRA model as opposed to the average Test and Maintenance PRA model used in the development of risk metrics associated with other aspects of the Reactor Oversight Process defined by IMC 0308 and implemented in IMC 0609. This concept of being aligned to a configuration is repeated throughout the process including the parameter definitions used in this significance determination process.

From IMC 0308,Section IV (emphasis added):

Incremental Core Damage Frequency (ICDF). The ICDF is the difference between the actual (adequately/accurately assessed) maintenance risk (configuration-specific CDF) and the zero-maintenance CDF. The configuration-specific CDF or ICDF is the annualized risk estimate with the out-of-service or otherwise affected SSCs considered unavailable.

Incremental Core Damage Probability (ICDP). The ICDP is the product of the incremental CDF and the annual fraction of the duration of the configuration [ i.e.,

ICDP = ICDF x (duration in hours)÷(8760 hours0.101 days 2.433 hours 0.0145 weeks 0.00333 months per reactor year)].

Incremental Core Damage Frequency Deficit (ICDFD). The ICDFD is that portion of the ICDF defined as the difference between the actual maintenance-configuration-specific CDF (called ICDFactual for purposes of this definition) and the maintenance-related ICDF as originally and inadequately assessed (flawed) by the licensee (ICDFflawed).

Incremental Core Damage Probability Deficit (ICDPD). The ICDPD is the product of the ICDFD and the Exposure (i.e., the annual fraction of the duration of the unassessed or inadequately assessed configuration, or that portion of the annual fraction of the duration of the maintenance configuration during which its risk remained unassessed or inadequately assessed). Thus the ICDPD = ICDFD x (exposure in hours) ÷ (8760 hours0.101 days 2.433 hours 0.0145 weeks 0.00333 months per reactor-year).

The above definitions are graphically represented in Figures 1 and 2 below. These figures are taken from IMC 0609, Appendix K.

The determination of any metric associated with an inadequate risk assessment is clearly tied to a specific configuration and not to an aggregated condition.

There are no provisions, as defined in IMC 0308 or as implemented in IMC 0609, for the aggregation of different configurations into an overall significance determination. There is no known precedent associated with this aggregation process associated with (a)(4) issues.

For this issue, the NRC has identified a number of specific maintenance configurations of various chillers being unavailable (and associated unavailability durations) for which the risk assessment and/or risk management was not adequate. Per IMC 0308 and

3 IMC 0609, each of these individual maintenance configurations must be assessed independently to determine the significance of the inadequate risk assessment for that configuration.

4 Selection of the Exposure Time To evaluate the significance of an (a)(4) related performance deficiency, the following information is required:

The Base Zero Maintenance CDF (LERF)

The actual Maintenance Configuration CDF (LERF)

The duration (Exposure) of the Maintenance Configuration As defined in IMC 0308 and implemented in IMC 0609, the determination of the Incremental Core Damage Probability Deficit (ICDPD) is based on the difference between the actual configuration risk and the inadequately assessed risk and the Exposure (i.e., the annual fraction of the duration of the unassessed or inadequately assessed configuration, or that portion of the annual fraction of the duration of the maintenance configuration during which its risk remained unassessed or inadequately assessed). (emphasis added)

For this performance deficiency, the inspection report identifies that an exposure time of one year was used for the regulatory assessment. This is inappropriate since none of the specific maintenance configurations listed have unavailability times of that magnitude individually. The Maintenance Rule is a performance based, risk informed rule. When there is a performance deficiency, the significance of the deficiency is aligned to the configuration duration associated with the deficiency, not to the process duration.

When the applicable maintenance configuration exposure times and the associated configuration delta CDF values (Actual Configuration Risk - Assessed Configuration Risk) are used, the realistic significance of this performance deficiency is only a fraction of the risk impact developed using the inappropriate Exposure time (aggregating the times of the individual and independent maintenance configurations).

Adequacy of Fire Risk Management Actions (RMAs)

The concept associated with Fire RMAs is different than that for RMAs developed as part of the Internal Events portion of the CRM process. Fire RMAs are directed at reducing the likelihood of a fire or at minimizing the consequences of a fire in the important fire areas. For any given Fire important component that is unavailable and for which Fire RMAs are desired, the main focus of those Fire RMAs is to protect the ability for the function to be successful. This aspect of the RMA development is similar to the internal events RMA development. Due to the spatial nature of fire events, the protection is aligned to the fire events in the areas that would result in the loss of the function.

The following guidance is provided in NUMARC 93-01, Revision 4A on the considerations associate with Fire RMA development:

5 11.3.7.5 Fire Risk Management Actions If the evaluation described in Section 11.3.7.3 indicates risk management actions are appropriate, the following actions should be considered:

1. Primary action: Coordinate activities within the plant that could involve increased fire risk with those maintenance activities involving removal from service of mitigation equipment important for fire risk. This involves coordination of fire protection personnel with maintenance rule (a)(4) personnel. Based on this coordination, evaluate appropriate risk management actions as discussed in Section 11.3.7.4.

2. Additional risk management actions specific to fire could include:

Re-scheduling activities that involve increased fire likelihood in fire areas where the out of service core damage mitigation equipment would be relied upon in the event of a fire Increased fire watches in fire areas where the out of service core damage mitigation equipment would be relied upon in the event of a fire Confirm the availability of an alternate success path for safe shutdown should it be needed. These could include alternative success paths excluded from design basis evaluations (e.g., Bleed & Feed Cooling (PWRs), Containment Venting (BWRs))

Entergy procedure ADM-0096, RISK MANAGEMENT PROGRAM IMPLEMENTATION AND ON-LINEMAINTENANCE RISK ASSESSMENT provides the station specific guidance on Fire RMAs and aligns well with the endorsed guidance in NUMARC 93-01.

Table 1 below lists the Fire RMAs contained in ADM-0096 that were developed to satisfy the guidance in NUMARC 93-01 and the corresponding attribute associated with either reducing the likelihood of a fire or reducing the magnitude of a fire should it occur.

Table 1: Comparison of River Bend Fire RMAs and NUMARC 93-01 Recommendations RMA RMA Description NUMARC 93-01 Attribute 1

Make a Main Control Room narrative log entry documenting the completion of the following:

Brief Fire Brigade and Operations on Fire Areas w/o credited SSD success path Identify Risk Mitigation equipment OOS Identify current success path for SSD Fire Fighting strategies for affected area(s)

Provides increased awareness and control 2

Identify Fire Areas w/o credited success path in POD & T-6 and T-2 Meetings Provides increased awareness and control 3

Limit/minimize combustibles in affected areas - walkdown to confirm Reduces magnitude of a potential fire 4

Prohibit Hot Work in affected areas - notify all Hot Work Supervisors Reduces likelihood of a potential fire 5

Confirm availability of fire detection and/or suppression in affected areas or adequacy of comp. measures Reduces magnitude of a potential fire

6 Table 1: Comparison of River Bend Fire RMAs and NUMARC 93-01 Recommendations RMA RMA Description NUMARC 93-01 Attribute 6

Confirm no impaired barriers in affected area or adequate comp.

measures in place Reduces magnitude of a potential fire 7

Prohibit/minimize electrical switching at panels in subject areas Reduces likelihood of a potential fire 8

Work Fire Risk Mitigation equipment on an accelerated schedule Reduces magnitude of the potential risk increase 9

Evaluate/Reschedule surveillances/PM that could affect FP equipment in area Reduces magnitude of a potential fire 10 Evaluate work in the affected area for compensatory measures Reduces magnitude of a potential fire 11 Determine if alternate or contingent SSD success path can be established Reduces magnitude of the potential risk increase Based on this review, the Fire RMAs developed in Entergy procedure ADM-0096 are aligned with the endorsed guidance in NUMARC 93-01 and are adequate to meet the intent of managing the increase in risk from the performance of maintenance activities.

7 Attachment A - Background Information

Background

For the succeeding 15 years, US utilities have implemented the requirements of 10CFR50.65, paragraph (a)(4) through a process referred to as Configuration Risk Management (CRM). This process, as required by paragraph (a)(4), assesses and manages the increase in risk from the performance of maintenance activities. And as noted by the name itself, the process evaluates the risk impact and provides insights associated with a specific configuration. If the configuration is changed, then the risk impact and associated insights are changed.

Risk Assessment of the Configuration As noted above, assessing the risk impact is performed on a configuration by configuration basis. Figure A below represents a set of maintenance configurations of unavailable equipment as follows:

Configuration 1 - Component A unavailable

Configuration 2 - Components A and B unavailable

Configuration 3 - Components A, B and C unavailable

Configuration 4 - Components A and C unavailable

Configuration 5 - Component C unavailable Figure A Each of these configurations is assessed independently of each other to generate a risk impact and associated insights that are used to manage the increase in risk from the

8 planned (or emergent ) maintenance activities. Note that there is no configuration of maintenance unavailability where Component B is the only unavailable component.

Determining Significance of a Performance Deficiency Associated with CRM NRC Manual Chapter 0609, Appendix K provides guidance on how to evaluate the significance of a performance deficiency associated with the Configuration Risk Management process. This process develops a risk deficit for the deficient condition that takes into account the base level of risk, the risk impact from the configuration and the duration that the configuration was in existence. This is shown graphically in Figures 1 and 2 of IMC 0609, Appendix A and repeated below.

Figure 1 shows the three pieces of information needed to develop an ICDP for a Maintenance configuration:

Zero-Maintenance Risk

Actual Maintenance Risk

Configuration Duration (Exposure)

Figure 2 from Appendix K provides the graphical representation of how the risk deficit is determined for an inadequate risk assessment. Using Figure A as an example, assume that the configuration of Components A and C (Configuration 4) was never assessed as

9 part of the CRM process for that work week, only Configuration 5, Component C by itself, was assessed. A determination of the risk impact would look similar to Figure 2 from IMC 0609, Appendix K (repeated below). In this case, the line labeled Inadequately Assessed Maintenance Risk is associated with the risk impact from Component C being unavailable by itself as this was the configuration assessed. The line labeled Actual Maintenance Risk represents the risk impact from Components A and C being unavailable. The width of the column, defined as Exposure, is the duration of time that the configuration of Components A and C were unavailable concurrently. The significance of the performance deficiency is associated with the Incremental Code Damage Probability Deficit (ICDPD). This represents the difference in the CDF between the Actual Maintenance Risk and the Inadequately Assessed Maintenance Risk times the Exposure divided by the number of hours in a year (8760 hours0.101 days 2.433 hours 0.0145 weeks 0.00333 months ). This is the fraction of a year that the configuration existed.