ML033580411

From kanterella
Jump to navigation Jump to search
Sensitivity Analysis
ML033580411
Person / Time
Site: Arkansas Nuclear  Entergy icon.png
Issue date: 11/21/2003
From:
- No Known Affiliation
To:
Office of Nuclear Reactor Regulation
References
FOIA/PA-2003-0358
Download: ML033580411 (11)
v • d • e


Text

Sensitivity Analysis A wide spectrum of sensitivity analyses were completed by requesting that the licensee calculate CCDP values which corresponded to various combinations of HEPs. The analysts determined that the calculated increase in CDF for Fire Zone 99-M was most likely in the range of 7E-6 to 2E-5. The analyst qualitatively determined that an additional increase in the CDF X.vas warranted due the existence f additionaLfire ones at the facilit whic also crIdited the use of operator recovery actions

_X _ _ _ _ 7 - __ i~~~~~~~~~~~~~~

Ox.:1- -T 47--

The licensee's human reliability analysis (HRA) was completed for non-fire conditions. The dominate recovery actions for a fire in Zone 99-M involved the establishment of emergency feedwater (EFW), the restoration of electrical power, and the establishment of feed and bleed capability. The associated non-fire human error probabilities for these recovery actions were 1.86E-1 for EFW, 1.OE-1 for electrical power, and 6E-3 for feed and bleed. The revised HRA estimate from the licensee included HEP values of 2.6E-1 for EFW, 1E-1 for electric power, and 3.2E-1 for feed and bleed.

The NRC analysts' completed a simplified HRA screening analysis using INEEL/EXT-99-0041, "Revision of the 1994 ASP HRA Methodology (Draft)," January 1999. The HEP values using the assumption that procedures were available, but poor were 1.0 for EFW, 7.5E-1 for electric power, and 7.5E-1 for feed and bleed. The HEP values using the assumption that procedures were adequate were 6E-1 for EFW, 5.5E-1 for electric power, and 5.5E-1 for feed and bleed.

The delta CDF non-fire results were obtained by subtracting the associated recovery term from the NON-FIRE NOMINAL VALUE. The delta CDF revised HRA results (SPAR and Licensee) were obtained by subtracting the associated recovery term from the associated REVISED HRA NOMINAL VALUE.

FIRE ZONE 99M - SEVERITY FACTOR NOT APPLIED RECOVERY TERM CDF DELTA CDF DELTA CDF DELTA CDF NON FIRE REVISED REVISED HRA H__RA H (SPAR) (LICENSEE)

NON-FIRE NOMINAL VALUE 5.37E-07 N/A N/A N/A REVISED HRA NOMINAL VALUE (SPAR) 2.23E-5 N/A N/A N/A REVISED HRA NOMINAL VALUE ESTIMATE 2.28E-6 N/A N/A N/A (LICENSEE)

ELECTRIC POWER 0.3, EFW 0.3, FEED 1.21 E-06 6.73E-07 N/A N/A AND BLEED 6E-3 ELECTRIC POWER 0.3, EFW 0.6, FEED 6.05E-06 5.51 E-06 N/A 3.77E-6 AND BLEED 6E-3 ELECTRIC POWER 0.6, EFW 0.6, FEED 7.73E-06 7.19E-06 N/A 5.45E-6 AND BLEED 6E-3 ELECTRIC POWER 0.3, EFW 0.6, FEED 8.46E-06 7.92E-06 N/A 6.18E-6 AND BLEED 0.1 ELECTRIC POWER 0.3, EFW 0.6, FEED 1.52E-05 1.47E-05 N/A 1.29E-5 AND BLEED 0.3 ELECTRIC POWER 0.55, EFW 0.6, AND 2.23E-5 2.1 8E-5 N/A 2.OOE-5 FEED AND BLEED 0.55 ELECTRIC POWER 0.1, EFW 1.0, FEED 2.28E-05 2.23E-05 5.OOE-7 2.05E-5 AND BLEED 6E-3 ELECTRIC POWER 1.0, EFW 1.0, FEED 2.44E-05 2.39E-05 2.10E-6 2.21 E-5 AND BLEED 6E-3 ELECTRIC POWER 0.75, EFW 1.0, FEED 1.07E-04 1.06E-04 8.47E-5 1.05E-4 AND BLEED 0.75 2 ,0 o s 3 X - . _ _

FIRE ZONE 99M WITH SEVERITY FACTOR APPLIED RECOVERY TERM CDF DELTA CDF DELTA CDF DELTA CDF NON FIRE REVISED REVISED HRA HRA HRA (SPAR) (LICENSEE)

NON-FIRE NOMINAL VALUE 3.15E-07 NIA NSA N/A REVISED HRA NOMINAL VALUE (SPAR) 1.31E-5 N/A N/A N/A REVISED HRA NOMINAL VALUE ESTIMATE 1.43E-6 N/A N/A N/A (LICENSEE)

ELECTRIC POWER 0.3, EFW 0.3, FEED 7.13E-07 3.98E-07 N/A N/A AND BLEED 6E-3 ELECTRIC POWER 0.3, EFW 0.6, FEED 3.55E-06 3.24E-06 N/A 2.21 E-6 AND BLEED 6E-3 ELECTRIC POWER 0.3, EFW 0.6, FEED 4.97E-06 4.66E-06 N/A 3.63E-6 AND BLEED 0.1 ELECTRIC POWER 0.3, EFW 0.6, FEED 8.94E-06 8.63E-06 N/A 7.6E-6 AND BLEED 0.3 ELECTRIC POWER 0.6, EFW 0.6, FEED 9.74E-06 9.43E-06 N/A 8.40E-6 AND BLEED 6E-3 ELECTRIC POWER 0.55, EFW 0.6, FEED 1.31 E-5 1.28E-5 N/A 1.1 8E-7 AND BLEED 0.55 ELECTRIC POWER 0.1, EFW 1.0, FEED 1.34E-05 1.31 E-05 3.OE-7 1.21 E-5 AND BLEED 6E-3 ELECTRIC POWER 1.0, EFW 1.0, FEED 1.43E-05 1.40E-05 1.20E-6 1.30E-5 AND BLEED 6E-3 ELECTRIC POWER 0.75, EFW 1.0, FEED 6.31 E-05 6.28E-05 5.OOE-5 6.18E-5 AND BLEED 0.75

A qualitative analysis of similarly affected fire zones in Unit 1 and Unit 2 was completed. The analyst compared the remaining 15 fire zones in Unit 1 which required manual actions for safe shutdown to Calculation 85-E-0053-47, "Individual Plant Examination of External Events/Fire,"

Revision 2, to determine which fire zones were unscreened as part of the FIVE analysis. The following fire zones were unscreened.

Fire Description Ignition Automatic Multiple Zone Frequency Suppression Redundant Trains 197-X Turbine Building (A1/A2 Failed) 7.31 E-3 Partial No 149-E Upper North Electrical Penetration 2.66E-3 Yes Yes 100-N South Switchgear Room 1.13E-3 No Yes 104-S Electrical Equipment Room 3.71 E-3 No Yes 105-T Lower South Electrical Penetration 3.07E-4 Yes No Room 73-W Bowling Alley 1.06E-3 Partial Yes 76-W Compressor Room 3.86E-3 No Yes 34-Y Auxiliary Building Piping Area 5.91 E-4 No Yes The analyst compared the 21 fire zones in Unit 2 which required manual actions for safe shutdown to Calculation 85-E-0053-48, "Individual Plant Examination of External Events/Fire,"

Revision 2, to determine which fire zones were unscreened as part of the FIVE analysis. The following fire zones were unscreened:

Description Ignition Automatic Multiple Frequency Suppression Redundant Trains I 2200-MM Turbine Building A1/A2 Failed 1.8E-2 Partial No 2200-MM Turbine Building A1/A2 Not Failed 1.18E-3 Partial No 2100-Z 4160 Volt Switchgear Room A4 1.13E-3 No Yes 2096-M MCC (2B63) 1.25E-3 No Yes 2101 -AA 4160 Volt Switchgear Room A3 1.08E-3 No No 2108-S Electrical Equipment Room 368 6.3E-4 No Yes 2109-U EDG Access Corridor 2.01 E-3 Partial Yes 00 Intake Structure 1.78E-3 Partial Yes

Fire Description Ignition Automatic Multiple Zone Frequency Suppression Redundant Trains B3SC Super Compartment for Auxiliary 9.28E-3 No Yes Building (Area of concern is 2091 -BB) 2055SC Super Compartment for Lower 6.62E-4 2084-DD No 2084-DD Yes South Electrical and Piping Penetration Room 2111-T Yes 2111-T No 2040-JJ Auxiliary Building Elevation 335 7.92E-3 No Yes 2063SC Super Compartment for Auxiliary 5.94E-3 Partial Yes Building Elevation 354 The analysts' quantitative analysis determined that Fire Zone 98-J was of low safety significance due to the availability of automatic suppression capability and Fire Zone 99-M had either low to moderate or substantial safety significance due to not having automatic suppression capability.

The analysts determined that Fire Zones 98-J and 99-M had ignition frequencies between 2E-3 and 4E-3 and that both fire zones included multiple redundant trains of safe shut down equipment. The analysts determined the significance of a fire in a particular fire zone would be reduced if multiple redundant trains of equipment were "not" affected or if the fire zone had a relatively low ignition frequency (less than 1E-3). Accordingly, the analysts qualitatively removed fire zones from further consideration if any of the following conditions existed: the ignition frequency was less than 1E-3, the affected area had automatic suppression capability, or multiple redundant trains of safe shutdown equipment were "not" affected by a postulated fire.

The following fire zones required an additional assessment of the affected trains of redundant equipment:

Unit 1 Unit 2 100-N 21 OO-Z 104-S 2096-M 76-W 2091 -BB 2040-JJ

The analysts qualitatively compared the safety functions affected in Fire Zone 99-M to the safety functions affected by a fire in the above unscreened fire zones.

Unit 1 Fire Zone Unit 2 Fire Zone Safety 99-M 100-N 104-S :-76-W 2100-Z 2096-M 2091 -BB 2040-JJ Function White White White or Green White White White White or Yellow Yellow Main 1/1'11 /1. 0/1':. / 1/1

/ 0/1 Feedwater High 2/3 213 323 1/3 1/3 013 3/3 Pressure Injection ._._._-_-

Low 1/2 112 212 11/2 1/2 0/2 013 1/2 Pressure Injection - '; . .

Service 112 1/2 2/2 -1/ 1/3 0/3 0/3 1/3 Water Diesel 2/2 2/2 2/2 1/2 2/2 1/2 1/2 1/2 Generator Emergency 4/4 3/4 4/4 3/4 0/2 2/22/2 1/2 Feedwater.-.2 Flow-paths .r__ _ . I-41 . YIY-f.Jdf,.. I'4UiIU iv^.

lI.lemhor Ui IOII 111JIIIIJOI VI ICIIIVU

/NathU

' ia US trIinO LICIII&WOWIIIIJUI U1 CVCXIJCIUIU 41CHIM,

Human Reliability Screening Analysis ANO Fire Issue

Background

During the triennial fire inspection, the team determined that the licensee had not implemented appropriate procedural controls for a fire in Fire Areas 99-M (Green Train switchgear room) and 98-J (corridor with Red and Green Train conduit). Specifically, the licensee relied solely on a symptomatic response to a fire in these areas. For example, if control room operator became aware of a loss of feedwater condition, then operators would respond by aligning auxiliary feedwater (AFW) from either the control room or locally. This approach differed from other alternate shutdown areas of the plant. For these areas, specific procedural guidance (Procedure 1203.002, "Alternate Shutdown") existed to direct the operators to isolate and then restore potentially affected components.

The following four broad classes of operator actions were evaluated:

  • Isolation of letdown flow and inventory control.
  • Local start of an EDG without DC control power.

For each of the above classes, an operator would be required to successfully diagnose the system failure, determine the appropriate procedure, and then take the appropriate series of operator actions to mitigate the failure. There were several complicating factors in completing the analysis because the operator actions would be required following a major fire. Specifically the fire could result in:

  • Suspect indications associated with critical plant parameters.
  • Spurious actuations of plant equipment which are detrimental to the event.
  • Failure of plant equipment to respond automatically.
  • Inability to remotely operate plant equipment from the main control room.
  • Previously implemented operator actions could become over-ridden by subsequent operator actions through the use of multiple procedures in lieu of a single prioritized procedure.

Assumptions

1. An "Extreme Stress" classification was used for each class of operator actions. This level of stress is likely to occur when the onset of the stressor is sudden and the stressing situation persists for long periods.
2. An "Available, But Poor" classification was used for the procedural actions necessary to recover failed or degraded mitigating equipment. This classification is used for conditions where a procedure is available but inadequate. This classification level was chosen because of the symptomatic response of operators to a fire instead of a having a pre-planned alternate shutdown procedure. If properly diagnosed, procedures existed for operators to implement the individual system recovery actions. However, there may be dependencies between the procedures which are not accounted for. Specifically, to recover AC power, the operators may need to open the individual breakers on various switchgear. This activity could affect previous actions to restore mitigating systems. A single pre-planned procedure would account for the dependencies between procedures such that subsequent recovery actions do not affect previously implemented recovery actions.
3. A "Barely Adequate Time" classification was used for diagnosing a loss of flow to the steam generators and establishing AFW flow. This classification level was chosen based on the potential for indications and controls not being available in the control room. The timing associated with initiating AFW flow is dependent on operator actions to secure reactor coolant pumps. In addition, the flow rate to the steam generators must be controlled to prevent over-cooling and shrinkage of the reactor coolant system.
4. A "Barely Adequate Time" classification was used for diagnosing an EDG without service water and for securing the affected EDG. The EDG without service water flow must be secured within 7 minutes to prevent overheating and mechanical damage. The failure to secure the EDG could potentially prevent recovery of an emergency AC power source.
5. A "Barely Adequate Time" classification was used for diagnosing the failure of letdown to isolate and for securing letdown. If letdown is isolated within 4 minutes, then inventory control may not be required for 40 minutes. The failure to isolate letdown directly impacts the time available to initiate inventory control.
6. A uHighly Complex" classification was used for a local start of the EDG without DC power. This procedure is infrequently performed, requires a high degree of skill, and includes multiple steps to complete.
7. A "Moderately Complex" classification was used for a local manual start of an AFW pump and for local manual control of AFW flow to a steam generator. This activity is infrequently performed and would require constant communication with personnel monitoring important plant parameters to ensure the appropriate heat removal rate was maintained.
8. Limited personnel would be available during the first hour following a fire. Two individuals would be available for field operations (1 main control room reactor operator and 1 auxiliary operator). The remaining personnel would be assigned other functions.

Specifically, the shift manager would be assigned emergency response organization duties, the control room supervisor and one reactor operator would remain in the main control room, the waste control operator and 1 auxiliary operator would be assigned to the fire brigade. The shift engineer would be available to provide assistance where necessary. A Unit 2 operator would be dispatched to start the alternate EDG. The

licensee did not credit the use of Unit 2 operators in the performance of Unit 1 plant manipulations.

The analyst determined that 1 operator would need to be dedicated to the restoration of AFW and the operation of the AFW flow control valves. The remaining operator would be required to complete all other evolutions (Isolate letdown, local start of the EDG, and all breaker manipulations). In contrast, the alternate shutdown procedure requires four operators, as a minimum, for successful completion. The analyst determined that the majority of actions specified in the alternate shutdown procedure could potentially be required for a major fire in Fire Areas 99-M or 98-J.

References

1. INEEUJEXT-99-0041, "Revision of the 1994 ASP HRA Methodology (Draft)," January 1999
2. Procedure 1203.002, "Alternate Shutdown"
3. Procedure 1104.036, "Emergency Diesel Generator Operation"
4. Procedure 1106.006, 'Emergency Feedwater Pump Operation"
5. Procedure 1202.008, "Blackout"
6. Procedure 1202.007, "Degraded Power"
7. Procedure 2104.037, "Alternate AC Diesel Generator Operations"
8. Procedure 1107.001, "Electrical System Operations"
9. Procedure 1107.002, "ES Electrical System Operation"
10. Procedure 1104.002, "Makeup & Purification System Operation"
11. Procedure 2104.028, "Component Cooling Water System Operation"
12. Fire Hazards Analysis
13. IPEEE Fire Calculation 85-E-0053-47
14. ANO Appendix R Position Paper, "Emergency Diesel Generator Access Corridor Fire Zone 98-J"

Diagnosis Failure Probability Recovery Diagnosis Time Stress Complexity Experience Procedures Ergonomics Fitness For Work Diagnosis Action Factor & Training Duty Processes Failure l__ _ _ _ _ _ _ _ _ _ _ _ l _ __ __ __ ___ __ __ __ __ _ __ __ _ _ __ _ __ __ __ _ _ P r ob ab ility Establish 1E-2 10 5 1 1 1 1 1 1 0.5 AFW Secure EDG 1E-2 10 5 1 1 1 1 1 1 0.5 Without Service Water Local EDG 1E-2 1 5 1 1 1 1 1 1 0.05 Start Isolate 1E-2 10 5 1 1 1 1 1 1 0.5 Letdown and Inventory Control Action Failure Probability Without Adequate Procedures Recovery Action Time Stress Complexity Experience Procedures Ergonomics Fitness For Work Action Failure Action Factor & Training Duty Processes Probability Establish 1E-3 10 5 2 1 5 1 1 1 0.5 AFW Secure EDG 1E-3 10 5 1 1 5 1 1 1 0.25 Without Service Water Local EDG 1E-3 1 5 5 1 5 1 1 1 0.125 Start Isolate 1E-3 10 5 1 1 5 1 1 1 0.25 Letdown and Inventory Control

Task Failure Probability Without Adequate Procedures Recovery Action Diagnosis Failure Probability Action Failure Probability Task Failure Probability Without Formal Dependence Establish AFW 0.5 0.5 1.0 Secure EDG Without Service 0.5 0.25 0.75 Water Local EDG Start 0.05 0.125 0.13 Isolate Letdown and Inventory 0.5 0.25 0.75 Control

_________Action Failure Probability W ithAdequateProcedures _ _ _ _ _

Recovery Action Time Stress Complexity Experience Procedures Ergonomics Fitness For Work Action Failure Action Factor &Training Duty Processes Probability Establish 1E-3 10 5 2 1 1 1 1 1 0.1 AFW Secure EDG 1EE-3 10 5 1 1 1 1 1 1 0.05 Without Service Water Local EDG 1E-3 1 5 5 1 1 1 1. 1 0.025 Start Isolate 1E-3 10 5 1 1 1 1 1 1 0.05 Letdown and Inventory Control

Task Failure Probability With Adequate Procedures Recovery Action Diagnosis Failure Probability Action Failure Probability Task Failure Probability Without Formal Dependence Establish AW 0.5 0.1 0.6 Secure EDG Without Service 0.5 0.05 0.55 Water Local EDG Start 0.05 0.025 0..03 Isolate Letdown and Inventory 0.5 0.05 0.55 Control

Retrieved from "https://kanterella.com/w/index.php?title=ML033580411&oldid=2687826"